EUVD-2005-0932

Malware in sbrugna...

The Includer remote command execution flaw

The remote web server contains a PHP script that is affected by a remote code execution vulnerability. The remote host is running The Includer, a PHP script for emulating server-side includes. The version of The Includer installed on the remote host allows an attacker to execute arbitrary shell...

CVE-2005-1356: Undefined Security Weakness

Cross-site scripting XSS vulnerability in includer.cgi script in The Includer allows remote attackers to inject arbitrary web script or HTML via the argument...

CVE-2005-1355: Undefined Security Weakness

includer.cgi in The Includer allows remote attackers to read arbitrary files via a full pathname in the argument, a similar vulnerability to CVE-2005-0801...

CVE-2005-0931

PHP remote file inclusion vulnerability in The Includer 1.0 and 1.1 allows remote attackers to execute arbitrary PHP code...

CVE-2005-0931: Undefined Security Weakness

PHP remote file inclusion vulnerability in The Includer 1.0 and 1.1 allows remote attackers to execute arbitrary PHP code...

The Includer 1.0/1.1 - Remote File Inclusion

source: https://www.securityfocus.com/bid/12926/info The Includer is reported prone to a remote file include vulnerability. The problem presents itself specifically when an attacker passes the location of a remote script through an affected parameter. An attacker may leverage this issue to execut...

CVE-2005-0801: Undefined Security Weakness

Directory traversal vulnerability in includer.cgi in The Includer allows remote attackers to read arbitrary files via 1 a .. dot dot or 2 a full pathname in the URL...

includerExec.txt

Remote Command Execution Script: The Includer www.smarterscripts.com/includer/ Remote Command Execution on: Example I.: www.host-vulnerable.com/includer.cgi?|id| Example II.: www.host-vulnerable.com/includer.cgi?template=|id| Sorry if the bug is already posted ;...

CVE-2005-0689: Undefined Security Weakness

includer.cgi in The Includer allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the URL or 2 the template parameter...