CVE-2007-5156

Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php."...

Design/Logic Flaw

Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php."...

CVE-2007-5156

An incomplete blacklist vulnerability exists in the FCKeditor component, specifically within the editor/filemanager/upload/php/upload.php file. This vulnerability affects products such as SiteX CMS 0.7.3.beta , La-Nai CMS , Syntax CMS , and Cardinal CMS . It allows remote attackers to upload and ...

CVE-2007-5156: Undefined Security Weakness

Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php."...

Sql injection

SQL injection vulnerability in search.php in SiteX CMS 0.7.3 Beta allows remote attackers to execute arbitrary SQL commands via the search parameter...

CVE-2007-5141

SQL injection vulnerability in search.php in SiteX CMS 0.7.3 Beta allows remote attackers to execute arbitrary SQL commands via the search parameter...

CVE-2007-5141

SQL injection vulnerability in search.php in SiteX CMS 0.7.3 Beta allows remote attackers to execute arbitrary SQL commands via the search parameter...

CVE-2007-5141

The CVE-2007-5141 entry describes an SQL injection vulnerability in SiteX CMS 0.7.3 Beta, caused by unsafely handling the search parameter in search.php. This allows remote attackers to potentially execute arbitrary SQL commands. Affected component: SiteX CMS (search.php) with input via the searc...

waraxe-2007-SA057.txt

waraxe-2007-SA057 - Unauthorized File Upload in SiteX CMS ==================================================================== Author: Janek Vind "waraxe" Date: 27. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-57.html Target software description:...

CVE-2007-5141: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.php in SiteX CMS 0.7.3 Beta allows remote attackers to execute arbitrary SQL commands via the search parameter...

[waraxe-2007-SA#055] - Sql Injection in SiteX CMS 0.7.3 Beta

waraxe-2007-SA055 - Sql Injection in SiteX CMS 0.7.3 Beta ==================================================================== Author: Janek Vind "waraxe" Date: 27. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-55.html Target software description:...

[waraxe-2007-SA#057] - Unauthorized File Upload in SiteX CMS

waraxe-2007-SA057 - Unauthorized File Upload in SiteX CMS ==================================================================== Author: Janek Vind "waraxe" Date: 27. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-57.html Target software description:...

Sql injection

sitex allows remote attackers to obtain potentially sensitive information via a ' quote value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error...

CVE-2007-1235

Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file...

CVE-2007-1236

sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the 1 sxMonth or 2 sxYear parameter to calendar.php, or the 3 page parameter to calendarevents.php, which reveals the path in various error messages...

CVE-2007-1237

sitex allows remote attackers to obtain potentially sensitive information via a ' quote value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error...

CVE-2007-1235

Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file...

CVE-2007-1236

sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the 1 sxMonth or 2 sxYear parameter to calendar.php, or the 3 page parameter to calendarevents.php, which reveals the path in various error messages...

CVE-2007-1237

sitex allows remote attackers to obtain potentially sensitive information via a ' quote value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error...

CVE-2007-1235

CVE-2007-1235 describes an unrestricted file upload vulnerability in sitex. An attacker can upload arbitrary PHP code by crafting an avatar filename with a double extension (for example, .php.jpg). The system fails to verify the extension properly and saves the file as a .php, enabling remote cod...