FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload

The version of Geeklog installed on the remote host includes an older version of FCKeditor that is enabled by default and allows an unauthenticated attacker to upload arbitrary files containing, say, PHP code, and then to execute them subject to the privileges of the web server user id...

Geeklog Multiple Script _CONF[path] Parameter Remote File Inclusion

The version of Geeklog installed on the remote host fails to sanitize input to the 'CONFpath' parameter before using it in several scripts to include PHP code. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated attacker may be able to exploit these flaws to view arbitrary fil...

GeekLog 1.4.0sr3 - '_CONF[path]' Remote File Inclusion

--------------------------------------------------------------------------- GeekLog www.site.com/path/publichtml/index.php http://www.site.com/path/plugins/links/functions.inc?CONFpath=EvilScript http://www.site.com/path/plugins/polls/functions.inc?CONFpath=EvilScript...

GeekLog <= 1.4.0sr3 (_CONF[path]) Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ===================================================================== GeekLog www.site.com/path/publichtml/index.php http://www.site.com/path/plugins/links/functions.inc?CONFpath=EvilScript...

GeekLog 1.4.0sr3 - 'f(u)ckeditor' Remote Code Execution

!/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex =...

Sql injection

SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...

CVE-2006-2701

SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...

Sql injection

SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter...

Path traversal

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

CVE-2006-2699

Cross-site scripting XSS vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action...

CVE-2006-2700

SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter...

CVE-2006-2700

CVE-2006-2700 affects Geeklog 1.4.0sr2 and earlier, with a SQL injection in admin/auth.inc.php via the loginname parameter that can enable remote arbitrary SQL execution and authentication bypass. Connected sources indicate the issue is part of Geeklog

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

CVE-2006-2701

SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...

CVE-2006-2699

Geokay: CVE-2006-2699 is a documented Cross-site Scripting (XSS) vulnerability in Geeklog 1.4.0sr2 and earlier. The flaw exists in getimage.php’s show action where the image parameter can be exploited to inject arbitrary HTML or web script, enabling remote attackers to run injected content in a v...

CVE-2006-2699

Cross-site scripting XSS vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action...

CVE-2006-2701

The CVE-2006-2701 issue affects Geeklog ≤ 1.4.0sr2, and is a SQL injection vulnerability in the story submission path that could allow remote attackers to execute arbitrary SQL commands. The connected documents confirm affected software and the underlying vulnerability type but do not provide con...

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier is affected by a path-disclosure vulnerability. Remote attackers can obtain the full installation path by sending direct requests to layout/professional/functions.php or getimage.php with possibly invalid arguments. No remediation details are provided in the supplied ...

Geeklog auth.inc.php loginname Parameter SQL Injection

The version of Geeklog installed on the remote fails to sanitize input to the 'loginname' and 'passwd' parameters before using it in the script 'admin/auth.inc.php' to construct database queries. Provided PHP's 'magicquotesgpc' setting is enabled, an unauthenticated attacker can exploit this flaw...