Geeklog Remote Code Execution

GulfTech Security Research February 19, 2006 Vendor : Geeklog URL : http://www.geeklog.net/ Version : All Versions Risk : Multiple Vulnerabilities Description: Geeklog is one of the most popular content management systems available today. Geeklog unfortunately is vulnerable to a number of differe...

CVE-2005-4725

Geeklog before 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID...

CVE-2005-4725

This entry concerns Geeklog prior to version 1.3.11sr3. The vulnerability allows remote attackers to bypass intended access controls and post a comment on an arbitrary story or topic by guessing the story ID. Evidence from connected sources confirms the affected software is Geeklog and the proble...

GeekLog 1.* (error.log) Remote Commands Execution Exploit (gpc = Off)

No description provided by source. !/usr/bin/perl -w use IO::Socket; print "\r\n"; print "| Geeklog 1. remote commands execution |\r\n"; print "| By rgod rgodATautisticiDOTorg |\r\n"; print "| site: http://retrogod.altervista.org |\r\n"; print "| |\r\n"; print "\r\n"; print "| - this works agains...

GeekLog 1.* (error.log) Remote Commands Execution Exploit (gpc = Off)

Exploit for unknown platform in category web applications ===================================================================== GeekLog 1. error.log Remote Commands Execution Exploit gpc = Off ===================================================================== !/usr/bin/perl -w use IO::Socket;...

GeekLog 1.x - 'error.log' Remote Command Execution

!/usr/bin/perl -w use IO::Socket; print "\r\n"; print "| Geeklog 1. remote commands execution |\r\n"; print "| By rgod rgodautisticiorg |\r\n"; print "| site: http://retrogod.altervista.org |\r\n"; print "| |\r\n"; print "\r\n"; print "| - this works against magicquotesgpc = Off |\r\n"; print...

GeekLog 1.x - error.log Remote Command Execution

GeekLog 1.x - error.log Remote Command Execution !/usr/bin/perl -w use IO::Socket; print "\r\n"; print "| Geeklog 1. remote commands execution |\r\n"; print "| By rgod rgodautisticiorg |\r\n"; print "| site: http://retrogod.altervista.org |\r\n"; print "| |\r\n"; print "\r\n"; print "| - this wor...

CVE-2005-4725

Geeklog before 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID...

CVE-2005-4026

search.php in Geeklog 1.4.x before 1.4.0rc1, and 1.3.x before 1.3.11sr3, allows remote attackers to obtain sensitive information via invalid 1 datestart and 2 dateend parameters, which leaks the web server path in an error message...

CVE-2005-4026

search.php in Geeklog 1.4.x before 1.4.0rc1, and 1.3.x before 1.3.11sr3, allows remote attackers to obtain sensitive information via invalid 1 datestart and 2 dateend parameters, which leaks the web server path in an error message...

CVE-2005-4026

CVE-2005-4026 affects Geeklog: search.php in Geeklog 1.4.x before 1.4.0rc1 and 1.3.x before 1.3.11sr3. The issue is an information disclosure where invalid datestart and dateend parameters trigger error messages that leak the web server path. This is a remote-style vulnerability that can reveal s...

Geeklog 1.4.x Full Path Disclosure vuln.

Geeklog 1.4.x Full Path Disclosure vuln. Vuln. dicovered by : r0t Date: 28 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/geeklog-14x-full-path-disclosure-vuln.html Vendor:http://www.geeklog.net/ affected version:1.4.0 Beta 1 and prior Product Description: Geeklog is a Web Portal...

CVE-2005-2152

SQL injection vulnerability in Geeklog before 1.3.11 allows remote attackers to execute arbitrary SQL commands via user comments for an article...

CVE-2005-2152

SQL injection vulnerability in Geeklog before 1.3.11 allows remote attackers to execute arbitrary SQL commands via user comments for an article...

CVE-2005-2152

Geekslog (Geeklog) vulnerability CVE-2005-2152 affects Geeklog

Geeklog User Comment Retrieval SQL Injection

The installed version of Geeklog suffers from a SQL injection vulnerability due to the application's failure to sanitize user- supplied input via the 'order' parameter of the 'comment.php' script. By leveraging this flaw, an attacker may be able to recover sensitive information, such as password...

[Full-disclosure] Advisory 06/2005: Geeklog SQL Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Geeklog SQL Injection Vulnerability Release Date: 2005/07/05 Last Modified: 2005/07/05 Author: Stefan Esser [email protected] Application: Geeklog = 1.3.11 Severity: An...

Geeklog < 1.3.12 comment.php order Parameter SQL Injection

Binary data 3050.prm...

CVE-2002-1917

CRLF injection vulnerability in the User Profile: Send Email feature of Geeklog 1.35 and 1.3.5sr1 allows remote attackers to obtain e-mail addresses by injecting a CRLF into the Subject field and adding a BCC header. The description, sources, and connected documents confirm the affected products/...

CVE-2002-1917

CRLF injection vulnerability in the "User Profile: Send Email" feature in Geeklog 1.35 and 1.3.5sr1 allows remote attackers to obtain e-mail addresses by injecting a CRLF into the Subject field and adding a BCC mail header...