CVE-2006-2822

SQL injection vulnerability in admin/default.asp in Dusan Drobac CodeAvalanche FreeForum aka CAForum 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

EV0089.txt

New eVuln Advisory: FreeForum PHP Code Execution & Multiple XSS Vulnerabilities http://evuln.com/vulns/89/summary.html --------------------Summary---------------- eVuln ID: EV0089 CVE: CVE-2006-0957 CVE-2006-0958 Vendor: ZoneO-Soft Vendor's Web Site: http://soft.zoneo.net/ Software: FreeForum...

[eVuln] FreeForum PHP Code Execution & Multiple XSS Vulnerabilities

New eVuln Advisory: FreeForum PHP Code Execution & Multiple XSS Vulnerabilities http://evuln.com/vulns/89/summary.html --------------------Summary---------------- eVuln ID: EV0089 CVE: CVE-2006-0957 CVE-2006-0958 Vendor: ZoneO-Soft Vendor's Web Site: http://soft.zoneo.net/ Software: FreeForum...

CVE-2006-0957

Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the 1 X-Forwarded-For and 2 Client-Ip HTTP headers, which are stored in Data/flood.db.php...

CVE-2006-0958

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

CVE-2006-0958

FreeForum by ZoneO-Soft (vendor: ZoneO-Soft) prior to version 1.2.1 is affected. CVE-2006-0958 stems from unsanitized inputs in func.inc.php, allowing cross-site scripting via the name and subject parameters. Related linked advisory EV0089 also describes a PHP code execution path through unvalida...

CVE-2006-0957

CVE-2006-0957 affects ZoneO-Soft FreeForum (before 1.2.1). A direct static code injection vulnerability exists in func.inc.php where HTTP headers X-Forwarded-For and Client-Ip are written to Data/flood.db.php, enabling remote attackers to inject and execute arbitrary PHP code. The vulnerability a...

CVE-2006-0958

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

CVE-2005-3816

CVE-2005-3816 describes multiple SQL injection vulnerabilities in freeForum 1.1 and earlier, exploitable via the cat or thread parameters in thread mode, allowing remote execution of arbitrary SQL commands. Affected product: freeForum (forum.php). Root cause: insufficient input handling leading t...

CVE-2005-3816

Multiple SQL injection vulnerabilities in forum.php in freeForum 1.1 and earlier and earlier allow remote attackers to execute arbitrary SQL commands via the 1 cat parameter or 2 thread parameter in thread mode...

freeForum 1.x "cat" "thread" SQL inj.

freeForum 1.x "cat" "thread" SQL inj. Vuln. dicovered by : r0t Date: 23 nov. 2005 Orginal advsiory:http://pridels.blogspot.com/2005/11/freeforum-1x-cat-and-thread-sql-inj.html Vendor:http://soft.zoneo.net/freeForum/ affected version: 1.1 and prior Vuln. description: Input passed to the "cat" and...

FreeForum 1.0/1.1 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/15559/info freeForum is prone to multiple SQL injection vulnerabilities. These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation...