CVE-2002-1878

W-Agora 4.1.3 is affected by a PHP remote file inclusion vulnerability (CVE-2002-1878) via the inc_dir parameter. The root cause is lack of sanitization of user-supplied data, enabling a remote attacker to execute arbitrary PHP code on the affected system. Exploitation details are not provided in...

CVE-2002-1878: Undefined Security Weakness

PHP remote file inclusion vulnerability in w-Agora 4.1.3 allows remote attackers to execute arbitrary PHP code via the incdir parameter...

W-Nailer 0.34

случайно обнаружыл искал уязвимости на чужом сайте уязвимость в W-Nailer 0.34. Разработчик - http://wnailer.vddh.com/ Узвимость: в файле scripts/thumb.php не проверяется file, в итоге - возможность просмотра любых файлоф на сайте, при просмотре превьюшек типа шелла что-то Пример:...

CVE-2004-1562

The connected Nessus/NV documents confirm CVE-2004-1562 affects w-Agora 4.1.6a; vulnerability is a SQL injection in redir_url.php, exploitable via the key parameter to execute arbitrary SQL in the remote database. The related NASL entry also notes additional input validation flaws (XSS and HTTP r...

CVE-2004-1563

Multiple cross-site scripting XSS vulnerabilities in w-Agora 4.1.6a allow remote attackers to execute arbitrary web script or HTML via the 1 thread parameter to downloadthread.php, 2 loginuser parameter to login.php, or 3 userid parameter to forgotpassword.php...

CVE-2004-1562

SQL injection vulnerability in redirurl.php in w-Agora 4.1.6a allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2004-1565

list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id parameter...

CVE-2004-1565

CVE-2004-1565 affects w-Agora 4.1.6a: list.php exposes the full server path via a crafted HTTP request to an id parameter (path disclosure). The connected Nessus entry notes multiple input validation issues in the remote software, including SQL injection and XSS vectors, but does not provide a pa...

CVE-2004-1563

CVE-2004-1563 concerns multiple XSS flaws in w-Agora 4.1.6a. The affected component is the web-based forum software (PHP) and the vulnerable vectors are: (1) thread parameter in download_thread.php, (2) loginuser parameter in login.php, and (3) userid parameter in forgot_password.php. The underly...

CVE-2004-1564

The CVE-2004-1564 entry concerns w-Agora 4.1.6a, where CRLF injection in subscribe_thread.php allows HTTP Response Splitting to alter server‑generated HTML content via the thread parameter. The vulnerability is caused by improper handling of input that can introduce CRLF sequences in HTTP headers...

CVE-2004-1562: Undefined Security Weakness

SQL injection vulnerability in redirurl.php in w-Agora 4.1.6a allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2004-1564: Undefined Security Weakness

CRLF injection vulnerability in subscribethread.php in w-Agora 4.1.6a allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the thread parameter...

CVE-2004-1565: Undefined Security Weakness

list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id parameter...

CVE-2004-1563: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in w-Agora 4.1.6a allow remote attackers to execute arbitrary web script or HTML via the 1 thread parameter to downloadthread.php, 2 loginuser parameter to login.php, or 3 userid parameter to forgotpassword.php...

CVE-2004-1562

SQL injection vulnerability in redirurl.php in w-Agora 4.1.6a allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2004-1564

CRLF injection vulnerability in subscribethread.php in w-Agora 4.1.6a allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the thread parameter...

CVE-2004-1565

list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id parameter...

CVE-2004-1563

Multiple cross-site scripting XSS vulnerabilities in w-Agora 4.1.6a allow remote attackers to execute arbitrary web script or HTML via the 1 thread parameter to downloadthread.php, 2 loginuser parameter to login.php, or 3 userid parameter to forgotpassword.php...

w-agora.txt

http://www.maxpatrol.com/mpadvisory.asp Title: Multiple vulnerabilities in w-agora forum Date: 28.09.04 Severity: Medium Application: w-agora 4.1.6a, http://www.w-agora/en/download.php Platform: PHP I. DESCRIPTION Multiple vulnerabilities were found in w-agora forum. A remote user can conduct SQL...

w-Agora 4.1.6a Multiple Input Validation Vulnerabilities

The remote host is running w-agora, a web-based forum management software written in PHP. There are multiple input validation flaws in the remote version of this software : - There is a SQL injection vulnerability in the file 'redirurl.php' that could allow an attacker to execute arbitrary SQL...