83 matches found
Directory traversal
HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory...
CVE-2017-14146
HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory...
CVE-2017-14145
HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATHINFO, related to the selectWarning function...
CVE-2017-14145
HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATHINFO, related to the selectWarning function...
CVE-2017-14145
HelpDEZk 1.1.1 has a SQL Injection vulnerability in app/modules/admin/controllers/loginController.php via the admin/login/getWarningInfo/id/ PATH_INFO, related to the selectWarning function. The initial records (CVE-2017-14145) enumerate high-severity impact (C/P/I/A partial) with CVSS2/3 scores ...
CVE-2017-14146
HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory...
CVE-2017-14146
CVE-2017-14146 affects HelpDEZk 1.1.1 and enables remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it from the helpdezk\app\uploads\helpdezk\attachments\ directory. The available sources confirm this file-upload vulnerability and PHP code...
CVE-2017-14145
HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATHINFO, related to the selectWarning function...
PT-2017-13279
Name of the Vulnerable Software and Affected Versions HelpDEZk version 1.1.1 Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved by uploading a .php attachment and then requesting it in the "helpdezkappuploadshelpdezkattachments" directory...
PT-2017-13278
Name of the Vulnerable Software and Affected Versions HelpDEZk version 1.1.1 Description The issue concerns a SQL Injection in the loginController.php file, specifically via the "admin/login/getWarningInfo/id/" PATH INFO. This is related to the selectWarning function. Recommendations For HelpDEZk...
CVE-2017-14146: Improper Control of Generation of Code
HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory...
CVE-2017-14145: Improper Neutralization of Special Elements used in an SQL Command
HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATHINFO, related to the selectWarning function...
HelpDEZk Cross-Site Request Forgery Vulnerability
HelpDEZk is a suite of PHP-based software for managing requests, events. A cross-site request forgery vulnerability exists in admin/home/person/ in HelpDEZk. It allows remote attackers to construct malicious URIs and trick users into parsing them, which can be used to perform malicious actions an...
HelpDEZk Cross-Site Request Forgery Vulnerability (CNVD-2017-04611)
HelpDEZk is a suite of PHP-based software for managing requests, events. A cross-site request forgery vulnerability exists in admin/home/logos/ in HelpDEZk. Allows a remote attacker to construct a malicious URI and trick a user into parsing it, which could perform a malicious action in the contex...
HelpDEZK 1.1.1 - Cross-Site Request Forgery / Code Execution Vulnerabilities
Exploit for php platform in category web applications Exploit Title: Multiple CSRF Remote Code Execution Vulnerability on HelpDEZK 1.1.1 Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.helpdezk.org/ Software Link:...
Code injection
HelpDEZk 1.1.1 has CSRF in admin/home/logos/ with an impact of remote execution of arbitrary PHP code...
CVE-2017-7446
HelpDEZk 1.1.1 has CSRF in admin/home/person/ with an impact of obtaining admin privileges...
CVE-2017-7447
HelpDEZk 1.1.1 has CSRF in admin/home/logos/ with an impact of remote execution of arbitrary PHP code...