CVE-2002-2190

ArtsCore Studios CuteCast Forum 1.2 stores passwords in plaintext under the web document root, which allows remote attackers to obtain the passwords via an HTTP request to a .user file...

W-Agora 4.1.6 - EditForm.php Cross-Site Scripting

W-Agora 4.1.6 - EditForm.php Cross-Site Scripting source: https://www.securityfocus.com/bid/6464/info W-Agora is a freely available, open source PHP forum software package. It is available for Unix and Linux systems. A problem with W-Agora may make cross-site scripting attacks possible. It has be...

XSS and PHP include bug in W-Agora

I have found some bugs in W-Agora's forum configuration filesystem. In the page editform.php, an admin or root user can open any file, with the "PHP Include bug". A sample of the script: editform.php ?php the script gets the parameter "file", puts ".php" after this, and includes the file in the...

Security Patchs for PHP Products

PHPSecure made some patchs for security holes in PHP products. Here is the list : - ALP - Banner Ad 2.0 : http://www.phpsecure.org/index.php?id=1&zone=pDl More details : http://online.securityfocus.com/search?category=22&query=ALP - Tight Auction 3.0 :...

APBoard-Bug

Product: APBoard-Bug Versions: tested on 2.02 Vulnerability: users can subscribe a thread in the internal forum Date: Dezember 5, 2002 Discovered by: DNA [email protected] Introduction: Normal Users can read new answers to a thread in the internal forum I have already informed APP about this...

APBoard 2.0 2 - Unauthorized Thread Reading

APBoard 2.0 2 - Unauthorized Thread Reading source: https://www.securityfocus.com/bid/6330/info A vulnerability has been reported for APBoard that may allow unauthorized users to read postings in internal forums. The vulnerability is a result of the 'useraction.php' script failing to properly che...

YaBB 1 Gold SP 1 - YaBB.pl Cross-Site Scripting

YaBB 1 Gold SP 1 - YaBB.pl Cross-Site Scripting source: https://www.securityfocus.com/bid/6272/info A cross-site scripting vulnerability has been reported in the YaBB forum. This vulnerability is due to insufficient sanitization of URI parameters in some scripts. As a result, it is possible for a...

YaBB 1 Gold SP 1 - 'YaBB.pl' Cross-Site Scripting

source: https://www.securityfocus.com/bid/6272/info A cross-site scripting vulnerability has been reported in the YaBB forum. This vulnerability is due to insufficient sanitization of URI parameters in some scripts. As a result, it is possible for a remote attacker to create a malicious link to t...

phpBB 2.0.3 - Script Injection

source: https://www.securityfocus.com/bid/6248/info phpBB does not properly sanitize user input in forum postings. This could allow a malicious user to inject script code into a forum post which would in turn be executed when the page is viewed by other users. Script code would be executed in the...

vBulletin 2.2.7/2.2.8 - HTML Injection

source: https://www.securityfocus.com/bid/6337/info Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages. vBulletin does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user chooses to...

Vulnerability in Cutecast Forum v1.2

Vulnerability in Cutecast Forum v1.2 You can read passwords of all users. Passwords in Plaintext Exploit: http://www.website.com/cgi-bin/cutecast/members/username.user Zero X, member of www.lobnan.de -- http://www.linuxmail.org/ Now with POP3/IMAP access for only US$19.95/yr Powered by Outblaze...

dobermann FORUM (php)

Informations : °°°°°°°°°°°°°° Product : dobermann FORUM version : 0.5 website : http://www.le-dobermann.com Problem : Include file PHP Code/location : °°°°°°°°°°°°°°°°°°° entete.php enteteacceuil.php topic/entete.php : ------------------------------------------ ?php @include...

Benjamin Lefevre Dobermann Forum 0.x - enteteacceuil.php?subpath Remote File Inclusion

Benjamin Lefevre Dobermann Forum 0.x - enteteacceuil.php?subpath Remote File Inclusion source: https://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several P...

Benjamin Lefevre Dobermann Forum 0.x - 'newtopic.php?subpath' Remote File Inclusion

source: https://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Dobermann. An attacker may exploit this by supplying a pa...

Benjamin Lefevre Dobermann Forum 0.x - 'index.php?subpath' Remote File Inclusion

source: https://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Dobermann. An attacker may exploit this by supplying a pa...

Benjamin Lefevre Dobermann Forum 0.x - index.php?subpath Remote File Inclusion

Benjamin Lefevre Dobermann Forum 0.x - index.php?subpath Remote File Inclusion source: https://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP scrip...

Benjamin Lefevre Dobermann Forum 0.x - entete.php?subpath Remote File Inclusion

Benjamin Lefevre Dobermann Forum 0.x - entete.php?subpath Remote File Inclusion source: https://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP scri...

Benjamin Lefevre Dobermann Forum 0.x - newtopic.php?subpath Remote File Inclusion

Benjamin Lefevre Dobermann Forum 0.x - newtopic.php?subpath Remote File Inclusion source: https://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP...

Benjamin Lefevre Dobermann Forum 0.x - 'enteteacceuil.php?subpath' Remote File Inclusion

source: https://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Dobermann. An attacker may exploit this by supplying a pa...

YaBB 1.401.41 - Login Cross-Site Scripting

YaBB 1.401.41 - Login Cross-Site Scripting source: https://www.securityfocus.com/bid/6004/info A cross-site scripting vulnerability has been reported in the YaBB Yet Another Bulletin Board forum login script. HTML tags or script code are not sanitized from the error output of erroneous login...