PHP-Fusion news.PHP SQL注入漏洞

PHP-Fusion是一款基于PHP的内容管理程序。 PHP-Fusion不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'news.PHP'脚本对用户提交的'SERVERREMOTEADDR'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 PHP-Fusion PHPFusion 6.1.4 PHP-Fusion PHP-Fusion 6.0.307 PHP-Fusion PHP-Fusion 6.0.204 PHP-Fusion PHP-Fusion 6.0.110 PHP-Fusion...

PHP-Fusion Maincore.PHP SQL注入漏洞

PHP-Fusion是一款基于PHP的内容管理程序。 PHP-Fusion不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Maincore.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 PHP-Fusion PHPFusion 6.1.4 PHP-Fusion PHP-Fusion 6.0.307 PHP-Fusion PHP-Fusion 6.0.204 PHP-Fusion PHP-Fusion 6.0.110 PHP-Fusion PHP-Fusion...

FusionPHP Fusion News Index.PHP远程文件包含漏洞

Fusion News是一款基于PHP的新闻管理程序。 Fusion News不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Fusionphp Fusion News 3.7 http://www.fusionphp.net/index.php?cat=fnews&page=features !/usr/bin/perl Aria-Security.net Advisory Discovered by: OUTLAW...

[Full-disclosure] Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"

·= Security Advisory =· Issue: Cross Site Scripting XSS Vulnerability in Netquery by "VIRtech" Discovered Date: 04/10/2006 Author: Tal Argoni, LegendaryZion. talargoni at gmail.com Product Vendor: http://www.virtech.org Details: VIRtechs Netquery system is prone to a Cross Site Scripting...

CVE-2006-5396

The CVE-2006-5396 entry relates to Sun Solaris 10: the tcp_fuse_rcv_drain function in the kernel (pre-2006-10-17) when TCP Fusion is enabled can allow a local user to crash the system via a TCP loopback connection with both endpoints on the same host. The vulnerability is a local denial-of-servic...

CVE-2006-5396

The tcpfusercvdrain function in the Sun Solaris 10 kernel before 20061017, when TCP Fusion is enabled, allows local users to cause a denial of service system crash via a TCP loopback connection with both endpoints on the same system...

phpGreetz <= 0.99 (footer.php) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ================================================================ phpGreetz "phpgreetz-global.inc.php"; "$PHPGREETZINCLUDEDIR/language/lang.$sessionlang.inc.php"; $PHPGREETZINCLUDEDIR = "$sitelocation/includes";...

PHPGreetz 0.99 - 'footer.php' Remote File Inclusion

Author: [email protected] mozi phpGreetz Remote File Inclusion Vulnerability Greetz: Raver phpfreaks eu.undernet.org Greetz: SpiderZ , fUSiON ---------------------------------------------------------------- Download: http://sourceforge.net/project/showfiles.php?groupid=6127...

CVE-2006-4673

Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the SERVERREMOTEADDR parameter to news.php...

CVE-2006-4673

Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the SERVERREMOTEADDR parameter to news.php...

CVE-2006-4673

The CVE-2006-4673 entry concerns PHP-Fusion 6.01.4 and earlier, where maincore.php applies extract() to superglobals. This enables a global-variable overwriting flaw that can lead to SQL injection via the _SERVER[REMOTE_ADDR] parameter to news.php. The vulnerability arises from unrestricted varia...

PHP-Fusion extract() Global Variable Overwriting

The version of PHP-Fusion on the remote host supports registering variables from user-supplied input in the event that PHP's 'registerglobals' setting is disabled, which is the default in current versions of PHP. Unfortunately, the way that this has been implemented in the version on the remote...

PHP-Fusion 6.0.x - news.php SQL Injection

PHP-Fusion 6.0.x - news.php SQL Injection source: https://www.securityfocus.com/bid/19908/info PHP-Fusion is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker...

PHP-Fusion 6.0.x - 'news.php' SQL Injection

source: https://www.securityfocus.com/bid/19908/info PHP-Fusion is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or...

CVE-2006-4303

Race condition in 1 libnsl and 2 TLI/XTI API routines in Sun Solaris 10 allows remote attackers to cause a denial of service "tight loop" and CPU consumption for listener applications via unknown vectors related to TCP fusion dotcpfusion...

CVE-2006-4303

Race condition in 1 libnsl and 2 TLI/XTI API routines in Sun Solaris 10 allows remote attackers to cause a denial of service "tight loop" and CPU consumption for listener applications via unknown vectors related to TCP fusion dotcpfusion...

CVE-2006-4303

CVE-2006-4303 describes a race condition in Sun Solaris 10 affecting libnsl and the TLI/XTI API routines (do_tcp_fusion) that can enable remote denial of service by causing a tight loop and CPU consumption in listener applications. The NVD summary indicates an availability impact (PARTIAL) with n...

CVE-2006-4240

PHP remote file inclusion vulnerability in index.php in Fusion News 3.7 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter...

CVE-2006-4240

The CVE-2006-4240 entry describes a PHP remote file inclusion in Fusion News 3.7 (index.php) that allows an attacker to execute arbitrary PHP code via a URL parameter fpath. This is the core vulnerability and the affected component is Fusion News 3.7, specifically the index.php file handling fpat...

Fusionphp Fusion News 3.7 - index.php Remote File Inclusion

Fusionphp Fusion News 3.7 - index.php Remote File Inclusion source: https://www.securityfocus.com/bid/19546/info Fusion News is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote...