VWar 1.5 - 'news.php?vwar_root' Remote File Inclusion

source: https://www.securityfocus.com/bid/19387/info VWar is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and...

Vwar v1.5.0 <= Sql Injection and XSS vuln.

IHST Iran HackerZ Security Team WhiteHat Part ------------------------------------------------- Vendor : www.vwar.de vuln. Version = v1.5.0 and lower Credits : MFox Contact : [email protected] HomePage : www.hackerz.ir ------------------------------------------------- Proof of Concept...

VWar 1.x - war.php Multiple SQL Injections

VWar 1.x - war.php Multiple SQL Injections source: https://www.securityfocus.com/bid/19327/info Vwar is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. These issues occur because the application fails to properly sanitize user-supplied...

VWar 1.x - 'war.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/19327/info Vwar is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. These issues occur because the application fails to properly sanitize user-supplied input. A successful exploit of these...

VWar 1.x - war.php?page Cross-Site Scripting

VWar 1.x - war.php?page Cross-Site Scripting source: https://www.securityfocus.com/bid/19327/info Vwar is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. These issues occur because the application fails to properly sanitize user-supplie...

VWar 1.x - 'war.php?page' Cross-Site Scripting

source: https://www.securityfocus.com/bid/19327/info Vwar is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. These issues occur because the application fails to properly sanitize user-supplied input. A successful exploit of these...

Update Protection against VWar Remote File Inclusion Vulnerability

Several vulnerabilities have been reported in Virtual War VWar due to input validation errors in several scripts. Remote attackers could exploit these vulnerabilities to include malicious files and compromise a vulnerable system...

CVE-2006-3139

CVE-2006-3139 concerns multiple SQL injection flaws in war.php of Virtual War (VWar) 1.5.0 R14 and earlier. The vulnerability arises in the war.php handler, where user-supplied input through the parameters (s, showgame, sortorder, sortby) is used to construct SQL queries, enabling remote attacker...

CVE-2006-3139: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in war.php in Virtual War VWar 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 s, 2 showgame, 3 sortorder, and 4 sortby parameters...

CVE-2006-2091

CVE-2006-2091 affects Virtual War (VWar) — specifically VWar 1.5 and all versions before 1.2. The issue is an information disclosure: an invalid vwar_root parameter causes an error message that reveals the server path. This is a remote-access concern with partial confidentiality impact and no int...

CVE-2006-2091: Undefined Security Weakness

admin.php in Virtual War VWar 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwarroot parameter, which reveals the path in an error message...

VWar Path Disclosure

SUMMARY : VWar is is a clan management system. It stores all clan members details. Logs match results and keeps track of upcomming matches. Using the links under the Vwar menu, you can view all clan members, view upcomming matches, view previous results, view clan statistics and members can log...

Remote file inclusion

PHP remote file inclusion vulnerability in Virtual War VWar 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwarroot parameter to 1 admin/admin.php, 2 war.php, 3 stats.php, 4 news.php, 5 joinus.php, 6 challenge.php, 7 calendar.php, 8 member.php, 9 popup.php, and other...

CVE-2006-1747

PHP remote file inclusion vulnerability in Virtual War VWar 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwarroot parameter to 1 admin/admin.php, 2 war.php, 3 stats.php, 4 news.php, 5 joinus.php, 6 challenge.php, 7 calendar.php, 8 member.php, 9 popup.php, and other...

CVE-2006-1747

CVE-2006-1747 affects Virtual War (VWar) 1.5.0 and earlier. It is a PHP remote file inclusion vulnerability allowing an attacker to execute arbitrary PHP code by supplying a URL in the vwar_root parameter to admin/admin.php, war.php, stats.php, news.php, joinus.php, challenge.php, calendar.php, m...

CVE-2006-1747

PHP remote file inclusion vulnerability in Virtual War VWar 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwarroot parameter to 1 admin/admin.php, 2 war.php, 3 stats.php, 4 news.php, 5 joinus.php, 6 challenge.php, 7 calendar.php, 8 member.php, 9 popup.php, and other...

PT-2006-2739 · Vwar · Virtual War

PHP remote file inclusion vulnerability in Virtual War VWar 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar root parameter to 1 admin/admin.php, 2 war.php, 3 stats.php, 4 news.php, 5 joinus.php, 6 challenge.php, 7 calendar.php, 8 member.php, 9 popup.php, and othe...

CVE-2006-1747: Undefined Security Weakness

PHP remote file inclusion vulnerability in Virtual War VWar 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwarroot parameter to 1 admin/admin.php, 2 war.php, 3 stats.php, 4 news.php, 5 joinus.php, 6 challenge.php, 7 calendar.php, 8 member.php, 9 popup.php, and other...

Remote file inclusion

PHP remote file inclusion vulnerability in getheader.php in VWar 1.5.0 R12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwarroot parameter. NOTE: this is a different vulnerability than CVE-2006-1503...

CVE-2006-1636

PHP remote file inclusion vulnerability in getheader.php in VWar 1.5.0 R12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwarroot parameter. NOTE: this is a different vulnerability than CVE-2006-1503...