phpMyFAQ多个页面URL参数跨站脚本漏洞

BUGTRAQ ID: 37180 phpMyFAQ是一款多语言、基于数据库的FAQ系统。 phpMyFAQ没有正确地过滤用户提交给多个页面的变量，远程攻击者可以通过特制的URL请求向页面的输出注入JavaScript代码，导致窃取域Cookie，如会话标识符。 phpMyFAQ 2.5.x 厂商补丁： phpMyFAQ -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.phpmyfaq.de/ http://host/index.php?action=sitemap&lang=code...

CVE-2009-4085

PHP remote file inclusion vulnerability in assets/plugins/mp3id/mp3id.php in PHP Traverser 0.8.0 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSBASE parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2009-3705

PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the configatkroot parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the fsjVroot parameter to 1 sites/site/pages/index.php, 2 sites/test/pages/contact.php, 3 system/pageTemplate.php, and 4 system/utilities.php...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to 1 Calendar.php, 2 Comment.php, 3 Rss.php and 4 Trackback.php in lib/Loggix/Module/; and 5...

CVE-2009-3362

PHP remote file inclusion vulnerability in printnews.php3 in SZNews 2.7 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in add-ons/modules/sysmanager/plugins/install.plugin.php in Aurora CMS 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the AURORAMODULESFOLDER parameter...

CVE-2009-3324

PHP remote file inclusion vulnerability in include/prodler.class.php in ProdLer 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sPath parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in include/header.php in ClearSite 4.50 allows remote attackers to execute arbitrary PHP code via a URL in the csbasepath parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in include/prodler.class.php in ProdLer 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sPath parameter...

CVE-2009-3306

PHP remote file inclusion vulnerability in include/header.php in ClearSite 4.50 allows remote attackers to execute arbitrary PHP code via a URL in the csbasepath parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in cphtml2txt.php in All In One Control Panel AIOCP 1.4.001 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in save.php in phpSANE 0.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the filesave parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in eva/index.php in EVA CMS 2.3.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the evacaminho parameter to index.php...

CVE-2009-3055

PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine DLE 8.2 allows remote attackers to execute arbitrary PHP code via a URL in the dleconfigapi parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in include/engine/content/elements/menu.php in KingCMS 0.6.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIGAdminPath parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Specimen Image Database SID, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to 1 client.php or 2 taxonservice.php...

Remote file inclusion

PHP remote file inclusion vulnerability in searchwA.php in OpenPro 1.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the LIBPATH parameter...

CVE-2008-7087

PHP remote file inclusion vulnerability in searchwA.php in OpenPro 1.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the LIBPATH parameter...

CVE-2008-7000

PHP remote file inclusion vulnerability in index.php in PHPAuction 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the lan parameter. NOTE: this might be related to CVE-2005-2255.1...