Hycus CMS 1.0.3 Path Disclosure

Vulnerability ID: HTB22795 Reference: http://www.htbridge.ch/advisory/pathdisclousureinhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 and probably prior versions Vendor Notification: 13 January 2011 Vulnerability Type: Path...

CVE-2010-4613

Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the site parameter to 1 index.php and 2 admin.php...

CVE-2010-4612

Multiple SQL injection vulnerabilities in index.php in Hycus CMS 1.0.3, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 usremail parameters to user/1/hregister.html, 3 usremail parameter to user/1/hlogin.html, 4 useremail paramete...

Sql injection

Multiple SQL injection vulnerabilities in index.php in Hycus CMS 1.0.3, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 usremail parameters to user/1/hregister.html, 3 usremail parameter to user/1/hlogin.html, 4 useremail paramete...

Directory traversal

Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the site parameter to 1 index.php and 2 admin.php...

CVE-2010-4613

Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the site parameter to 1 index.php and 2 admin.php...

CVE-2010-4612

Hycus CMS 1.0.3 is affected by CVE-2010-4612: multiple SQL injection in index.php when magic_quotes_gpc is disabled. Vulnerable parameters include user_name and usr_email (hregister.html, hlogin.html), useremail (forgotpass.html), and q (search.html). Root cause is input sanitation flaws allowing...

CVE-2010-4612

Multiple SQL injection vulnerabilities in index.php in Hycus CMS 1.0.3, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 usremail parameters to user/1/hregister.html, 3 usremail parameter to user/1/hlogin.html, 4 useremail paramete...

CVE-2010-4613

Hycus CMS 1.0.3 is affected by a Local File Include vulnerability (CVE-2010-4613). The issue arises from insufficient sanitization of the site parameter in index.php and admin.php, allowing remote attackers to include local files via directory traversal sequences (e.g., ../../) and NULL-byte tric...

Hycus CMS Multiple Vulnerabilities

Exploit for php platform in category web applications Vulnerability ID: HTB22737 Reference: http://www.htbridge.ch/advisory/lfiinhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability...

Hycus CMS 1.0.3 SQL Injection

Vulnerability ID: HTB22738 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: SQL injection Status: Not Fixed, Vendor...

SQL injection in Hycus CMS

Vulnerability ID: HTB22739 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhycuscms1.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendo...

Hycus CMS 1.0.3 SQL Injection

=============================== Vulnerability ID: HTB22739 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhycuscms1.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: SQL...

Hycus CMS 1.0.3 Local File Inclusion

Vulnerability ID: HTB22737 Reference: http://www.htbridge.ch/advisory/lfiinhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: LFI Status: Not Fixed, Vendor Alerted, Awaiting...

SQL injection in Hycus CMS

Vulnerability ID: HTB22741 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhycuscms3.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendo...

LFI in Hycus CMS

Vulnerability ID: HTB22737 Reference: http://www.htbridge.ch/advisory/lfiinhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: LFI Status: Not Fixed, Vendor Alerted, Awaiting...

Hycus CMS - Multiple Vulnerabilities

Hycus CMS - Multiple Vulnerabilities Vulnerability ID: HTB22737 Reference: http://www.htbridge.ch/advisory/lfiinhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: LFI Status:...

Hycus CMS - Multiple Vulnerabilities

Vulnerability ID: HTB22737 Reference: http://www.htbridge.ch/advisory/lfiinhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: LFI Status: Not Fixed, Vendor Alerted, Awaiting...

SQL injection in Hycus CMS

Vulnerability ID: HTB22738 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: SQL injection Status: Not Fixed, Vendor...

SQL injection in Hycus CMS

Vulnerability ID: HTB22740 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhycuscms2.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendo...