Directory traversal

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

CVE-2007-6184

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

CVE-2007-6184

CVE-2007-6184 affects Project Alumni 1.0.9. The vulnerability arises in index.php where an attacker can use a .. in the act parameter to perform a directory traversal, allowing remote inclusion and execution of local files. The condition is an unrestricted act parameter that leads to file inclusi...

CVE-2007-6184: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

CVE-2007-6184

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

projectalumni-disclose.txt

project alumni 1.0.9 remote file disclosure vulnerability download : https://sourceforge.net/projects/project-alumni/ vulnerable code on index.php include$SERVER'DOCUMENTROOT' . "/pages/" . $GET'act' . ".page.inc.php"; exploit : http://victim/path/index.php?act=../../../../../../etc/passwd%00...

project alumni 1.0.9 - index.php?act Local File Inclusion

project alumni 1.0.9 - index.php?act Local File Inclusion project alumni 1.0.9 remote file disclosure vulnerability download : https://sourceforge.net/projects/project-alumni/ vulnerable code on index.php include$SERVER'DOCUMENTROOT' . "/pages/" . $GET'act' . ".page.inc.php"; exploit :...

project alumni 1.0.9 (index.php act) Local File Inclusion Vulnerability

No description provided by source. project alumni 1.0.9 remote file disclosure vulnerability download : https://sourceforge.net/projects/project-alumni/ vulnerable code on index.php include$SERVER'DOCUMENTROOT' . "/pages/" . $GET'act' . ".page.inc.php"; exploit :...

project alumni 1.0.9 (index.php act) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ======================================================================= project alumni 1.0.9 index.php act Local File Inclusion Vulnerability ======================================================================= project alumni 1.0.9 remo...

project alumni 1.0.9 - 'index.php?act' Local File Inclusion

project alumni 1.0.9 remote file disclosure vulnerability download : https://sourceforge.net/projects/project-alumni/ vulnerable code on index.php include$SERVER'DOCUMENTROOT' . "/pages/" . $GET'act' . ".page.inc.php"; exploit : http://victim/path/index.php?act=../../../../../../etc/passwd%00...

CVE-2007-6126

Multiple cross-site scripting XSS vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to 1 xml/index.php; or 2 the year parameter to view.page.inc.php, which is reachable through a view action to the top-level...

CVE-2007-6127

Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to 1 view.page.inc.php, which is reachable through a view action to index.php; or 2 the year parameter to news.page.inc.php, which is reachabl...

Sql injection

Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to 1 view.page.inc.php, which is reachable through a view action to index.php; or 2 the year parameter to news.page.inc.php, which is reachabl...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to 1 xml/index.php; or 2 the year parameter to view.page.inc.php, which is reachable through a view action to the top-level...

CVE-2007-6126

CVE-2007-6126 affects Project Alumni versions 1.0.9 and earlier. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary scripts via the year parameter in (1) xml/index.php and (2) view.page.inc.php, reachable through a view action to index.php. The...

CVE-2007-6127

CVE-2007-6127 affects project alumni 1.0.9 and earlier. The vulnerability is a SQL injection in the year parameter of two PHP entry points: view.page.inc.php (accessed via a view action to index.php) and news.page.inc.php (via a news action to index.php). Exploitation allows remote attackers to e...

CVE-2007-6127

Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to 1 view.page.inc.php, which is reachable through a view action to index.php; or 2 the year parameter to news.page.inc.php, which is reachabl...

projectalumni-sqlxss.txt

project-alumni sql injection & xss author : tomplixsee [email protected] -------------------------------------------------------------------------- affected software version : project alumni 1.0.9, 1.0.8, or lower?? download : https://sourceforge.net/projects/project-alumni/ vulnerability...

CVE-2007-6127: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to 1 view.page.inc.php, which is reachable through a view action to index.php; or 2 the year parameter to news.page.inc.php, which is reachabl...

CVE-2007-6126: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to 1 xml/index.php; or 2 the year parameter to view.page.inc.php, which is reachable through a view action to the top-level...