LoveCMS 1.4 install/index.php step Parameter Traversal Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacker ca...

ttCMS 2.2 / ttForum 1.1 News.php template Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/7542/info A remote file include vulnerability has been reported for both ttForum and ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'News.php' and 'Install.php' scripts, it is possible for ...

EasyDynamicPages 1.0 config_page.php Remote PHP File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9338/info EasyDynamicPages is prone to a remote file include vulnerability in a configuration script. This will permit a remote attack to include malicious PHP scripts from remote servers, which will then be executed by t...

Tastydir <= 1.2 (1216) Multiple Vulnerabilities

No description provided by source. Exploit Title: Tastydir = 1216 folder creation vuln Date: Oct 17 2010 Author: R Software Link: http://codecanyon.net/item/tastydir-an-ajax-file-manager-and-dir-listing/117167 Version: 1216 Tested on: Ubuntu 10.10 Information: Tastydir is a cross-platform PHP fil...

S8Forum 3.0 - Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6547/info S8Forum is prone to a remote command execution vulnerability. When a user registers with the forum, a file is created locally with the specified username. The contents of this file will be the data entered by th...

ILIAS 4.4.1 - Multiple Vulnerabilities

No description provided by source. ============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias.de...

X2CRM 3.4.1 - Multiple Vulnerabilities

No description provided by source. Advisory ID: HTB23172 Product: X2CRM Vendor: X2Engine Inc. Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Advisory Published: September 4, 2013 Vendor Notification: September 4, 2013 Vendor Patch: September 10, 2013 Public Disclosure:...

Libra PHP File Manager <= 1.18 Insecure Cookie Handling Vulnerability

No description provided by source. + Libra PHP File Manager Insecure Cookie Handling Vulnerability + Discovered By Stack + Greetz : All my freind --- exploit: javascript:document.cookie = user=1; path=/; document.cookie = pass=1; path=/; milw0rm.com 2008-09-26...

AlienVault 4.5.0 Authenticated SQL Injection

No description provided by source. The following request is vulnerable to a SQL injection attack from authenticated users. GET /ossim/report/BusinessAndComplianceISOPCI/ISO27001Bar1.php?datefrom=2014-02-28&dateto=2014-03-30 HTTP/1.1 Host: 172.31.16.150 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux...

BabyGekko 1.2.2e Multiple Vulnerabilities

No description provided by source. Advisory ID: HTB23122 Product: BabyGekko Vendor: babygekko.com Vulnerable Versions: 1.2.2e and probably prior Tested Version: 1.2.2e Vendor Notification: October 24, 2012 Vendor Patch: November 4, 2012 Public Disclosure: November 14, 2012 Vulnerability Type: SQL...

@lexPHPTeam @lex Guestbook 3.12 Remote PHP File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11260/info A vulnerability is reported to exist in the @lexPHPTeam @lex Guestbook software that may allow an attacker to include malicious PHP files containing arbitrary code to be executed on a vulnerable system. The iss...

WordPress image-symlinks Plugin Arbitrary File Upload Vulnerability

Author = X-Bruno E-mail = email protected Facebook = http://fb.me/Inj3ct.Bruno Google Dork = inurl:/wp-content/plugins/image-symlinks/ Usage Info = Exploit Info : The attacker can uplaod file/shell.php "php" // Allowed file extensions "/uploadify/"; // The path were we will save the file getcwd m...

ecmall后台某处任意文件读取

简要描述： 很高兴看到shopex团队终于扛起了这个烂摊子发布了部分的ecmall补丁，可喜可贺的同时再提个醒，前台注射还没有修复完毕，在此先不表。 ecmall后台某处存在任意文件读取漏洞，可以读取服务器系统文件等。 详细说明： 文件admin\app\db.app.php line:198 function download $file = isset$GET'file' ? trim$GET'file' : ''; $backupname = isset$GET'backupname' ? trim$GET'backupname' : ''; if !$file...

Localize: A Serious Bug on SIGNUP Process!

Hello, I found a bug on your registration/Sign UP process.. You should fix this one soon as Possible! With This bug, Attacker will able to create thousands of ID's on you application.. POC ------ it can be done in three 3 ways.. 1 By CSRF .. Copy You Registration FORM source only form code is...

AlienVault Authenticated SQL Injection Arbitrary File Read

AlienVault 4.5.0 is susceptible to an authenticated SQL injection attack via a PNG generation PHP file. This module exploits this to read an arbitrary file from the file system. Any authenticated user is able to exploit it, as administrator privileges aren't required. This module requires...

CVE-2014-2089

ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain clientid pathname...

Joomla ofc_upload_image.php Unrestricted File Upload (CVE-2009-4140)

A remote code execution vulnerability has been reported in Joomla. The vulnerability is due to improper validation. A remote attacker can exploit this issue by uploading a specially crafted php file to the target...

ILIAS 4.4.1 Cross Site Scripting / Shell Upload Vulnerabilities

ILIAS version 4.4.1 suffers from cross site scripting and remote shell upload vulnerabilities. ============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias....

ILIAS 4.4.1 - Multiple Vulnerabilities

============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias.de ============================================================== First from admin user logged...

Imageview 6.x Shell Upload

Author: TUNISIAN CYBER + Exploit Title: Imageview File Upload vulnerability + Date: 20-01-2014 + Category: WebApp + Google Dork: : + Tested on: KaliLinux + Friendly Sites: na3il.com,th3-creative.com +Exploit: Imageview Suffers from a File Upload Vulnerability which allows the attacker to upload a...