2012 matches found
WordPress <= 3.3.1 - Multiple Vulnerabilities
WordPress version 3.3.1 is prone to PHP code execution and persistent cross-site scripting vulnerabilities via "setup-config.php" page. The attackers can host their own MySQL database server and then successfully complete the WordPress installation without having any valid credentials on the targ...
WordPress Core 3.3.1 - Multiple Vulnerabilities
Trustwave's SpiderLabs Security Advisory TWSL2012-002: Multiple Vulnerabilities in WordPress https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Published: 1/24/12 Version: 1.0 Vendor: WordPress http://wordpress.org/ Product: WordPress Version affected: 3.3.1 and prior Product...
miniCMS 1.0 / 2.0 Code Execution
Title : miniCMS v1.0 : v2.0 php inject code Author : Or4nG.M4n Version : all version GDork : "This site is managed using MiniCMS©" Download : http://sourceforge.net/projects/mini-cms/files/mini-cms/ Thnks : +----------------------------------+ | xSs m4n i-Hmx h311 c0d3 | sp. Cyb3r-Crystal |...
[PT-2011-02] PHP code Injection in Kayako Support Suite
----------------------------------------------------------------- PT-2011-02 Positive Technologies Security Advisory PHP code Injection in Kayako Support Suite ----------------------------------------------------------------- --- Vulnerable software Kayako Support Suite Version: 3.70.02-stable an...
Multiple vulnerabilities in ZENphoto
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ZENphoto, which can be exploited to perform arbitrary PHP code execution, sql injection and cross site scripting attacks. 1 Arbitrary PHP Code Execution in ZENphoto: CVE-2012-0993 Input passed via...
Kayako Support Suite 3.70.02 PHP Code Execution
----------------------------------------------------------------- PT-2011-02 Positive Technologies Security Advisory PHP code Injection in Kayako Support Suite ----------------------------------------------------------------- --- Vulnerable software Kayako Support Suite Version: 3.70.02-stable an...
phpLDAPadmin orderby Parameter Arbitrary PHP Code Execution
The version of phpLDAPadmin installed on the remote host does not sanitize input to the 'orderby' parameter of the 'cmd.php' script when 'cmd' is set to 'queryengine' before using it in a call to 'createfunction'. An unauthenticated, remote attacker can leverage this issue to execute arbitrary PH...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to execute arbitrary PHP code via a URL in the classpath parameter to 1 file.php or 2 comdel.php...
CVE-2010-4918
CVE-2010-4918 affects the Joomla! extension iJoomla Magazine (com_magazine) version 3.0.1, where a PHP Remote File Inclusion (RFI) vulnerability in magazine.functions.php allows an attacker to execute arbitrary PHP code via the config parameter in a URL. The underlying issue is an unchecked confi...
Jcow Social Networking Script 4.2 <= 5.2 Arbitrary Code Execution
Exploit for php platform in category web applications Exploit Title: Jcow CMS 4.x:4.2 Software Link: http://sourceforge.net/projects/jcow/files/jcow4/jcow.4.2.1.zip/download Version: 4.x:4.2 5.6.7.8:34441 at Sat Jun 04 00:00:44 +0000 2011 require 'msf/core' class Metasploit3 'JCow CMS Remote...
DVBBS 2.0 index_0_0.php 任意php代码执行漏洞
No description provided by source...
Chyrp 2.x swfupload Extension - upload_handler.php Arbitrary File Upload Arbitrary PHP Code Execution
Chyrp 2.x swfupload Extension - uploadhandler.php Arbitrary File Upload Arbitrary PHP Code Execution source: https://www.securityfocus.com/bid/48672/info Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, an...
Chyrp 2.x swfupload Extension - 'upload_handler.php' Arbitrary File Upload / Arbitrary PHP Code Execution
source: https://www.securityfocus.com/bid/48672/info Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability. An attacker may leverage these issues to execute arbitrary...
Code injection
uploadhandler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a writepost action to the...
Ecmall全版本本地文件包含漏洞
简要描述： Ecmall的默认处理中犯了一个严重的错误，绕开了系统中的保护逻辑从而导致可以包含任意文件以php代码执行 详细说明： eccore/ecmall.php内 if !getmagicquotesgpc $GET = addslashesdeep$GET; $POST = addslashesdeep$POST; $COOKIE= addslashesdeep$COOKIE; / 请求转发 / $defaultapp = $config'defaultapp' ? $config'defaultapp' : 'default'; $defaultact =...
P.A.S. (php web-shell)
P.A.S. v.3.0.x Возможности : - Авторизация по кукам. - Шифрование шелла по вашему паролю сразу при скачивании. - Файловый менеджер : групповое удаление, перемещение, копирование, скачка и загрузка файлов и директорий. переименование и создание файлов и директорий. правка, просмотр, изменении...
vBulletin 4.1.2 search.php SQL Injection
Requirements require 'msf/core' Class declaration class Metasploit3 'vBulletin 4 %q vBulletin versions 4 Exploit Only 'James Bercegay http://www.gulftech.org/ ' , 'License' = MSFLICENSE, 'References' = 'BID', '47281' , , 'Privileged' = false, 'Platform' = 'php', 'Arch' = ARCHPHP, 'Targets' =...
CVE-2010-2789
PHP remote file inclusion vulnerability in MediaWikiParserTest.php in MediaWiki 1.16 beta, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via unspecified vectors...
PHP code execution vulnerability references summary-vulnerability warning-the black bar safety net
A code execution function In PHP you can execute the Code of the function. Such as eval , assert , theand system and exec and shellexec and passthru and escapeshellcmd and pcntlexec , etc. demo code 1.1: The second file contains the code injection The file containing the function in the specific...