CVE-2011-3804: Exposure of Sensitive Information to an Unauthorized Actor

SweetRice 0.7.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugin/tinymce/plugins/advimage/images.php...

CVE-2011-3804

SweetRice 0.7.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugin/tinymce/plugins/advimage/images.php...

JAF CMS 4.0 RC2 Multiple Vulnerabilities

Exploit for php platform in category web applications ======================================== JAF CMS 4.0 RC2 Multiple Vulnerabilities ======================================== Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor Notification: 21...

SweetRice CMS 0.6.7 Multiple Vulnerabilities

Exploit for php platform in category web applications ============================================ SweetRice CMS 0.6.7 Multiple Vulnerabilities ============================================ Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor...

SweetRice 0.6.7 Cross Site Scripting / SQL Injection

========================================== Vulnerability ID: HTB22667 Reference: http://www.htbridge.ch/advisory/sqlinjectioninsweetricecms.html Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor Notification: 21 October 2010 Vulnerability Type...

XSS in SweetRice CMS

Vulnerability ID: HTB22668 Reference: http://www.htbridge.ch/advisory/xssinsweetricecms.html Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor Notification: 21 October 2010 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by Vendor...

SweetRice 0.6.7 - Multiple Vulnerabilities

SweetRice 0.6.7 - Multiple Vulnerabilities Vulnerability ID: HTB22669 Reference: http://www.htbridge.ch/advisory/resetadminpasswordinsweetricecms.html Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor Notification: 21 October 2010 Vulnerabilit...

SQL injection in SweetRice CMS

Vulnerability ID: HTB22667 Reference: http://www.htbridge.ch/advisory/sqlinjectioninsweetricecms.html Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor Notification: 21 October 2010 Vulnerability Type: SQL Injection Status: Fixed by Vendor Ris...

SweetRice 0.6.7 - Multiple Vulnerabilities

Vulnerability ID: HTB22669 Reference: http://www.htbridge.ch/advisory/resetadminpasswordinsweetricecms.html Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor Notification: 21 October 2010 Vulnerability Type: Logic error Status: Not Fixed, Vend...

Reset admin password in SweetRice CMS

Vulnerability ID: HTB22669 Reference: http://www.htbridge.ch/advisory/resetadminpasswordinsweetricecms.html Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor Notification: 21 October 2010 Vulnerability Type: Logic error Status: Not Fixed, Vend...

Multiple Vulnerabilities in SweetRice CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SweetRice CMS which could be exploited to perform cross-site scripting and SQL injection attacks and change administrators password. 1 Cross-site scripting XSS vulnerability in SweetRice CMS The vulnerability...

SweetRice 0.6.4 - FCKeditor Arbitrary File Upload

SweetRice 0.6.4 - FCKeditor Arbitrary File Upload Title: SweetRice 0.6.4 fckeditor Remote File Upload Vendor: http://www.basic-cms.org Dork: "Powered By Basic CMS SweetRice" AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original...

SweetRice <= 0.6.4 (fckeditor) Remote File Upload

Exploit for php platform in category web applications ================================================= SweetRice = 0.6.4 fckeditor Remote File Upload ================================================= Title: SweetRice 0.6.4 fckeditor Remote File Upload Vendor: http://www.basic-cms.org Dork:...

SweetRice Remote File Upload

Title: SweetRice 0.6.4 fckeditor Remote File Upload Vendor: http://www.basic-cms.org Dork: "Powered By Basic CMS SweetRice" AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original Advisory:...

SweetRice < 0.6.4 - 'FCKeditor' Arbitrary File Upload

Title: SweetRice 0.6.4 fckeditor Remote File Upload Vendor: http://www.basic-cms.org Dork: "Powered By Basic CMS SweetRice" AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original Advisory:...

SweetRice 0.6.0 Remote File Inclusion Vulnerabilities

===================================================== SweetRice 0.6.0 Remote File Inclusion Vulnerabilities ===================================================== + SweetRice 0.6.0 Remote File Inclusion Vulnerabilities 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 ...

SweetRice 0.6.0 Remote File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications ===================================================== SweetRice 0.6.0 Remote File Inclusion Vulnerabilities ===================================================== + SweetRice 0.6.0 Remote File Inclusion Vulnerabilities...

CVE-2009-4231

Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to include and execute arbitrary local files via .. dot dot in the plugin parameter...

Directory traversal

Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to include and execute arbitrary local files via .. dot dot in the plugin parameter...

CVE-2009-4231

CVE-2009-4231 describes a directory traversal in SweetRice (versions 0.5.3 and earlier) affecting as/lib/plugins.php. An attacker can trigger local file inclusion and execution by supplying .. in the plugin parameter, enabling arbitrary local file access and execution. The connected records confi...