Improper access control

AR Web Content Manager AWCM 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for control/dbbackup.php...

CVE-2010-1066

AR Web Content Manager AWCM 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for control/dbbackup.php...

CVE-2010-1066

AWCM 2.1 stores sensitive data under the web root with insufficient access control, enabling remote attackers to download the database via a direct request to control/db_backup.php. Impact is database disclosure; no exploit details are provided in the connected documents. Remediation not specifie...

Directory traversal

Directory traversal vulnerability in a.php in AR Web Content Manager AWCM 2.1, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the a parameter...

Sql injection

SQL injection vulnerability in control/login.php in AR Web Content Manager AWCM 2.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2009-3218

SQL injection vulnerability in control/login.php in AR Web Content Manager AWCM 2.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2009-3219

Directory traversal vulnerability in a.php in AR Web Content Manager AWCM 2.1, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the a parameter...

CVE-2009-3218

Summary: CVE-2009-3218 describes an SQL injection in AR Web Content Manager (AWCM) 2.1, exploitable when magic_quotes_gpc is disabled, via the username parameter in control/login.php. Affected software: AR Web Content Manager (AWCM) 2.1. The vulnerability originates from improper handling of user...