3730 matches found
CVE-2006-7172
CVE-2006-7172 affects PHP-Stats up to version 0.1.9.1b. Multiple SQL injection flaws exist in php-stats.recphp.php that allow remote attackers to execute arbitrary code via the (1) PC-REMOTE-ADDR HTTP header (in $_SERVER['HTTP_PC_REMOTE_ADDR']) or (2) ip parameter. The header infers a leading dot...
CVE-2006-7172: Undefined Security Weakness
Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers to execute arbitrary code via a leading dotted-quad IP address string in the 1 PC-REMOTE-ADDR HTTP header, which is inserted into $SERVER'HTTPPCREMOTEADDR', or 2 ip parameter...
CVE-2006-7173: Undefined Security Weakness
Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a crafted optionnewreportwday parameter in a preferenze action, which can be later accessed via option/php-stats-options.php...
PHP-Stats 0.1.9.1b - PHP-stats-options.php Command Execution
PHP-Stats 0.1.9.1b - PHP-stats-options.php Command Execution ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b admin 2 exec exploit by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org dork example:...
Php-Stats <= 0.1.9.1b (PC-REMOTE-ADDR) SQL Injection Exploit
No description provided by source. ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b PC-REMOTE-ADDR sql injection / cleat text admin pass disclosure by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org...
Php-Stats <= 0.1.9.1b (php-stats-options.php) admin 2 exec() eExploit
Exploit for unknown platform in category web applications ===================================================================== Php-Stats = 0.1.9.1b php-stats-options.php admin 2 exec eExploit ===================================================================== ?php printr'...
Php-Stats <= 0.1.9.1b (php-stats-options.php) admin 2 exec() eExploit
No description provided by source. ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b admin 2 exec exploit by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org dork example: inurl:php-stats.js.php...
Php-Stats <= 0.1.9.1b (ip) Remote SQL Injection Exploit
No description provided by source. ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b "ip" urldecode/ ereg / sql injection / cleat text admin pass disclosure exploit method ii by rgod mail: retrog at alice dot it site:...
PHP-Stats 0.1.9.1b - 'PHP-stats-options.php' Command Execution
126 $result.=" ."; else $result.=" ".$s...
Php-Stats <= 0.1.9.1b (ip) Remote SQL Injection Exploit
Exploit for unknown platform in category web applications ======================================================= Php-Stats 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0...
PHP-Stats 0.1.9.1b - ip SQL Injection
PHP-Stats 0.1.9.1b - ip SQL Injection 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex =...
PHP-Stats 0.1.9.1b - PC-REMOTE-ADDR SQL Injection
PHP-Stats 0.1.9.1b - PC-REMOTE-ADDR SQL Injection 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex =...
phpStats 0.1.9 - Multiple SQL Injections
phpStats 0.1.9 - Multiple SQL Injections source: https://www.securityfocus.com/bid/23003/info Php-Stats is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an...
Php-Stats <= 0.1.9.1b (PC-REMOTE-ADDR) SQL Injection Exploit
No description provided by source. ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b PC-REMOTE-ADDR sql injection / cleat text admin pass disclosure by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org...
Php-Stats <= 0.1.9.1b (PC-REMOTE-ADDR) SQL Injection Exploit
Exploit for unknown platform in category web applications ============================================================ Php-Stats 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$str...
PHP-Stats 0.1.9.1b - 'ip' SQL Injection
126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex = '\b\d1,3.\d1,3.\d1,3.\d1,3:\d1,5\b'; function se...
PHP-Stats 0.1.9.1b - 'PC-REMOTE-ADDR' SQL Injection
126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex = '\b\d1,3.\d1,3.\d1,3.\d1,3:\d1,5\b'; function...
phpStats 0.1.9 - Multiple SQL Injections
source: https://www.securityfocus.com/bid/23003/info Php-Stats is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application,...
Remote file inclusion
PHP remote file inclusion vulnerability in index.php in Mani Stats Reader 1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ipath parameter...
