MyKtools 2.4 - 'langage' Local File Inclusion

Autor: x0r Email: evolutionteam.x0atgmaildotcom Download: http://www.easy-script.com/scripts-dl/MyKtools-v2-4.zip Bug: LFI Bug: In \update.php // Include du fichier langue if $GET'langage' $langue = $GET'langage'; include "lang/".$langue.".php"; Exploit:...

MyKtools 2.4 - langage Local File Inclusion

MyKtools 2.4 - langage Local File Inclusion Autor: x0r Email: evolutionteam.x0atgmaildotcom Download: http://www.easy-script.com/scripts-dl/MyKtools-v2-4.zip Bug: LFI Bug: In \update.php // Include du fichier langue if $GET'langage' $langue = $GET'langage'; include "lang/".$langue.".php"; Exploit...

Pluck CMS 4.5.3 - 'update.php' Remote File Corruption

"; copy"data/title.dat", "data/settings/title.dat"; unlink"data/settings/install.dat"; copy"data/install.dat", "data/settings/install.dat"; copy"data/options.php", "data/settings/options.php"; copy"data/pass.php", "data/settings/pass.php"; unlink"data/settings/langpref.php";...

CVE-2008-3301: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in BilboBlog 0.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 content parameter to admin/update.php, related to conflicting code in widget.php; and allow remote attackers to inject arbitrary web scri...

Sql injection

Multiple SQL injection vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to execute arbitrary SQL commands via 1 the from parameter to index.php or 2 the page parameter to update.php...

CVE-2007-6559

Multiple SQL injection vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to execute arbitrary SQL commands via 1 the from parameter to index.php or 2 the page parameter to update.php...

CVE-2007-6559: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to execute arbitrary SQL commands via 1 the from parameter to index.php or 2 the page parameter to update.php...

Logaholic - update.php?page SQL Injection

Logaholic - update.php?page SQL Injection source: https://www.securityfocus.com/bid/27003/info Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the...

CVE-2007-1516: Undefined Security Weakness

PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the functionsdir parameter...

CCMail Update.PHP远程文件包含漏洞

CCMail是一款基于PHP的WEB应用程序。 CCMail不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Update.PHP'脚本对用户提交的'functiondir'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Cicoandcico CcMail 1.0.1 目前没有解决方案提供： http://www.cicoandcico.com !/usr/bin/perl CcMail 1.0 Remote File Inclusion Exploit...

CcMail 1.0.1 (update.php functions_dir) Remote File Inclusion Exploit

No description provided by source. !/usr/bin/perl CcMail 1.0 Remote File Inclusion Exploit Download Script http://www.cicoandcico.com/download/ccmail/ccmail1.0.1.tar.gz Bug Found & coded By CrackersChild [email protected] Kullanimi perl cra.pl perl cra.pl http://site.com/...

CVE-2007-1043

Ezboo webstats, possibly 3.0.3, allows remote attackers to bypass authentication and gain access via a direct request to 1 update.php and 2 config.php...

EUVD-2007-1040

Ezboo webstats, possibly 3.0.3, allows remote attackers to bypass authentication and gain access via a direct request to 1 update.php and 2 config.php...

CVE-2007-1043

CVE-2007-1043 concerns Ezboo Webstats (possibly v3.0.3), where an authentication bypass enables remote access via direct requests to 1) update.php and 2) config.php. Multiple sources corroborate a remote, unauthenticated bypass affecting the product, with a CVSS v2 base score of 7.5 (HIGH) and ne...

CVE-2007-1043: Undefined Security Weakness

Ezboo webstats, possibly 3.0.3, allows remote attackers to bypass authentication and gain access via a direct request to 1 update.php and 2 config.php...

CVE-2006-5289: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Vtiger CRM 4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the calpath parameter to 1 modules/Calendar/admin/update.php, 2 modules/Calendar/admin/scheme.php, or 3 modules/Calendar/calendar.php...

vtiger CRM <= 4.2 (calpath) Multiple Remote File Include Vulnerabilities

No description provided by source. \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple Remote File Inclusion...

vTiger CRM 4.2 - 'calpath' Multiple Remote File Inclusions

\ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple Remote File Inclusion Vulnerability...

vTiger CRM 4.2 - calpath Multiple Remote File Inclusions

vTiger CRM 4.2 - calpath Multiple Remote File Inclusions \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple...

vtiger -- multiple remote file inclusion vulnerabilities

Dedi Dwianto a.k.a theday reports: Input passed to the "$calpath" parameter in update.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources...