orca-rfi.txt

Orca - Interactive Forum Script Remote File Inclusion Vulnerability Discovered by : Ciph3r MAIL : [email protected] SP tanx4: Iranian hacker & Kurdish security TEAM sp TANX2: milw0rm.com & google.com & sourceforge.net CMS download :...

CVE-2008-2884

PHP remote file inclusion vulnerability in display.php in RSS-aggregator allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-2898

Directory traversal vulnerability in includes/header.php in Hedgehog-CMS 1.21 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ctemppath parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname...

Remote file inclusion

PHP remote file inclusion vulnerability in include/plugins/jrBrowser/purchase.php in Jamroom 3.3.0 through 3.3.5, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the jamroomjmdir parameter...

CVE-2008-2888

Multiple PHP remote file inclusion vulnerabilities in MiGCMS 2.0.5, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSapplicationapproot parameter to 1 collection.class.php and 2 contentimage.class.php in lib/obj/...

Remote file inclusion

PHP remote file inclusion vulnerability in src/browser/resource/categories/resourcecategoriesview.php in Open Digital Assets Repository System ODARS 1.0.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CLASSESROOT parameter...

CVE-2008-2886

PHP remote file inclusion vulnerability in include/plugins/jrBrowser/purchase.php in Jamroom 3.3.0 through 3.3.5, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the jamroomjmdir parameter...

CVE-2008-2885

PHP remote file inclusion vulnerability in src/browser/resource/categories/resourcecategoriesview.php in Open Digital Assets Repository System ODARS 1.0.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CLASSESROOT parameter...

CVE-2008-2888

CVE-2008-2888 affects MiGCMS 2.0.5. It describes multiple PHP remote file inclusion vulnerabilities when register_globals is enabled, enabling an attacker to execute arbitrary PHP code via a URL in the GLOBALS[application][app_root] parameter to (1) collection.class.php and (2) content_image.clas...

CVE-2008-2898

Directory traversal vulnerability in includes/header.php in Hedgehog-CMS 1.21 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ctemppath parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname...

CVE-2008-2888

Multiple PHP remote file inclusion vulnerabilities in MiGCMS 2.0.5, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSapplicationapproot parameter to 1 collection.class.php and 2 contentimage.class.php in lib/obj/...

CVE-2008-2884

The vulnerability CVE-2008-2884 affects the RSS-aggregator component, specifically display.php, where a PHP remote file inclusion is possible. An attacker can supply a URL in the path parameter to cause the application to include and execute remote PHP code on the server. Root cause: PHP remote f...

CVE-2008-2885

CVE-2008-2885 affects Open Digital Assets Repository System (ODARS) 1.0.2, where a PHP remote file inclusion vulnerability exists in src/browser/resource/categories/resource_categories_view.php. When register_globals is enabled, an attacker can supply a URL in the CLASSES_ROOT parameter to execut...

CVE-2008-2886

CVE-2008-2886 : The JAMroom platform versions 3.3.0 through 3.3.5 are affected by a PHP remote file inclusion vulnerability in include/plugins/jrBrowser/purchase.php. The issue occurs when register_globals is enabled and allows an attacker to trigger remote PHP code execution via the jamroom[jm_d...

Remote file inclusion

PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the modroot parameter...

CVE-2008-2877

PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the modroot parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in include/plugins/jrBrowser/payment.php in Jamroom 3.3.0 through 3.3.5 allows remote attackers to execute arbitrary PHP code via a URL in the jamroomjmdir parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-2877

PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the modroot parameter...

CVE-2008-2877

CVE-2008-2877 affects cmsWorks 2.2 RC4, where a PHP remote file inclusion vulnerability exists in admin/include/lib.module.php. When register_globals is enabled, an attacker can supply a URL in the mod_root parameter to execute arbitrary PHP code. The entry lists a CVSSv2 base score of 6.8 (MEDIU...

CVE-2008-2883

PHP remote file inclusion vulnerability in include/plugins/jrBrowser/payment.php in Jamroom 3.3.0 through 3.3.5 allows remote attackers to execute arbitrary PHP code via a URL in the jamroomjmdir parameter. NOTE: some of these details are obtained from third party information...