48 matches found
MG2 0.5.1 Multiple XSS Vulnerabilities
Summary MG2 is the sequel to the popular image gallery script MiniGal. One of the highlights of MG2 is, that it supports PHP running in safe mode which is unsupported by almost all other dynamic image gallery scripts on the web. Description MG2 suffers from multiple XSS vulns. Several parameters...
CVE-2008-6933
Directory traversal vulnerability in index.php in MiniGal b13 aka MG2 allows remote attackers to read the source code of .php files, and possibly the content of other files, via a .. dot dot in the list parameter...
Directory traversal
Directory traversal vulnerability in index.php in MiniGal b13 aka MG2 allows remote attackers to read the source code of .php files, and possibly the content of other files, via a .. dot dot in the list parameter...
CVE-2008-6933
CVE-2008-6933 is a vulnerability in MiniGal b13 (MG2) where a directory traversal flaw in index.php allows remote attackers to read the source code of .php files and possibly other files by injecting “..” in the list parameter. Affected component: MiniGal b13 (MG2). Root cause: improper sanitizat...
CVE-2008-6933
Directory traversal vulnerability in index.php in MiniGal b13 aka MG2 allows remote attackers to read the source code of .php files, and possibly the content of other files, via a .. dot dot in the list parameter...
Minigal b13 (index.php list) Remote File Disclosure Exploit
No description provided by source. ?php settimelimit0; function findpass$data $tab = explode'$gallerycopyright = ',$data; $tab1 = explode'$version = "B13";',$tab1; $tab2 = explode'$adminpass = "',$tab10; if$tab21!="" echo"Vuln exploited enjoy !\n"; echo sleep1; echo"Admin hash ==...
Minigal b13 - Remote File Disclosure
?php settimelimit0; function findpass$data $pass = explode'$adminpass = "',$data; if$pass1!="" echo"Vuln exploited enjoy !\n"; sleep1; echo"Admin hash == ".substr$pass1,0,32."\n"; else echo"Exploit failed!!!!"; function send$pack,$host,$port $ret = ""; $desc = fsockopen$host,$port,$errno, $errstr...
Minigal b13 (index.php list) Remote File Disclosure Exploit
Exploit for unknown platform in category web applications =========================================================== Minigal b13 index.php list Remote File Disclosure Exploit =========================================================== ?php settimelimit0; function findpass$data $pass =...
Minigal b13 - Remote File Disclosure
Minigal b13 - Remote File Disclosure ?php settimelimit0; function findpass$data $pass = explode'$adminpass = "',$data; if$pass1!="" echo"Vuln exploited enjoy !\n"; sleep1; echo"Admin hash == ".substr$pass1,0,32."\n"; else echo"Exploit failed!!!!"; function send$pack,$host,$port $ret = ""; $desc =...
CVE-2008-1228
CVE-2008-1228 is a cross-site scripting (XSS) flaw in MG2 (formerly Minigal) that affects the admin.php interface. The vulnerability is triggered by the list parameter during an import action, allowing remote attackers to inject arbitrary web script or HTML. Documents consistently describe this a...
Minigal 2 critical XSS
Title: Minigal 2 critical XSS Author: Jose Carlos Norte [email protected] Date: 4-3-2008 Severity: high Vendor URL: http://www.minigal.dk/ ------- Introduction Minigal 2a.k.a. MG2 is a picture album written in PHP, it have a simple administration panels, and makes non-ajax browsable albums. -------...
minigal-xss.txt
Title: Minigal 2 critical XSS Author: Jose Carlos Norte [email protected] Date: 4-3-2008 Severity: high Vendor URL: http://www.minigal.dk/ ------- Introduction Minigal 2a.k.a. MG2 is a picture album written in PHP, it have a simple administration panels, and makes non-ajax browsable albums. -------...
Code injection
The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the 1 name or 2 email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2007-2146
The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the 1 name or 2 email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
Input validation
The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the input parameter. NOTE: some of these details are obtained from third party information...
CVE-2007-2145
The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the input parameter. NOTE: some of these details are obtained from third party information...
CVE-2007-2146
The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the 1 name or 2 email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2007-2145
The CVE-2007-2145 entry describes a remote PHP code execution in MiniGal b13. The vulnerability is in the imagecomments function of classes.php, which allows an attacker to inject arbitrary PHP code into a file in the thumbs/ directory through the input parameter. The CVSS v2.0 base score is 7.5 ...
CVE-2007-2146
CVE-2007-2146 affects MiniGal b13: the imagecomments function in classes.php lets remote attackers inject arbitrary PHP code into a file under thumbs/ by supplying the name or email parameter. This is a client-controlled input vulnerability in a PHP application function, enabling code injection w...
MiniGal b13 (image backdoor) Remote Code Execution Exploit
No description provided by source. !/usr/bin/perl -=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=- MiniGal b13 -=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=- -=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=- Author : Dj7xpl / Dj7xplatYahoodotcom Type : Remo...