phpldapadmin Local File Inclusion

No description provided by source. PHPLDAPADMIN LOCAL FILE INCLUSION author : ipsecs website : http://ipsecs.com Date : December, 10th, 2009 -i- Description "Phpldapadmin is web based LDAP client which provides easy, anywhere-accessible, multi-language administration for LDAP server."...

phpLDAPadmin - Local File Inclusion

PHPLDAPADMIN LOCAL FILE INCLUSION author : ipsecs website : http://ipsecs.com Date : December, 10th, 2009 -i- Description "Phpldapadmin is web based LDAP client which provides easy, anywhere-accessible, multi-language administration for LDAP server." http://phpldapadmin.sourceforge.net vulnerable...

e-Courier CMS Tracking xss

Exploit for unknown platform in category web applications ========================== e-Courier CMS Tracking xss ========================== Vendor: e-Courier http://www.ecouriersoftware.com/ Product: CMS Tracking Site Issue: Cross-Site Scripting. Description: Nearly all pages include the URI...

MediaWiki 'IP'参数远程文件包含漏洞

BUGTRAQ: 9057 MediaWiki没有充分过滤用户提交的URI参数，远程攻击者可以利用这个漏洞包含远程服务器上的恶意文件，以WEB权限执行任意代码。 问题应该是对MediaWiki的'IP'参数缺少充分过滤，包含文件可被攻击者任意指令，如果指定远程服务器的恶意PHP文件，可导致以WEB进程权限执行。 MediaWiki-stable 20030829/20031107 临时解决方法： 如果您不能立刻安装补丁或者升级，建议您采取以下措施以降低威胁： 修改php.ini配置文件，关闭'allowurlfopen'和'registerglobals'选项。 厂商补丁：...

Directory traversal

Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to read arbitrary files via a .. dot dot in the uri parameter to dispatcher.php in 1 examples/dispatcher/framework/, 2 examples/dispatcher/, 3 examples/wizard/, and 4 PHP/, different vectors than...

Directory traversal

Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 languagesn.php, 2 languagesf.php, or 3 languages.php in inc/; and 4 allow remote attackers to read arbitrary...

NucleusCMS/Blog:CMS/PunBB未明远程文件包含漏洞

CMS/Blog:CMS/PunBB是基于WEB的BLOG系统和论坛系统。CMS/Blog:CMS/PunBB对用户提交的URI参数缺少充分过滤，远程攻击者可以利用这个漏洞以WEB进程权限在系统上执行任意命令。目前没有详细漏洞细节提供 PunBB PunBB 1.0-1.1.4/Nucleus CMS 3.0-3.0 RC/BLOG:CMS 3.0-3.1.3 厂商补丁：BLOG:CMS--------目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：BLOG:CMS Upgrade BLOG:CMS...

Looking Glass 20040427 - Remote Command Execution

Looking Glass 20040427 - Remote Command Execution source: https://www.securityfocus.com/bid/14682/info Looking Glass may be exploited to execute arbitrary commands. An attacker can prefix arbitrary commands with the '|' character, supply them through a URI parameter and have them executed in the...

PHPCart - Input Validation

source: https://www.securityfocus.com/bid/13406/info PHPCart is prone to a remote input validation vulnerability. The issue exists because the software fails to sufficiently sanitize URI parameter data that is employed when computing product charges. A remote attacker may exploit this issue to...

CityPost PHP Image Editor M3 URI Parameter Cross-Site Scripting Vulnerability

CityPost PHP Image Editor M3 URI Parameter Cross-Site Scripting Vulnerability. Webapps exploit for php platform source: http://www.securityfocus.com/bid/13258/info CityPost Image Cropper/Resizer is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application...

Siteman 1.1 - User Database Privilege Escalation (1)

source: https://www.securityfocus.com/bid/12304/info Siteman is reported prone to a vulnerability that may allow users to gain elevated privileges. This issue results from insufficient sanitization of user-supplied data. Apparently, an attacker can supply additional lines to the stream used to...

Siteman 1.1 - User Database Privilege Escalation (2)

Siteman 1.1 - User Database Privilege Escalation 2 source: https://www.securityfocus.com/bid/12304/info Siteman is reported prone to a vulnerability that may allow users to gain elevated privileges. This issue results from insufficient sanitization of user-supplied data. Apparently, an attacker c...

DCP-Portal 3.74.x5.x - contents.php?cid Cross-Site Scripting

DCP-Portal 3.74.x5.x - contents.php?cid Cross-Site Scripting source: https://www.securityfocus.com/bid/11338/info DCP-Portal is reported prone to multiple cross-site scripting vulnerabilities. It is reported that DCP-Portal does not sufficiently filter URI parameters supplied to several scripts...

DCP-Portal 3.74.x5.x - calendar.php Multiple Cross-Site Scripting Vulnerabilities

DCP-Portal 3.74.x5.x - calendar.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/11338/info DCP-Portal is reported prone to multiple cross-site scripting vulnerabilities. It is reported that DCP-Portal does not sufficiently filter URI parameters supplied...

DCP-Portal 3.74.x5.x - index.php Multiple Cross-Site Scripting Vulnerabilities

DCP-Portal 3.74.x5.x - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/11338/info DCP-Portal is reported prone to multiple cross-site scripting vulnerabilities. It is reported that DCP-Portal does not sufficiently filter URI parameters supplied to...

DCP-Portal 3.7/4.x/5.x - 'announcement.php?cid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/11338/info DCP-Portal is reported prone to multiple cross-site scripting vulnerabilities. It is reported that DCP-Portal does not sufficiently filter URI parameters supplied to several scripts. Because of this deficiency, it is possible for a remote...

PostNuke Modules Factory Subjects Module 2.0 - SQL Injection

PostNuke Modules Factory Subjects Module 2.0 - SQL Injection source: https://www.securityfocus.com/bid/11148/info Reportedly the PostNuke Modules Factory Subjects module is affected by a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize...

ZaireWeb Solutions NewsLetter ZWS - Administrative Interface Authentication Bypass

ZaireWeb Solutions NewsLetter ZWS - Administrative Interface Authentication Bypass source: https://www.securityfocus.com/bid/10605/info Newsletter ZWS is reported prone to an administrative interface authentication bypass vulnerability. The vulnerability exists due to a design error in the...

ArbitroWeb PHP Proxy 0.50.6 - Cross-Site Scripting

ArbitroWeb PHP Proxy 0.50.6 - Cross-Site Scripting source: https://www.securityfocus.com/bid/10592/info It is reported that ArbitroWeb is susceptible to a cross-site scripting vulnerability in its rawURL URI parameter. The URI parameter passed to 'index.php' called 'rawURL' contains the desired...

ArbitroWeb PHP Proxy 0.5/0.6 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/10592/info It is reported that ArbitroWeb is susceptible to a cross-site scripting vulnerability in its rawURL URI parameter. The URI parameter passed to 'index.php' called 'rawURL' contains the desired target for the proxy to connect to. This parameter i...