249 matches found
PT-2006-5563 · Telekorn · Telekorn Signkorn Guestbook
Name of the Vulnerable Software and Affected Versions: Telekorn SignKorn Guestbook SL versions 1.3 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled and the SESSIONpermission parameter is set to "yes". This can be achieved vi...
CVE-2006-4673
Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the SERVERREMOTEADDR parameter to news.php...
PHP-Fusion extract() Global Variable Overwriting
The version of PHP-Fusion on the remote host supports registering variables from user-supplied input in the event that PHP's 'registerglobals' setting is disabled, which is the default in current versions of PHP. Unfortunately, the way that this has been implemented in the version on the remote...
vBulletin 3.0.14 ~ init.php~ registerring global arbitary variable~ XSS exploit
ORIGINAL ADVISORY: http://myimei.com/security/2006-07-24/vbulletin-3014-initphp-XSS-exploit.html http://www.kapda.ir/advisory-397.html VENDOR CREDIT: http://www.vbulletin.com/forum/showthread.php?t=194062 ——–Summary——– Software: vBulletin Sowtware’s Web Site: http://www.vBulletin.com Versions:...
phpMyAdmin import_blacklist Variable Overwriting
The version of phpMyAdmin installed on the remote host fails to properly protect the global 'importblacklist' variable, which is used in the 'libraries/grabglobals.lib.php' script to protect global variables in its registerglobals emulation layer. An unauthenticated attacker can exploit this flaw...
DoceboLms303.txt
----------------------------------------------------- Advisory id: FSA:010 Author: Federico Fazzi Date: 09/06/2006, 7:24 Sinthesis: Docebo Lms 3.0.3, Remote command execution Type: high Product: http://www.docebolms.org/ Patch: unavailable ----------------------------------------------------- 1...
CVE-2006-2828
CVE-2006-2828 is a vulnerability in PHP-Nuke where a global variable overwrite allows remote PHP file inclusion by a modified phpbb_root_path parameter to multiple admin scripts (index.php, admin_ug_auth.php, admin_board.php, admin_disallow.php, admin_forumauth.php, admin_groups.php, admin_ranks....
APC ActionApps CMS 2.8.1 - Remote File Inclusion
APC ActionApps CMS 2.8.1 - Remote File Inclusion DEVIL TEAM THE BEST POLISH TEAM APC ActionApps CMS 2.8.1 - Remote File Include Vulnerabilities Find by Kacper Rahim. Greetings For ALL DEVIL TEAM members, Special DragonHeart : Contact: [email protected] or http://www.devilteam.yum.pl site:...
Design/Logic Flaw
DbbS 2.0-alpha and earlier allows remote attackers to obtain sensitive information via an invalid 1 fcategoryid parameter to topics.php or 2 unavariabile, 3 GLOBALS, or 4 SERVER parameters to script.php. NOTE: this information leak might be resultant from a global variable overwrite issue...
CVE-2006-1914
DbbS 2.0-alpha and earlier allows remote attackers to obtain sensitive information via an invalid 1 fcategoryid parameter to topics.php or 2 unavariabile, 3 GLOBALS, or 4 SERVER parameters to script.php. NOTE: this information leak might be resultant from a global variable overwrite issue...
MyBB 1.1 - Global Variable Overwrite
source: https://www.securityfocus.com/bid/17564/info MyBB is prone to a vulnerability that permits an attacker to overwrite global variables. This issue is due to a design flaw in handling HTTP GET and POST variables. An attacker can exploit this issue to overwrite the global variables with...
MyBB global.php 'KILL_GLOBAL' Overwrite SQL Injection
The version of MyBB installed on the remote host is affected by a global variable overwrite vulnerability due to a failure to properly initialize global variables in the global.php script. A remote, unauthenticated attacker can exploit this issue to overwrite global variables to launch a SQL...
Advisory 25/2005: phpMyAdmin Variables Overwrite Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: phpMyAdmin Variable Overwrite Vulnerability Release Date: 2005/12/07 Last Modified: 2005/12/07 Author: Stefan Esser [email protected] Application: phpMyAdmin 2.7.0-rc1...
phpMyAdmin < 2.7.0-pl1 Global Variable Overwrite
Binary data 3319.prm...
Global variable settings
This plugin configures miscellaneous global variables for NASL scripts. It does not perform any security check but may disable or change the behaviour of others. SPDX-FileCopyrightText: 2005 Michel Arboi SPDX-FileCopyrightText: New code / functionality since 2009 Greenbone AG Some text descriptio...
Generic HTTP SQLi (Web Application) - Active Check
This script attempts to use SQL injection SQLi techniques on CGI / web application scripts. SPDX-FileCopyrightText: 2002 John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
CVE-2005-3415
phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GET/POST/COOKIE GPC variable and a GLOBALS variable with the same name, which causes phpBB to unset the GLOBALS variable but not the GPC variable...
PHP 4.x5.0.x - Arbitrary File Upload GLOBAL Variable Overwrite
PHP 4.x5.0.x - Arbitrary File Upload GLOBAL Variable Overwrite source: https://www.securityfocus.com/bid/15250/info PHP is prone to a vulnerability that allows attackers to overwrite the GLOBAL variable via HTTP POST requests. By exploiting this issue, remote attackers may be able to overwrite th...
PHP 4.x/5.0.x - Arbitrary File Upload GLOBAL Variable Overwrite
source: https://www.securityfocus.com/bid/15250/info PHP is prone to a vulnerability that allows attackers to overwrite the GLOBAL variable via HTTP POST requests. By exploiting this issue, remote attackers may be able to overwrite the GLOBAL variable. This may allow attackers to further exploit...