CVE-2006-4674

Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php...

CVE-2006-4023

CVE-2006-4023 : The issue concerns the ip2long function in PHP 5.1.4 and earlier, which may incorrectly validate an arbitrary string and return a valid network IP address. This can enable remote attackers to obtain network information and facilitate other attacks, as demonstrated via SQL injectio...

Governs the granting of leave true when True also false-the“real”IP security risks-vulnerability warning-the black bar safety net

Let us look at the ASP code first: Function getIP Dim strIPAddr as string If Request. ServerVariables"HTTPXFORWARDEDFOR" = "" OR InStrRequest. ServerVariables"HTTPXFORWARDEDFOR", "unknown" 0 Then strIPAddr = Request. ServerVariables"REMOTEADDR" ElseIf InStrRequest...

Governs the granting of leave true when True also false—the“real”IP brings security risks-vulnerability warning-the black bar safety net

Author: lake2, http://lake2.0x54.org Let us look at the ASP code first: | Function getIP Dim strIPAddr as string If Request. ServerVariables"HTTPXFORWARDEDFOR" = "" OR InStrRequest. ServerVariables"HTTPXFORWARDEDFOR", "unknown" 0 Then strIPAddr = Request. ServerVariables"REMOTEADDR" ElseIf...

SMF 1.0.7 and lower plus 1.1rc2 and lower - IP spoofing vulnerability/IP ban evasion vulnerability

====================================================================== Advisory : SMF 1.0.7 and lower plus 1.1rc2 and lower - IP spoofing vulnerability/IP ban evasion vulnerability Release Date : June 02, 2006 Application : SMF Version : SMF 1.0.7 and previous versions, SMF1.1rc2 and lower Platfo...

phpMyChat 0.15.0dev - SYS enter Remote Code Execution

phpMyChat 0.15.0dev - SYS enter Remote Code Execution !/usr/bin/php -q -d shortopentag=on works with magicquotesgpc=Off\r\n\r\n"; echo "dork: intext:"2000-2001 The phpHeaven Team" -sourceforge\r\n\r\n"; if $argc4 echo "Usage: php ".$argv0." host path cmd OPTIONS\r\n"; echo "host: target server...

Design/Logic Flaw

Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For XFORWARDEDFOR HTTP header, which is checked by Gallery before other more reliable sources of IP address information, such as REMOTEADDR...

CVE-2006-1126

Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For XFORWARDEDFOR HTTP header, which is checked by Gallery before other more reliable sources of IP address information, such as REMOTEADDR...

CVE-2006-1126

Gallery 2 up to 2.0.2 has an IP-spoofing flaw where a remote attacker can spoof X-Forwarded-For, which is trusted over REMOTE_ADDR. Affected: Gallery 2.x prior to 2.0.3. Root cause: server uses X_FORWARDED_FOR in IP checks. Impact: potential partial confidentiality/integrity exposure; possible fo...

CVE-2006-1127

CVE-2006-1127 describes a cross-site scripting (XSS) vulnerability in Gallery 2 up to 2.0.2. A remote attacker can inject arbitrary script/HTML through the X-Forwarded-For header when adding a comment to an album. Reported sources (e.g., Exploit-DB/Nessus entries) corroborate multiple Gallery 2 v...

EV0086.txt

New eVuln Advisory: Simple Machines Forum - SMF 'X-Forwarded-For' XSS Vulnerability http://evuln.com/vulns/86/summary.html --------------------Summary---------------- eVuln ID: EV0086 CVE: CVE-2006-0896 Software: Simple Machines Forum - SMF Sowtware's Web Site: http://www.simplemachines.org/...

[eVuln] Simple Machines Forum - SMF 'X-Forwarded-For' XSS Vulnerability

New eVuln Advisory: Simple Machines Forum - SMF 'X-Forwarded-For' XSS Vulnerability http://evuln.com/vulns/86/summary.html --------------------Summary---------------- eVuln ID: EV0086 CVE: CVE-2006-0896 Software: Simple Machines Forum - SMF Sowtware's Web Site: http://www.simplemachines.org/...

CVE-2006-0896

Cross-site scripting XSS vulnerability in Sources/Register.php in Simple Machine Forum SMF 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For HTTP header field...

Code injection

Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For HTTP header field, which is inserted into content-data.php...

CVE-2006-0852

Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For HTTP header field, which is inserted into content-data.php...

[SA18930] Admbook "X-Forwarded-For" PHP Code Injection

TITLE: Admbook "X-Forwarded-For" PHP Code Injection SECUNIA ADVISORY ID: SA18930 VERIFY ADVISORY: http://secunia.com/advisories/18930/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: Admbook 1.x http://secunia.com/product/8159/ DESCRIPTION: rgod has reported a...

Admbook 1.2.2 - x-forwarded-for Remote Command Execution

Admbook 1.2.2 - x-forwarded-for Remote Command Execution !/usr/bin/perl -w use IO::Socket; print "\r\n"; print "| Admbook autisticiorg |\r\n"; print "| site: http://retrogod.altervista.org |\r\n"; print "| |\r\n"; print "| Sun-Tzu: "Rouse him, and learn the principle of his activity or |\r\n";...

Admbook <= 1.2.2 (X-Forwarded-For) Remote Command Execution Exploit

Exploit for unknown platform in category web applications =================================================================== Admbook autisticiorg |\r\n"; print "| |\r\n"; print "| Sun-Tzu: "Rouse him, and learn the principle of his activity or |\r\n"; print "| inactivity. Force him to reveal...

Admbook &lt;= 1.2.2 (X-Forwarded-For) Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl -w use IO::Socket; print "\r\n"; print "| Admbook =1.2.2 X-Forwarded-For cmmnds xctn xploit |\r\n"; print "| By rgod rgodATautisticiDOTorg |\r\n"; print "| site: http://retrogod.altervista.org |\r\n"; print "| |\r\n"; print "| Sun-Tzu: "Rouse him,...

Admbook 1.2.2 - 'x-forwarded-for' Remote Command Execution

!/usr/bin/perl -w use IO::Socket; print "\r\n"; print "| Admbook autisticiorg |\r\n"; print "| site: http://retrogod.altervista.org |\r\n"; print "| |\r\n"; print "| Sun-Tzu: "Rouse him, and learn the principle of his activity or |\r\n"; print "| inactivity. Force him to reveal himself, so as to...