CVE-2007-2081

MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php...

CVE-2007-2081

CVE-2007-2081 affects MyBlog 0.9.8 and earlier. The vulnerability is an authentication bypass where an attacker can bypass authentication by manipulating the admin cookie parameter to admin files (e.g., admin/settings.php). The provided sources consistently describe this as a remote-auth bypass a...

myblog098-exec.txt

!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n";...

MyBlog 0.9.8 - 'Settings.php' Authentication Bypass

source: https://www.securityfocus.com/bid/23521/info MyBlog is prone to an authentication-bypass vulnerability. Attackers can exploit this issue to bypass the authentication mechanism and then access or overwrite files with arbitrary PHP script code. Script code added to certain files are later...

MyBlog 0.9.8 - Settings.php Authentication Bypass

MyBlog 0.9.8 - Settings.php Authentication Bypass source: https://www.securityfocus.com/bid/23521/info MyBlog is prone to an authentication-bypass vulnerability. Attackers can exploit this issue to bypass the authentication mechanism and then access or overwrite files with arbitrary PHP script...

MyBlog Games.PHP远程文件包含漏洞

MyBlog是一款基于PHP的WEB应用程序。 MyBlog不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Games.PHP'脚本对用户提交的'scoreid'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 MyBlog MyBlog 1.6 MyBlog MyBlog 1.5 MyBlog MyBlog 1.4 MyBlog MyBlog 1.3 MyBlog MyBlog 1.2 MyBlog MyBlog 1.1 MyBlog MyBlog 1.0 目前没有解决方案提供：...

Remote file inclusion

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, a different vector than CVE-2007-1968. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-1990

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, a different vector than CVE-2007-1968. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-1990

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, a different vector than CVE-2007-1968. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-1990

The provided connected documents confirm a PHP remote file inclusion vulnerability in Sam Crew MyBlog (games.php) affecting versions 1.0–1.6. The flaw allows an attacker to retrieve arbitrary PHP code execution by supplying a crafted URL parameter (scoreid in CVE-2007-1968/2007-1990 entries; also...

CVE-2007-1990

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, a different vector than CVE-2007-1968. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-1969

Cross-site scripting XSS vulnerability in admin/modify.php in Sam Crew MyBlog remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2007-1969

Cross-site scripting XSS vulnerability in admin/modify.php in Sam Crew MyBlog remote attackers to inject arbitrary web script or HTML via the id parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the scoreid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/modify.php in Sam Crew MyBlog remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2007-1968

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the scoreid parameter...

CVE-2007-1968

CVE-2007-1968 : PHP remote file inclusion in Sam Crew MyBlog (likely 1.0–1.6) enables an attacker to execute arbitrary PHP code via a URL in the scoreid parameter. Root cause is unsanitized user input leading to remote file inclusion. The connected documents corroborate the same vulnerability pat...

CVE-2007-1968

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the scoreid parameter...

CVE-2007-1969

CVE-2007-1969 describes an XSS vulnerability in Sam Crew MyBlog, specifically in admin/modify.php where the id parameter can be manipulated to inject arbitrary web script/HTML by remote attackers. The NVD entry lists a CVSS v2 base score of 4.3 (Medium) with impact confined to confidentiality and...

CVE-2007-1969

Cross-site scripting XSS vulnerability in admin/modify.php in Sam Crew MyBlog remote attackers to inject arbitrary web script or HTML via the id parameter...