CVE-2008-6585

Cross-site request forgery CSRF vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action...

CVE-2008-6584

The affected software is TorrentFlux 2.3 (html/index.php). The vulnerability arises from the url_upload parameter, which accepts a URL to a file with an executable extension; TorrentFlux downloads this file and it can be accessed directly in the html/downloads/ user directory. This enables remote...

CVE-2008-6584

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

CVE-2008-6585

Cross-site request forgery CSRF vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action...

CVE-2008-6585

CVE-2008-6585 concerns a Cross-site request forgery (CSRF) vulnerability in TorrentFlux 2.3, specifically in html/admin.php, that allows remote attackers to hijack administrator authentication to add new accounts via the addUser action. The affected component is the web administration interface’s...

CVE-2008-6585: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action...

CVE-2008-6584: Improper Control of Generation of Code

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

FreeBSD Ports: torrentflux

The remote host is missing an update to the system as announced in the referenced advisory. VID 72f21372-55e4-11db-a5ae-00508d6a62df OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: torrentflux

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Unfixed XSS vulnerability at torrentflux-host.com

Security researcher Codenaur, has submitted on 09/02/2008 a cross-site-scripting XSS vulnerability affecting torrentflux-host.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/03/2008. It is...

CVE-2008-2020

The CAPTCHA implementation as used in 1 Francisco Burzi PHP-Nuke 7.0 and 8.1, 2 my123tkShop e-Commerce-Suite aka 123tkShop 0.9.1, 3 phpMyBitTorrent 1.2.2, 4 TorrentFlux 2.3, 5 e107 0.7.11, 6 WebZE 0.5.9, 7 Open Media Collectors Database aka OpenDb 1.5.0b4, and 8 Labgab 1.1 uses a codebg.jpg...

CVE-2008-2020

The CVE-2008-2020 issue affects multiple CAPTCHA implementations: PHP-Nuke (versions 7.0–8.1), my123tkShop 0.9.1, phpMyBitTorrent 1.2.2, TorrentFlux 2.3, e107 0.7.11, WebZE 0.5.9, Open Media Collectors Database 1.5.0b4, and Labgab 1.1. The root cause is use of a code_bg.jpg background with PHP Im...

PT-2008-3540 · Francisco Burzi +7 · Php-Nuke +7

Name of the Vulnerable Software and Affected Versions: Francisco Burzi PHP-Nuke versions 7.0 through 8.1 my123tkShop e-Commerce-Suite version 0.9.1 phpMyBitTorrent version 1.2.2 TorrentFlux version 2.3 e107 version 0.7.11 WebZE version 0.5.9 Open Media Collectors Database version 1.5.0b4 Labgab...

CVE-2008-2020: Use of Insufficiently Random Values

The CAPTCHA implementation as used in 1 Francisco Burzi PHP-Nuke 7.0 and 8.1, 2 my123tkShop e-Commerce-Suite aka 123tkShop 0.9.1, 3 phpMyBitTorrent 1.2.2, 4 TorrentFlux 2.3, 5 e107 0.7.11, 6 WebZE 0.5.9, 7 Open Media Collectors Database aka OpenDb 1.5.0b4, and 8 Labgab 1.1 uses a codebg.jpg...

TorrentFlux跨站请求伪造及远程PHP脚本执行漏洞

BUGTRAQ ID: 28846 TorrentFlux是使用PHP编写的BitTorrent下载客户端。如果架设在Web服务器上，便可以通过Web界面对BitTorrent下载进行管理。 TorrentFlux在处理下载文件的浏览时存在漏洞，远程攻击者可能利用此漏洞在用户系统上执行恶意代码。 如果用户受骗使用TorrentFlux下载了包含有backdoor.php文件的torrent的话，则在http://localhost/torrentflux2.3/html/downloads/USERNAME/ 查看该文件时就会导致执行该文件。无需口令便可以访问这个文件夹，但需要知道用户名...

BitTorrent Clients and CSRF

The following are proof of concept exploits against three bittorrent clients. uTorrent' WebUI, Azurues's "HTML WebUI", and TorrentFlux. More information: http://www.rooksecurity.com/blog/?p=10 TorrentFlux v2.3Latest http://sourceforge.net/projects/torrentflux/ If you force TorrentFlux to download...

TorrentFlux 2.3 - admin.php Cross-Site Request Forgery (Add Admin)

TorrentFlux 2.3 - admin.php Cross-Site Request Forgery Add Admin source: https://www.securityfocus.com/bid/28846/info TorrentFlux is prone to a cross-site request-forgery vulnerability and a remote PHP code-execution vulnerability. Exploiting these issues may allow a remote attacker to create...

TorrentFlux 2.3 - 'admin.php' Cross-Site Request Forgery (Add Admin)

source: https://www.securityfocus.com/bid/28846/info TorrentFlux is prone to a cross-site request-forgery vulnerability and a remote PHP code-execution vulnerability. Exploiting these issues may allow a remote attacker to create administrative accounts in the application or to execute arbitrary P...

CVE-2006-6600

Cross-site scripting XSS vulnerability in dir.php in TorrentFlux 2.2, when allows remote attackers to inject arbitrary web script or HTML via double URL-encoded strings in the dir parameter, a related issue to CVE-2006-5609...

CVE-2006-6600

Cross-site scripting XSS vulnerability in dir.php in TorrentFlux 2.2, when allows remote attackers to inject arbitrary web script or HTML via double URL-encoded strings in the dir parameter, a related issue to CVE-2006-5609...