Path disclosure in Etomite

Vulnerability ID: HTB22711 Reference: http://www.htbridge.ch/advisory/pathdisclosureinetomite.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor...

SQL Injection in Etomite

Vulnerability ID: HTB22714 Reference: http://www.htbridge.ch/advisory/sqlinjectioninetomite1.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor...

Local file view in Etomite

Vulnerability ID: HTB22712 Reference: http://www.htbridge.ch/advisory/localfileviewinetomite.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: Status: Not Fixed, Vendor Alerted, Awaiting...

Etomite 1.1 SQL,XSS,and file include vulnerabilities and fixes-vulnerability warning-the black bar safety net

Due to thevulnerabilityexists in“/index.php”the script has not been filtered will provide a search variable input. The attacker can modify the application the SQL query to the database, execute arbitrary queries of the database, compromise the application, access or modify sensitive data, or use ...

Etomite 1.1 Multiple Vulnerabilities

Exploit for php platform in category web applications ==================================== Etomite 1.1 Multiple Vulnerabilities ==================================== Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 20...

Etomite 1.1 Cross Site Scripting / Path Disclosure / SQL Injection

Vulnerability ID: HTB22710 Reference: http://www.htbridge.ch/advisory/sqlinjectioninetomite.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor...

etomite 1.1 - Multiple Vulnerabilities

Vulnerability ID: HTB22710 Reference: http://www.htbridge.ch/advisory/sqlinjectioninetomite.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor...

etomite 1.1 - Multiple Vulnerabilities

etomite 1.1 - Multiple Vulnerabilities Vulnerability ID: HTB22710 Reference: http://www.htbridge.ch/advisory/sqlinjectioninetomite.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: SQL...

Multiple Vulnerabilities in Etomite

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Etomite which could be exploited to perform cross-site scripting and SQL injection attacks and gain access to sensitive information. 1 Cross-site scripting XSS vulnerability in Etomite The vulnerability exists du...

Etomite CMS id Paramater SQL Injection

The remote web server contains a PHP script that is affected by a SQL injection vulnerability. Description: The remote web server is running Etomite CMS, a PHP-based content management system. The version of Etomite CMS installed on the remote host fails to sanitize input to the 'id' parameter...

Etomite CMS id Parameter SQL Injection

The remote web server contains a PHP script that is affected by a SQL injection vulnerability. Description: The remote web server is running Etomite CMS, a PHP-based content management system. The version of Etomite CMS installed on the remote host fails to sanitize input to the...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Etomite 0.6.1.4 Final allows remote attackers to inject arbitrary web script or HTML via $SERVER'PHPINFO'. NOTE: the vendor disputes this issue in a followup, stating that the affected variable is $SERVER'PHPSELF', and "This is not an Etomite...

CVE-2008-0820

Cross-site scripting XSS vulnerability in index.php in Etomite 0.6.1.4 Final allows remote attackers to inject arbitrary web script or HTML via $SERVER'PHPINFO'. NOTE: the vendor disputes this issue in a followup, stating that the affected variable is $SERVER'PHPSELF', and "This is not an Etomite...

CVE-2008-0820

CVE-2008-0820 affects Etomite 0.6.1.4 Final with a reported XSS in index.php exploitable via the server variable (initially cited as $_SERVER['PHP_INFO'], vendor later asserts the variable is $_SERVER['PHP_SELF']). Multiple sources corroborate an XSS vulnerability, but the vendor disputes the rep...

CVE-2008-0820

Cross-site scripting XSS vulnerability in index.php in Etomite 0.6.1.4 Final allows remote attackers to inject arbitrary web script or HTML via $SERVER'PHPINFO'. NOTE: the vendor disputes this issue in a followup, stating that the affected variable is $SERVER'PHPSELF', and "This is not an Etomite...

PT-2008-2438 · Etomite · Etomite

Name of the Vulnerable Software and Affected Versions: Etomite version 0.6.1.4 Final Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. The issue is disputed by the vendor, who claims the affected variable is $ SERVER'PHP SELF' and states...

CVE-2006-7070

Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile parameter with a filename that contains a .php extension followed by a valid image extension such as .gif...

CVE-2006-7070

CVE-2006-7070 affects Etomite CMS 0.6.1 and earlier. Unrestricted file upload via manager/media/ibrowser/scripts/rfiles.php using nfile[] allows a filename containing .php followed by a valid image extension (e.g., .gif or .jpg) and, after rename(), enables remote upload and execution of arbitrar...

CVE-2006-7070

Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile parameter with a filename that contains a .php extension followed by a valid image extension such as .gif...

Etomite CMS index.php id Parameter SQL Injection

The remote web server is running Etomite CMS, a PHP-based content management system. The version of Etomite CMS installed on the remote host fails to sanitize input to the 'id' parameter before using it in the 'index.php' script in a database query. Provided PHP's 'magicquotesgpc' setting is...