Pligg CMS 2.0.0rc2 - Cross-Site Request Forgery (File Creation)

Pligg CMS 2.0.0rc2 - Cross-Site Request Forgery File Creation --------------------------------------------------- Exploit Title: Pligg CMS - CSRF Vulnerability Author: DaOne Vendor Homepage: http://pligg.com/ Download link: https://github.com/Pligg/pligg-cms/archive/2.0.0rc2.zip Category:...

Pligg CMS 2.0.0rc2 - CSRF File Creation Vulnerability

Exploit for php platform in category web applications -Create File by CSRF Exploit- " 0day.today 2018-02-15...

Pligg CMS 0.9 / 1.x Command Execution

!/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex =...

Multiple vulnerabilities in Pligg CMS

Advisory ID: HTB23089 Product: Pligg CMS Vendor: Pligg, LLC. Vulnerable Versions: 1.2.1 and probably prior Tested Version: 1.2.1 Vendor Notification: 25 April 2012 Vendor Patch: 18 May 2012 Public Disclosure: 23 May 2012 Vulnerability Type: Local File Inclusion, Cross-Site Scripting XSS CVE...

CVE-2012-2436

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter in a move or 2 minimize action to admin/adminindex.php; 3 the karmausername parameter to module.php in the karma module; 4 q1low, ...

CVE-2012-2937

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

CVE-2012-2936

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 page parameter to a admin/admincomments.php or b admin/adminlinks.php; or list parameter in a 3 move or 4 minimize action to c...

CVE-2012-2435

Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to module.php, as demonstrated by cross-site request forgery CSRF attacks...

Directory traversal

Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to module.php, as demonstrated by cross-site request forgery CSRF attacks...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter in a move or 2 minimize action to admin/adminindex.php; 3 the karmausername parameter to module.php in the karma module; 4 q1low, ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 page parameter to a admin/admincomments.php or b admin/adminlinks.php; or list parameter in a 3 move or 4 minimize action to c...

Sql injection

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

CVE-2012-2937

CVE-2012-2937 affects Pligg CMS, prior to 1.2.2. The vulnerability is multiple SQL injection flaws in the core/admin and module code: (1) list parameter in move action to admin/admin_index.php, (2) display parameter in minimize action to admin/admin_index.php, (3) enabled[] parameter to admin/adm...

CVE-2012-2436

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter in a move or 2 minimize action to admin/adminindex.php; 3 the karmausername parameter to module.php in the karma module; 4 q1low, ...

CVE-2012-2435

Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to module.php, as demonstrated by cross-site request forgery CSRF attacks...

CVE-2012-2936

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 page parameter to a admin/admincomments.php or b admin/adminlinks.php; or list parameter in a 3 move or 4 minimize action to c...

CVE-2012-2937

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 list parameter in a move action to admin/adminindex.php, 2 display parameter in a minimize action to admin/adminindex.php, 3 enabled parameter to admin/adminusers.ph...

CVE-2012-2435

Pligg CMS (prior to 1.2.2) has a directory traversal / Local File Inclusion vulnerability in the captcha module (module.php) that allows remote authenticated users to include and execute local files via the captcha parameter, demonstrated as a CSRF-exploitation vector. The CVE entry CVE-2012-2435...

CVE-2012-2436

Pligg CMS 1.2.1 is affected by multiple XSS vulnerabilities (CVE-2012-2436) due to insufficient sanitization of inputs in several parameters across admin and module PHP files. Specifically, vectorized input includes arbitrary GET parameters to /admin/admin_index.php (action=move/minimize), the ka...

CVE-2012-2936

CVE-2012-2936 affects Pligg CMS prior to 1.2.2. The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary script/HTML via: (1) user or (2) page parameters to (a) admin/admin_comments.php or (b) admin/admin_links.php, or the list parameter in a ...