Directory traversal

Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in 1 errorhandlerfile and 2 localphp parameters to a tiki-index.php, or 3 encoded "..%2F" sequences in the implanguage parameter to...

CVE-2007-5684

Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in 1 errorhandlerfile and 2 localphp parameters to a tiki-index.php, or 3 encoded "..%2F" sequences in the implanguage parameter to...

CVE-2003-1499

CVE-2003-1499 : A directory traversal flaw in Bytehoard 0.7’s index.php allows remote attackers to read arbitrary files by supplying a .. in the infolder parameter. The NVD entry lists CVSS v2 base metrics: AV:N/AC:L/Au:N/C:N/I:N/A:P with a base score of 5.0 (Medium) and network attack vector; ex...

Directory traversal

Directory traversal vulnerability in system.php in ReloadCMS 1.2.7 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter to index.php...

DM CMS Index.PHP SQL注入漏洞

DM CMS是一款基于PHP的WEB应用程序。 DM CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL攻击，获得敏感信息或操作数据库。 问题是由于'index.php'脚本对用户提交的'id'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，攻击者可以获得敏感信息或操作数据库。 DMCMS 0.7 目前没有详细解决方案提供： http://sourceforge.net/projects/dmcms/ http://www.example.com/index.php?page=media&id=SQL INJECTION CODE GOES HE...

InstaGuide Weather Index.PHP文件包含漏洞

InstaGuide Weather是一款基于PHP的WEB应用程序。 InstaGuide Weather不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是'Index.PHP'脚本对用户提交的'PageName'参数缺少过滤，提交应用程序文件作为参数，可导致敏感信息泄露。 InstaGuide Weathe 目前没有解决方案提供： http://www.instaguide.com/index.php?PageName=products http://www.example.com/index.php?PageName=Local File%00...

visolfi.txt

Title : VISO apps Local File Inclusion Vulnerability Description : VISO apps is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Software: : http://www.viventus.no/visoapps/ Author : d3hydr8 Homepage : http://www.darkc0de.com Original Post :...

deeemm CMS (dmcms) 0.7 - index.php SQL Injection

deeemm CMS dmcms 0.7 - index.php SQL Injection source: https://www.securityfocus.com/bid/26169/info DMCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

CVE-2003-1412

CVE-2003-1412 affects GOsa (GOnicus System Administrator) 1.0. It is a PHP remote file inclusion vulnerability where the plugin parameter in index.php can be controlled to include arbitrary PHP code from several paths: 3fax/1blocklists/index.php, 6departamentadmin/index.php, 5terminals/index.php,...

CVE-2002-2277

PortailPHP 0.99 contains an SQL injection in mod_search/index.php. The vulnerability allows remote attackers to inject SQL via (1) $rech, (2) $BD_Tab_docs, (3) $BD_Tab_file, (4) $BD_Tab_liens, (5) $BD_Tab_faq, or (6) $chemin, potentially affecting confidentiality, integrity, and availability as i...

CVE-2002-2277

SQL injection vulnerability in modsearch/index.php in PortailPHP 0.99 allows remote attackers to execute arbitrary SQL commands via the 1 $rech, 2 $BDTabdocs, 3 $BDTabfile, 4 $BDTabliens, 5 $BDTabfaq, or 6 $chemin variables...

PHP File Sharing System Index.PHP目录遍历漏洞

PHP File Sharing System是一款基于PHP的WEB应用程序。 PHP File Sharing System不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'index.php'脚本对用户提交的WEB参数缺少过滤，提交包含"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容。 PHP File Sharing System 1.5.1 目前没有详细解决方案提供： http://sourceforge.net/projects/phpfilesadmin/...

CVE-2007-5485

SQL injection vulnerability in index.php in the mg2 1.0 module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the album parameter...

CVE-2007-5485

CVE-2007-5485 affects the mg2 1.0 module for KwsPHP. The vulnerability is a SQL injection in index.php via the album parameter, allowing remote attackers to execute arbitrary SQL commands. Exploitation details are not provided in the connected documents; no specific exploit status or in-the-wild ...

CVE-2007-5485

SQL injection vulnerability in index.php in the mg2 1.0 module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the album parameter...

[Full-disclosure] PHP File Sharing System 1.5.1

PHP File Sharing System - Directory traversal +--------------------------------------------+ Author: Jonas Thambert Date: 2007-10-13 URL: http://sourceforge.net/projects/phpfilesadmin/ Vendor Notified. Version: 1.5.1 latest - Description - PHP File Sharing System is vulnerable to directory...

Sql injection

SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsletter parameter...

CVE-2007-5458

CVE-2007-5458 describes an SQL injection in index.php of the KwsPHP newsletter module 1.0. The vulnerability occurs when magic_quotes_gpc is disabled, allowing remote attackers to inject arbitrary SQL via the newsletter parameter. This is supported by multiple connected records (NVD/NVD listing, ...

CVE-2007-5425

SQL injection vulnerability in admin/index.php in Interspire ActiveKB 1.5 allows remote attackers to execute arbitrary SQL commands via the questId parameter in a hideQuestion ToDo action. NOTE: the catId vector is already covered by CVE-2007-5131...

Sql injection

SQL injection vulnerability in admin/index.php in Interspire ActiveKB 1.5 allows remote attackers to execute arbitrary SQL commands via the questId parameter in a hideQuestion ToDo action. NOTE: the catId vector is already covered by CVE-2007-5131...