diginews.txt

Digi-news and Digi-ads version 1.1 admin access without password .oO Overview Oo. Digi-news and Digi-ads version 1.1 admin access without password Discovered on 2003, March, 30th Vendor: Digi-FX Digi-news 1.1 is a PHP news editor. It allows you to easily add, edit, and delete news. Digi-ad 1.1 is...

[Full-Disclosure] BlackBook - Multiple Vunerabilities

------------------------------------------------------------------ - EXPL-A-2003-015 exploitlabs.com Advisory 015 ------------------------------------------------------------------ -= BlackBook =- Donnie Werner July 11, 2003 Vunerabilitys: ---------------- 1. XSS executes JS in PHP remotely 2...

pMachine 1.0/2.x - Multiple Script 'sfx' Full Path Disclosures

source: https://www.securityfocus.com/bid/7980/info It has been reported that pMachine is prone to remote a patch disclosure vulnerability when accessing various scripts. When a request is made for a target PHP script, possibly requiring a blank URI parameter, pMachine is said to throw an...

Webfroot Shoutbox 2.32 directory traversal and code injection.

Products: Webfroot Shoutbox v 2.32 and below http://shoutbox.sf.net Date: 09 May 2003 Author: pokleyzz pokleyzzatscan-associates.net Contributors: skatscan-associates.net shaharilatscan-associates.net muniratscan-associates.net URL: http://www.scan-associates.net Summary: Webfroot Shoutbox 2.32 a...

shoutbox.txt

Products: Webfroot Shoutbox v 2.32 and below http://shoutbox.sf.net Date: 09 May 2003 Author: pokleyzz Contributors: skatscan-associates.net shaharilatscan-associates.net muniratscan-associates.net URL: http://www.scan-associates.net Summary: Webfroot Shoutbox 2.32 and below directory traversal a...

Ultimate PHP Board admin_iplog.php Arbitrary Code Execution

The remote host is running Ultimate PHP Board UPB. There is a flaw in this version which may allow an attacker to execute arbitrary code on this host, by sending a malformed user-agent which contains PHP commands. Once the user-agent has been sent, it is stored in the logs. When the administrator...

P-News p-news.php Name Field Privilege Escalation

The remote host is running the p-news bulletin board. There is a flaw in the version in use which may allow an attacker who has a 'Member' account to upgrade its privileges to administrator by supplying a malformed username. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From: "Peter...

Horde Turba status.php Path Disclosure

There is a flaw in the file 'status.php' of this CGI which may allow an attacker to retrieve the physical path of the remote web root. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Date: 17 May 2003 13:18:59 -0000 From: Lorenzo Manuel Hernandez Garcia-Hierro To:...

Owl browse.php Authentication Bypass

The remote host is using owl intranet engine, an open source file sharing utility written in php. There is a flaw in this application that may allow an attacker to browse files on this host without having to log in. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Date: Tue, 13 May 2003...

Horde test.php Direct Reqest Information Disclosure

The remote server is running Horde or a related project along with one or more test scripts. These scripts may leak server-side information that is valuable to an attacker. %NASLMINLEVEL 70300 This script was written by Sverre H. Huseby See the Nessus Scripts License for details Changes by Tenabl...

CVE-2001-1296

Technical details about CVE-2001-1296 are not publicly available in the provided documents. Monitor for updates.

CVE-2002-0513

The PHP administration script in poppermod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator...

CVE-2001-1296

More.groupware PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable...

Justice Guestbook 1.3 - Full Path Disclosure

Justice Guestbook 1.3 - Full Path Disclosure source: https://www.securityfocus.com/bid/7234/info A path disclosure vulnerability has been reported for Guestbook. The issue occurs when a request is made to the cfooter.php3 PHP script page. Access to sensitive filesystem information may aid an...

E-theni aff_liste_langue.php rep_include Parameter Remote File Inclusion

It is possible to make the remote host include PHP files hosted on a third-party server using E-Theni. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From:...

paFileDB pafiledb.php Multiple Parameter SQL Injection

The remote installation of paFileDB is vulnerable to SQL injection attacks because of its failure to sanitize input to the 'id' and 'rating' parameters to the 'pafiledb.php' script. An attacker may use this flaw to control your database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Date:...

WihPhoto sendphoto.php Traversal Arbitrary File Access

It is possible to make the remote host mail any file contained on its hard drive by using a flaw in WihPhoto's 'util/email.php' script. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Refs: http://www.frog-man.org/tutos/WihPhoto.txt From: "Frog Man" To: [email protected] Subject:...

Cedric Email Reader 0.4 - Global Configuration Script Remote File Inclusion

source: https://www.securityfocus.com/bid/6820/info It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'emailreaderexecuteoneachpage.inc.php' script. Under some...

Cedric Email Reader 0.2/0.3 - Skin Configuration Script Remote File Inclusion

source: https://www.securityfocus.com/bid/6818/info It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'email.php' script. Under some circumstances, it is possible fo...

myphpPageTool 0.4.3-1 - Remote File Inclusion

source: https://www.securityfocus.com/bid/6744/info myphpPageTool is prone to an issue which may allow remote attackers to include files located on remote servers. This issue is present in several PHP script files in the /doc/admin folder. Under some circumstances, it is possible for remote...