40 matches found
CVE-2007-1452
The FDF support ext/fdf in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypass web site filters via an application/vnd.fdf formatted POST...
CVE-2007-1452
The FDF support ext/fdf in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypass web site filters via an application/vnd.fdf formatted POST...
EUVD-2007-1446
The FDF support ext/fdf in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypass web site filters via an application/vnd.fdf formatted POST...
CVE-2007-1452
The FDF support ext/fdf in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypass web site filters via an application/vnd.fdf formatted POST...
CVE-2007-1452: Undefined Security Weakness
The FDF support ext/fdf in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypass web site filters via an application/vnd.fdf formatted POST...
PHP ext/filter FDF Post数据过滤绕过漏洞
PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP新实现的ext/filter FDF扩展实现上存在漏洞，远程攻击者可能利用此绕过用户数据过滤，从而在服务器上执行各种注入攻击。 根据设计，PHP的内容过滤钩子会在所有解析用户输入并注册为变量的地方添加对输入过滤器的调用，以确定如何处理这些变量，但添加对其他POST内容类型支持的所有扩展也需要实现钩子，否则数据就会绕过过滤。如果安装了ext/fdf的话PHP就会捆绑一个对FDF POST数据格式的扩展，但没有调用输入过滤器，因此攻击者就可能绕过所强制的过滤机制，获得非授权访问。 PHP = 5.2.0...
PHP <= 5.2.0 ext/filter FDF Post Filter Bypass Exploit
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...
PHP <= 5.2.0 ext/filter FDF Post Filter Bypass Exploit
Exploit for multiple platform in category remote exploits ====================================================== PHP alert/XSS/;"; $POST'var2' = " ' UNION SELECT "; $url = "http://127.0.0.1/info.php"; // You do not need to change...
MOPB-17-2007:PHP ext/filter FDF Post Bypass Vulnerability
Summary Since PHP 5.2.0 there is a new filtering extension in PHP that is on the one hand supposed to be used by applications to filter user input and on the other hand able to enforce site wide filtering. However due to its broken design it is possible to sneak POST data through the site wide...
PHP 5.2.0 - EXT/Filter FDF Post Filter Bypass
alert/XSS/;"; $POST'var2' = " ' UNION SELECT "; $url = "http://127.0.0.1/info.php"; // You do not need to change anything below this $outfdf = fdfcreate; foreach $POST as $key = $value fdfsetvalue$outfdf, $key, $value, 0; fdfsave$outfdf, "outtest.fdf"; fdfclose$outfdf; $ret =...
PHP <= 5.2.0 ext/filter FDF Post Filter Bypass Exploit
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...
PHP FDF POST request filtering protection bypass
FDF extension doesn't support filtering...
PHP 5.2.0 - EXTFilter FDF Post Filter Bypass
PHP 5.2.0 - EXTFilter FDF Post Filter Bypass alert/XSS/;"; $POST'var2' = " ' UNION SELECT "; $url = "http://127.0.0.1/info.php"; // You do not need to change anything below this $outfdf = fdfcreate; foreach $POST as $key = $value fdfsetvalue$outfdf, $key, $value, 0; fdfsave$outfdf, "outtest.fdf";...
security flaw
Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the 1 FDF, 2 XML, or 3 XFDF AJAX request parameters...
Cross site request forgery (csrf)
Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the 1 FDF, 2 xml, and 3 xfdf AJAX request parameters, following the hash character, aka...
Crlf injection
CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the...
CVE-2007-0046
Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the 1 FDF, 2 XML, or 3 XFDF AJAX request parameters...
Double free
Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the 1 FDF, 2 XML, or 3 XFDF AJAX request parameters...
CVE-2007-0045
Multiple cross-site scripting XSS vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770...
CVE-2007-0044: Cross-Site Request Forgery (CSRF)
Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the 1 FDF, 2 xml, and 3 xfdf AJAX request parameters, following the hash character, aka...