CVE-2009-0570

The CVE-2009-0570 entry describes a Directory traversal vulnerability in Ninja Designs Mailist 3.0 (send.php) that is exploitable when PHP register_globals is enabled and magic_quotes_gpc is disabled. An attacker can use a .. path in the load parameter to include and execute arbitrary local files...

CVE-2009-0441

PHP remote file inclusion vulnerability in skinshop/standard/2viewbody/bodydefault.php in TECHNOTE 7.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the shopthisskinpath parameter, a different vector than CVE-2008-4138...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when registerglobals is enabled and magicquotesgpc is disabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 theme parameter to a 179squareboxpdslist/view.php, b 179squareboxminishopexpand/view.php, c...

Coppermine Photo Gallery 1.4.19 - Remote File Upload

Written By Michael Brooks Special thanks to str0ke! Coppermine Photo gallery - Remote PHP File Upload Affects: v1.4.19 Homepage: http://coppermine-gallery.net/ 5,239,057 downloads from sf.net! For this attack we need registerglobals=on . The problem is that the anti-registerglobals security can b...

Coppermine Photo Gallery 1.4.19 File Upload

Written By Michael Brooks Special thanks to str0ke! Coppermine Photo gallery - Remote PHP File Upload Affects: v1.4.19 Homepage: http://coppermine-gallery.net/ 5,239,057 downloads from sf.net! For this attack we need registerglobals=on . The problem is that the anti-registerglobals security can b...

Pixie CMS 1.0 Local File Inclusion

Digital Security Research Group DSecRG Advisory DSECRG-09-005 Application: Pixie CMS Versions Affected: 1.0 Vendor URL: http://www.getpixie.co.uk/ Bug: Multiple Local File Include Exploits: YES Reported: 29.08.2008 Vendor Response: 30.08.2008 Solution: NONE Date of Public Advisory: 27.01.2009...

Flax Article Manager 1.1 Remote PHP Script Upload Vulnerability

Exploit for unknown platform in category web applications =============================================================== Flax Article Manager 1.1 Remote PHP Script Upload Vulnerability =============================================================== Flax Article Manager 1.1 Remote File Upload...

Pixie CMS 1.0 Multiple Local File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications =========================================================== Pixie CMS 1.0 Multiple Local File Inclusion Vulnerabilities =========================================================== Digital Security Research Group DSecRG Advisory DSECRG-09-0...

Pixie CMS 1.0 Multiple Local File Inclusion Vulnerabilities

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-09-005 Application: Pixie CMS Versions Affected: 1.0 Vendor URL: http://www.getpixie.co.uk/ Bug: Multiple Local File Include Exploits: YES Reported: 29.08.2008 Vendor Response: 30.08.2008 Solution: NONE Date...

OpenGoo 1.1 - Local File Inclusion

OpenGoo 1.1 - Local File Inclusion OpenGoo 1.1 Local File Inclusion http://www.opengoo.org/ magicquotesgpc = Off registerglobals = On http://site/opengoo/public/upgrade/index.php POST: formdatascriptclass=/../../../../../../../../../../../etc/passwd%00.html Author Notified: Jan. 18...

Aj Classifieds - For Sale v3 Remote Shell Upload Vulnerability

No description provided by source. AJClassifieds Merchandise RFu script down: http://www.ajclassifieds.net/demo/ajclassifiedsme/ClassifiedsMerchandise/ ---------------------------------------------------------- Discovered By: ZoRLu msn: [email protected] Date: 16.01.09 Home: z0rlu.blogspot.com...

Design/Logic Flaw

The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service...

XOOPS mydirname参数多个PHP代码注入漏洞

BUGTRAQ ID: 33176 Xoops是非常流行的动态web内容管理系统，用面向对象的PHP编写。...

CVE-2008-5878

CVE-2008-5878 affects Phpclanwebsite (also known as PCW) up to version 1.23.3 Fix Pack 5. The issue arises when magic_quotes_gpc is disabled and register_globals is enabled, allowing remote attackers to include and execute arbitrary files via a directory traversal in the following parameters: (1)...

Constructr CMS 3.02.5 SQL Injection / Traversal

Constructr CMS http://constructr-cms.org/ - = 3.02.5 "Stable" - magicquotesgpc = Off registerglobals = On - Directory Traversal - Source Disclosure - Arbitrary File Creation - Etc Etc Etc - http://site/constructr/backend/template.php?editfile= Db info: ../config/config.inc.php - SQL -...

Directory traversal

Multiple directory traversal vulnerabilities in AIST NetCat 3.12 and earlier, when magicquotesgpc is disabled and registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the system parameter in modules/netshop/post.php; and the...

freeSSHd SFTP命令远程缓冲区溢出漏洞

BUGTRAQ ID: 32972 freeSSHd是一款免费的SSH服务程序。 freeSSHd SFTP命令存在多个缓冲区溢出，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击，也可以以运行此程序的用户进程权限执行任意代码。 freeSSHd 1.2.1 目前没有解决方案提供： http://freesshd.com/ FreeSSHd Multiple Remote Stack Overflow Vulnerabilities. Version : 1.2.1 Advisory: http://www.bmgsec.com.au/advisory/42/ Discovered &...

CMS NetCat 3.12 - Multiple Vulnerabilities

CMS NetCat 3.12 - Multiple Vulnerabilities NetCat &control= etc. 4. HTTP Response Sp...

PHPLD 3.3 - Blind SQL Injection

phpLD 3.3 Blind SQL Injection http://www.phplinkdirectory.com/ magicquotesgpc = Off registerglobals = On Vulnerable: GET http://site/phpld/page.php?name= True Request: validpagename' or 1=1 False Request: validpagename' or 1=0 Try this urlencode: validpagename' or ORDMIDSELECT PASSWORD FROM PLDUS...

PHPLD 3.3 - Blind SQL Injection

PHPLD 3.3 - Blind SQL Injection phpLD 3.3 Blind SQL Injection http://www.phplinkdirectory.com/ magicquotesgpc = Off registerglobals = On Vulnerable: GET http://site/phpld/page.php?name= True Request: validpagename' or 1=1 False Request: validpagename' or 1=0 Try this urlencode: validpagename' or...