CVE-2008-5211

Cross-site scripting XSS vulnerability in search.php in Sphider 1.3.4, when the search suggestion feature is enabled, allows remote attackers to inject arbitrary web script or HTML via the query parameter, a different vector than CVE-2006-2506...

Sphider query参数跨站脚本漏洞

BUGTRAQ ID: 29074 Sphider是基于PHP的开源搜索引擎爬虫程序。 Sphider支持搜索建议功能，如果用户在搜索输入中存在笔误的话，该功能会返回“Did you mean xyz?”。当启用了搜索建议功能的时候，Sphider的search.php文件中没有正确地过滤对query参数的输入便返回给了用户，这允许攻击者通过提交恶意的查询请求执行跨站脚本攻击。 Ando Saabas Sphider 1.3.4 Ando Saabas ----------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Sphider 1.3.4 - query Cross-Site Scripting

Sphider 1.3.4 - query Cross-Site Scripting source: https://www.securityfocus.com/bid/29074/info Sphider is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in...

Sphider 1.3.4 - 'query' Cross-Site Scripting

source: https://www.securityfocus.com/bid/29074/info Sphider is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

CVE-2007-2411

PHP remote file inclusion vulnerability in index.php in Sphider 1.2.x allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter. NOTE: a third party disputes this vulnerability, stating that "the application is not vulnerable to this issue...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in Sphider 1.2.x allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter. NOTE: a third party disputes this vulnerability, stating that "the application is not vulnerable to this issue...

CVE-2007-2411

Affected software: Sphider 1.2.x. Vulnerability: PHP remote file inclusion via index.php, using include_dir parameter to execute arbitrary PHP code. Root cause: remote inclusion in include_dir path. Impact: potential remote code execution with partial confidentiality/integrity/availability implic...

CVE-2007-2411

PHP remote file inclusion vulnerability in index.php in Sphider 1.2.x allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter. NOTE: a third party disputes this vulnerability, stating that "the application is not vulnerable to this issue...

PT-2007-3744 · Sphider · Sphider

Name of the Vulnerable Software and Affected Versions: Sphider versions 1.2.x Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the include dir parameter in the index.php file. A third party disputes this issue, stating that the application is not vulnerabl...

Sphider Version 1.2.x (include_dir) file include

Sphider Version 1.2.x includedir remote file include script Vendor: http://cs.ioc.ee/ando/sphider/ Discovered by: IbnuSina found on index.php $includedir = "./include"; --- no patch here $languagedir = "./languages"; include "$includedir/indexheader.inc"; include "$includedir/conf.php"; include...

CVE-2006-7058

Multiple cross-site scripting XSS vulnerabilities in Sphider before 1.3.1c allow remote attackers to inject arbitrary web script or HTML via the catid parameter to 1 templates/standard/searchform.html and 2 templates/dark/searchform.html. NOTE: the provenance of this information is unknown; the...

CVE-2006-7057

SQL injection vulnerability in search.php in Sphider before 1.3.1c allows remote attackers to execute arbitrary SQL commands via the category parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue might be...

CVE-2006-7057

Technical details (affected versions, root cause nuances, and remediation) are not provided in the supplied connected documents. Monitor for updates from official advisories.

CVE-2006-7057

SQL injection vulnerability in search.php in Sphider before 1.3.1c allows remote attackers to execute arbitrary SQL commands via the category parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue might be...

CVE-2006-7058

Multiple cross-site scripting XSS vulnerabilities in Sphider before 1.3.1c allow remote attackers to inject arbitrary web script or HTML via the catid parameter to 1 templates/standard/searchform.html and 2 templates/dark/searchform.html. NOTE: the provenance of this information is unknown; the...

CVE-2006-7058

CVE-2006-7058 : Concrete XSS vulnerabilities in the Sphider web search implementation (before 1.3.1c) allow remote attackers to inject arbitrary script/HTML via the catid parameter in two templates (standard/search_form.html and dark/search_form.html). Root cause: unsanitized catid value enabling...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO and 2 the category parameter...

CVE-2006-2506

Multiple cross-site scripting XSS vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO and 2 the category parameter...

CVE-2006-2506

CVE-2006-2506 affects Sphider’s search.php, enabling multiple XSS via PATH_INFO and the category parameter. The available connected documents confirm the vulnerable component and vectors but do not provide specific version numbers, exploit details, or remediation within the supplied material. The...

CVE-2006-2506

Multiple cross-site scripting XSS vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO and 2 the category parameter...