181 matches found
Sql injection
SQL injection vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to execute arbitrary SQL commands via the contentid parameter, possibly involving content/news.php...
CVE-2006-1773
The CVE-2006-1773 entry describes an SQL injection vulnerability in include.php for PHPKIT 1.6.1 Release 2 and earlier. The issue arises via the contentid parameter (potentially involving content/news.php), allowing a remote attacker to execute arbitrary SQL commands. The affected product is PHPK...
CVE-2006-1773
SQL injection vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to execute arbitrary SQL commands via the contentid parameter, possibly involving content/news.php...
CVE-2006-1773: Undefined Security Weakness
SQL injection vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to execute arbitrary SQL commands via the contentid parameter, possibly involving content/news.php...
PHPKIT 1.6.1 R2 - 'Include.php' SQL Injection
source: https://www.securityfocus.com/bid/17467/info PHPKIT is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...
PHPKIT 1.6.1 R2 - Include.php SQL Injection
PHPKIT 1.6.1 R2 - Include.php SQL Injection source: https://www.securityfocus.com/bid/17467/info PHPKIT is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit coul...
phpkitXSS.txt
Subject: XSS in PHPKIT Version 1.6.03 http://www.example.com/include.php?path=login/login.php&error=alertdocument.Cookie Discovered by BadNet !!!!...
Cross site scripting
Cross-site scripting XSS vulnerability in PHPKIT 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the error parameter to include.php, possibly due to a problem in login/login.php...
CVE-2006-1507
Cross-site scripting XSS vulnerability in PHPKIT 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the error parameter to include.php, possibly due to a problem in login/login.php...
CVE-2006-1507
CVE-2006-1507 is a documented cross-site scripting (XSS) flaw in PHPKIT 1.6.03. The vulnerability allows remote attackers to inject arbitrary script or HTML via the error parameter to include.php, with a potential root cause in login/login.php. The available sources (NVD/CVE record, CVE listings)...
CVE-2006-1507
Cross-site scripting XSS vulnerability in PHPKIT 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the error parameter to include.php, possibly due to a problem in login/login.php...
CVE-2006-1507: Undefined Security Weakness
Cross-site scripting XSS vulnerability in PHPKIT 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the error parameter to include.php, possibly due to a problem in login/login.php...
XSS in PHPKIT Version 1.6.03
http://www.example.com/include.php?path=login/login.php&error=scriptalertdocument.Cookie/script Discovered by BadNet !!!!...
phpkit_161r2_incl_xpl.txt
---------- PHPKit = v.1.6.1 release 2 remote code execution ------------------- software: site: www.phpkit.de description: a Content Management / homepage / community building software written in PHP language --------------------------------------------------------------------------------...
Design/Logic Flaw
Incomplete blacklist vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier, with allowurlfopen enabled, allows remote attackers to conduct PHP remote file include attacks via a path parameter that specifies a 1 UNC share or 2 ftps URL, which bypasses the check for "http://", "ftp://"...
CVE-2006-0786
Incomplete blacklist vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier, with allowurlfopen enabled, allows remote attackers to conduct PHP remote file include attacks via a path parameter that specifies a 1 UNC share or 2 ftps URL, which bypasses the check for "http://", "ftp://"...
Path traversal
Absolute path traversal vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to include and execute arbitrary local files via a direct request with a path parameter with a null character and beginning with 1 '/' slash for an absolute pathname or 2 a drive...
CVE-2006-0785
Absolute path traversal vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to include and execute arbitrary local files via a direct request with a path parameter with a null character and beginning with 1 '/' slash for an absolute pathname or 2 a drive...
CVE-2006-0786
The CVE-2006-0786 entry concerns PHP-Kit prior to 1.6.1 Release 2, where include.php contains an incomplete blacklist vulnerability. When allow_url_fopen is enabled, an attacker can perform PHP remote file include attacks by passing a path parameter that points to a (1) UNC share or (2) ftps URL,...