CVE-2017-9101

CVE-2017-9101 affects PlaySMS 1.4 where import.php (Phonebook import) allows remote code execution. The vulnerability arises from improper handling of file contents during a CSV upload, enabling PHP code execution via payloads contained in the uploaded file name or User-Agent header. Public refer...

CVE-2017-9101: Unrestricted Upload of File with Dangerous Type

import.php aka the Phonebook import feature in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file...

PT-2017-18703

Name of the Vulnerable Software and Affected Versions PlaySMS version 1.4 Description The issue allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file, specifically in the import.php feature, also known as the Phonebook import feature...

PlaySMS 1.4 - 'import.php' Remote Code Execution

Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php Date: 21-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website: http://touhidshaikh.com/ Category: webapps ...

PT-2017-7405

Name of the Vulnerable Software and Affected Versions Bitrix versions 6.5.2 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via several parameters in two API endpoints: "admin/mcart xls import.php" and "admin/mcart xls...

ngrcomputers.co.za XSS vulnerability

Vulnerable URL: http://www.ngrcomputers.co.za/import.php?query=k400%27"--!confirmOPENBUGBOUNTY%3C/script /K/=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 331095 VIP website...

phpMyAdmin 4.0.10.x < 4.0.10.18 / 4.4.15.x < 4.4.15.9 / 4.6.x < 4.6.5 Multiple Vulnerabilities

Binary data 9830.prm...

ATutor <= 1.6.1-pl1 (import.php) Remote File Inclusion Vulnerability

No description provided by source. ATutor Course Server Rfi AUTHOR : IRCRASH R3d.W0rm Discovered by : IRCRASH R3d.W0rm Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Script Download : www.atutor.ca DORK : Web site engine's code is copyright © 2001-2007 ATutor® Note : You...

CVE-2013-1850

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

CVE-2013-1850: Improper Control of Generation of Code

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

PT-2014-2504

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.13 ownCloud versions 4.5.x prior to 4.5.8 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file due to multiple incomplete blacklist vulnerabilities i...

PT-2015-3697

Name of the Vulnerable Software and Affected Versions eGroupware versions prior to 1.8.006.20140217 Description The issue allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code. This can be achieved via several parameters to...

phpMyAdmin 'import.php'跨站脚本漏洞

BUGTRAQ ID: 65717 CVECAN ID: CVE-2014-1879 phpmyadmin是MySQL数据库的在线管理工具，主要功能包括在线创建数据表、运行SQL语句、搜索查询数据以及导入导出数据等。 攻击者可能会利用漏洞在受影响站点上下文的不知情用户浏览器中执行任意脚本代码。这可以允许攻击者窃取基于cookie的认证证书，并发动其他攻击。 0 phpMyAdmin phpMyAdmin 3.4.9 phpMyAdmin phpMyAdmin 3.4.8 phpMyAdmin phpMyAdmin 3.4.6 phpMyAdmin phpMyAdmin 3.4.3...

CVE-2014-1879

Cross-site scripting XSS vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action...

CVE-2014-1879

CVE-2014-1879 concerns phpMyAdmin prior to 4.1.7, where an XSS vulnerability exists in the import.php action. The issue arises from how a crafted filename in an import action is processed, enabling a remote authenticated user to inject arbitrary web script or HTML. The vulnerability affects phpMy...

CVE-2014-1879

Cross-site scripting XSS vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action...

CVE-2014-1879: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action...

PT-2014-4337

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.1.7 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action. This can b...

phpMyAdmin 4.x < 4.0.4.1 import.php GLOBALS Variable Injection Configuration Parameter Manipulation (PMASA-2013-7)

According to its self-identified version number, the phpMyAdmin 4.x install hosted on the remote web server is earlier than 4.0.4.1 and, therefore, contains a flaw where the 'import.php' script does not properly sanitize input. This could allow attackers to inject arbitrary GLOBALS variables and...

phpMyAdmin &lt;= 4.0.4.1 import.php GLOBALS变量注入漏洞

CVECAN ID: CVE-2013-4729 phpmyadmin是MySQL数据库的在线管理工具，主要功能包括在线创建数据表、运行SQL语句、搜索查询数据以及导入导出数据等。 phpMyAdmin 4.0.4.1之前版本内的import.php没有正确限制文件格式定义数据输入权限，可使经过身份验证的远程用户修改GLOBALS超级全局数组，然后通过特制的请求更改配置。 0 phpMyAdmin = 4.0.4.1 厂商补丁： phpMyAdmin ---------- phpMyAdmin已经为此发布了一个安全公告（PMASA-2013-7）以及相应补丁:...