CVE-2005-3050

PhpMyFaq 1.5.1 allows remote attackers to obtain sensitive information via a LANGCODE parameter that does not exist, which reveals the path in an error message...

CVE-2005-3049

PhpMyFaq 1.5.1 stores data files under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain sensitive information via a direct request to the data/trackingDATE file...

CVE-2005-3050

PhpMyFaq 1.5.1 allows remote attackers to obtain sensitive information via a LANGCODE parameter that does not exist, which reveals the path in an error message...

CVE-2005-3048

Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. dot dot in the LANGCODE parameter, which also allows direct code injection via the User Agent field in a request packet, which can be activated ...

CVE-2005-3048

CVE-2005-3048 affects PhpMyFAQ 1.5.1, where a directory traversal via LANGCODE in index.php can cause reading of arbitrary files or including arbitrary PHP files, enabling remote code execution via the request data (notably the User Agent field) and referencing the user tracking data file. The Op...

CVE-2005-3047

Multiple cross-site scripting XSS vulnerabilities in PhpMyFaq 1.5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 PMFCONFversion parameter to footer.php or 2 PMFLANGmetaLanguage to header.php...

CVE-2005-3049

CVE-2005-3049 affects phpMyFAQ 1.5.1, where data files are stored under the web document root with insufficient access control and predictable filenames. This allows remote attackers to obtain sensitive information via a direct request to data/tracking[DATE]. The NVD entry assigns a base score of...

CVE-2005-3049

PhpMyFaq 1.5.1 stores data files under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain sensitive information via a direct request to the data/trackingDATE file...

CVE-2005-3050

PhpMyFaq 1.5.1 is affected by CVE-2005-3050, enabling remote attackers to disclose sensitive information through a non-existent LANGCODE parameter that reveals file paths in error messages. The NVD entry assigns a base score of 5.0 (Medium) with network access, low attack complexity, and partial ...

CVE-2005-3047

CVE-2005-3047 describes multiple cross-site scripting (XSS) vulnerabilities in PhpMyFaq 1.5.1. The flaws allow remote attackers to inject arbitrary web script or HTML via two parameters: PMF_CONF[version] in footer.php and PMF_LANG[metaLanguage] in header.php. Documents consistently reference Php...

CVE-2005-3046

CVE-2005-3046 affects PhpMyFaq 1.5.1. The vulnerability is a SQL injection in password.php via the user field, enabling remote attackers to modify SQL queries and gain administrator privileges. Connected sources corroborate the issue and its impact; exploitation specifics are not provided beyond ...

CVE-2005-3046

SQL injection vulnerability in password.php in PhpMyFaq 1.5.1 allows remote attackers to modify SQL queries and gain administrator privileges via the user field...

PHPMyFAQ 1.5.1 - Multiple Cross-Site Scripting Vulnerabilities

PHPMyFAQ 1.5.1 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/14928/info PHPMyFAQ is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution

If magic quotes are off there's a SQL injection when sending a forgotten password. It's possible to overwrite the admin password and to take over the whole system. In some files in the admin section there are some cross site scripting vulnerabilities. In the public frontend it's possible to inclu...

phpMyFAQ 1.5.1 - 'User-Agent' Remote Shell Injection

?php 17.34 22/09/2005 phpmyfaqxpl.php PhpMyFaq 1.5.1 possibly prior versions shell inject by rgod site: http://rgod.altervista.org make these changes in your php.ini if you have troubles to launch this script: allowcalltimepassreference = on registerglobals = on usage: launch this script from...

phpMyFAQ <= 1.5.1 (User-Agent) Remote Shell Injection Exploit

No description provided by source. ?php 17.34 22/09/2005 phpmyfaqxpl.php PhpMyFaq 1.5.1 possibly prior versions shell inject by rgod site: http://rgod.altervista.org make these changes in your php.ini if you have troubles to launch this script: allowcalltimepassreference = on registerglobals = on...

phpMyFAQ <= 1.5.1 (User-Agent) Remote Shell Injection Exploit

Exploit for unknown platform in category web applications ============================================================= phpMyFAQ = 1.5.1 User-Agent Remote Shell Injection Exploit ============================================================= ?php 17.34 22/09/2005 phpmyfaqxpl.php PhpMyFaq 1.5.1...

phpMyFAQ 1.5.1 - User-Agent Remote Shell Injection

phpMyFAQ 1.5.1 - User-Agent Remote Shell Injection ?php 17.34 22/09/2005 phpmyfaqxpl.php PhpMyFaq 1.5.1 possibly prior versions shell inject by rgod site: http://rgod.altervista.org make these changes in your php.ini if you have troubles to launch this script: allowcalltimepassreference = on...

PHPMyFAQ 1.5.1 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/14928/info PHPMyFAQ is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in t...

PHPMyFAQ 1.5.1 - Password.php SQL Injection

PHPMyFAQ 1.5.1 - Password.php SQL Injection source: https://www.securityfocus.com/bid/14927/info phpMyFAQ is affected by an SQL injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input before using it in a SQL query. This vulnerability could...