CVE-2008-3098

CVE-2008-3098 is a Cross-site scripting (XSS) flaw in fuzzylime CMS prior to 3.03 affecting admin/usercheck.php. The vulnerability allows remote attackers to inject arbitrary script via the login form's user parameter. According to the CVE notes, vendor remediation released version 3.03 on 2008-0...

CVE-2008-3098: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/usercheck.php in fuzzylime cms before 3.03 allows remote attackers to inject arbitrary web script or HTML via the user parameter to the login form...

Cross Site Scripting (XSS) Vulnerabilitiy in fuzzylime (cms) >=3.02, CVE-2008-3098

Cross Site Scripting XSS Vulnerabilitiy in fuzzylime cms =3.02, CVE-2008-3098 References https://vulners.com/cve/CVE-2008-3098 http://cms.fuzzylime.co.uk http://www.datensalat.eu/fabian/cve/CVE-2008-3098-fuzzylime-cms.html Description Fuzzylime cms is a way to run websites and keep it up-to-date...

fuzzylime302-xss.txt

Cross Site Scripting XSS Vulnerabilitiy in fuzzylime cms =3.02, CVE-2008-3098 References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3098 http://cms.fuzzylime.co.uk Description Fuzzylime cms is a way to run websites and keep it up-to-date. Once installed, you can update from any...

Fuzzylime (cms) 3.0 - usercheck.php Cross-Site Scripting

Fuzzylime cms 3.0 - usercheck.php Cross-Site Scripting source: https://www.securityfocus.com/bid/31306/info fuzzylime cms is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform...

Fuzzylime (cms) 3.0 - 'usercheck.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/31306/info fuzzylime cms is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the...

fuzzylime (cms) comssrss.php files[] Parameter Traversal Local File Inclusion

The remote host is running fuzzylime cms, a PHP-based content management system. The version of fuzzylime cms installed on the remote host fails to sanitize user-supplied input to the 'files' parameter of the 'commsrss.php' script before using it to include PHP code. Regardless of PHP's...

fuzzylime301-execperl.txt

!/usr/bin/perl !!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!! after i noticed that there was a problem changing $cmd,i fixed it.this is the result. Fuzzylime 3.01 Remote Code Execution Credits: real and inphex C:\ perl ye.pl host /path/ :id uid=63676dswrealty...

fuzzylime301-execphpcomm.txt

Conditions: None Greetz: Inphex, hEEGy and austeN Explanations Ok, so today we will go for a walk in the fuzzylime cms maze ... Finding vulns was easy, but finding a no condition vuln was quite harder ... First, we look to the code/content.php file:...

fuzzylime301-execphp.txt

!/usr/bin/php ' ; $shell = new phpreter$url.'code/polls/titles.inc.php', '-:-:-.-:-:-', 'cmd', array, false; function get$url $infos = parseurl$url; $host = $infos'host'; $port = isset$infos'port' ? $infos'port' : 80; $fp = fsockopen$host, $port, &$errno, &$errstr, 30; $req = "GET $url...

Fuzzylime 3.01 Remote Code Execution Exploit

Good morning, Name: Fuzzylime 3.01 Remote Code Execution Exploit Credits: Charles "real" F. charlesfolathotmail.fr Conditions: None http://realn.free.fr/releases/89731 RCE with "no conditions" ... Peace, real...

Directory traversal

Directory traversal vulnerability in rss.php in fuzzylime cms 3.01a and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter, as demonstrated using content.php, a different vector than CVE-2007-4805...

Directory traversal

Directory traversal vulnerability in blog.php in fuzzylime cms 3.01, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter. NOTE: it was later reported that 3.01a is also affected...

CVE-2008-3164

Directory traversal vulnerability in blog.php in fuzzylime cms 3.01, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter. NOTE: it was later reported that 3.01a is also affected...

CVE-2008-3165

Directory traversal vulnerability in rss.php in fuzzylime cms 3.01a and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter, as demonstrated using content.php, a different vector than CVE-2007-4805...

CVE-2008-3164

Directory traversal vulnerability in blog.php in fuzzylime cms 3.01, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter. NOTE: it was later reported that 3.01a is also affected...

CVE-2008-3165

Directory traversal vulnerability in rss.php in fuzzylime cms 3.01a and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter, as demonstrated using content.php, a different vector than CVE-2007-4805...

CVE-2008-3164

CVE-2008-3164 affects fuzzylime (cms) 3.01 (and 3.01a) with a directory traversal condition in blog.php. When magic_quotes_gpc is disabled, an attacker can supply a .. in the file parameter to cause the application to include and execute arbitrary local files. The vulnerability impact is remote c...

CVE-2008-3165

CVE-2008-3165 affects fuzzylime (CMS) versions 3.01a and earlier. The vulnerability is a directory traversal flaw in rss.php that allows remote attackers to include and execute arbitrary local files by supplying a .. sequence in the p parameter, demonstrated via content.php; this is a different v...

fuzzylime cms 3.01 (commrss.php) Remote Code Execution Exploit

No description provided by source. ?php Name: Fuzzylime 3.01 Remote Code Execution Exploit Credits: Charles "real" F. charlesfolathotmail.fr Conditions: None Greetz: Inphex, hEEGy and austeN Explanations Ok, so today we will go for a walk in the fuzzylime cms maze ... Finding vulns was easy, but...