phpMyAdmin 4.0.x < 4.0.4.1 'import.php' Security Vulnerability

Binary data 6917.prm...

Design/Logic Flaw

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...

CVE-2013-4729

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...

CVE-2013-4729: Undefined Security Weakness

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...

PT-2013-5163

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.0 through 4.0.4 Description The issue allows remote authenticated users to modify the GLOBALS superglobal array and change the configuration via a crafted request. This is due to the import.php file in phpMyAdmin not...

phpMyAdmin -- Global variable scope injection

The phpMyAdmin development team reports: The import.php script was vulnerable to GLOBALS variable injection. Therefore, an attacker could manipulate any configuration parameter. This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents...

PT-2013-3374

Name of the Vulnerable Software and Affected Versions PHP Address Book version 8.2.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting SQL injection vulnerabilities via unspecified parameters to API endpoints such as "edit.php" or...

CVE-2013-1748: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to 1 edit.php or 2 import.php. NOTE: the view.php id vector is already covered by CVE-2008-2565.1 and the edit.php id vector is already covered by...

CVE-2012-4393

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use 1 addBookmark.php, 2 delBookmark.php, or 3 editBookmark.php in bookmarks/ajax/; 4 calendar/delete.php, 5 calendar/edit.php...

CVE-2009-4854

addons/import.php in TalkBack 2.3.14 allows remote attackers to execute arbitrary commands via the result parameter...

CVE-2009-4854: Improper Input Validation

addons/import.php in TalkBack 2.3.14 allows remote attackers to execute arbitrary commands via the result parameter...

CVE-2009-3249: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the module parameter to graph.php; or the 2 module or 3 file parameter to include/Ajax/CommonAjax.php, reachable through...

CVE-2008-3368: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via a URL in the type parameter...

ATutor &lt;= 1.6.1-pl1 (import.php) Remote File Inclusion Vulnerability

No description provided by source. ATutor Course Server Rfi AUTHOR : IRCRASH R3d.W0rm Discovered by : IRCRASH R3d.W0rm Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Script Download : www.atutor.ca DORK : "Web site engine's code is copyright 2001-2007 ATutor" Note : You...

ATutor <= 1.6.1-pl1 (import.php) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ==================================================================== ATutor = 1.6.1-pl1 import.php Remote File Inclusion Vulnerability ==================================================================== ATutor Course Server Rfi AUTHOR :...

ATutor 1.6.1-pl1 - 'import.php' Remote File Inclusion

ATutor Course Server Rfi AUTHOR : IRCRASH R3d.W0rm Discovered by : IRCRASH R3d.W0rm Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Script Download : www.atutor.ca DORK : "Web site engine's code is copyright © 2001-2007 ATutor®" Note : You must login , then use rfi bug ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

CVE-2007-4153: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...