[MajorSecurity Advisory #52]ActualAnalyzer family - Cross Site Scripting Issues

MajorSecurity Advisory 52ActualAnalyzer family - Cross Site Scripting Issues Details ======= Product: Actual Analyzer Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.actualscripts.com Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David...

Directory traversal

Directory traversal vulnerability in admin.php in ActualScripts ActualAnalyzer Lite 2.78 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the style parameter...

CVE-2008-2076

The CVE-2008-2076 entry concerns ActualAnalyzer Lite 2.78 from ActualScripts. Affected component: admin.php; vulnerability type: Local File Inclusion via the style parameter. Root cause: inadequate sanitization allows a “..” path traversal to include arbitrary local PHP files, enabling remote att...

ActualAnalyzer Lite (free) 2.78 Local File Inclusion Vulnerability

No description provided by source. ActualAnalyzer Lite free 2.78 LOCAL FILE INCLUSION AUTHOR : IRCRASH Dr.Crash Or Khashayar Fereidani Discovered by : IRCRASH Dr.Crash Or Khashayar Fereidani Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi -...

ActualAnalyzer Lite style Parameter Traversal Local File Inclusion

The remote host is running ActualAnalyzer, a PHP-based tool for monitoring website traffic. The version of ActualAnalyzer installed on the remote host fails to sanitize user-supplied input to the 'style' parameter of the 'admin.php' script before using it to include PHP code. Regardless of PHP's...

aal-lfi.txt

ActualAnalyzer Lite free 2.78 LOCAL FILE INCLUSION AUTHOR : IRCRASH Dr.Crash Or Khashayar Fereidani Discovered by : IRCRASH Dr.Crash Or Khashayar Fereidani Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr Scrip...

ActualAnalyzer Lite (free) 2.78 - Local File Inclusion

ActualAnalyzer Lite free 2.78 LOCAL FILE INCLUSION AUTHOR : IRCRASH Dr.Crash Or Khashayar Fereidani Discovered by : IRCRASH Dr.Crash Or Khashayar Fereidani Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr Scrip...

ActualAnalyzer Lite (free) 2.78 Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================== ActualAnalyzer Lite free 2.78 Local File Inclusion Vulnerability ================================================================== ActualAnalyzer Lite free 2.78 LOCAL FILE...

ActualAnalyzer Lite (free) 2.78 - Local File Inclusion

ActualAnalyzer Lite free 2.78 - Local File Inclusion ActualAnalyzer Lite free 2.78 LOCAL FILE INCLUSION AUTHOR : IRCRASH Dr.Crash Or Khashayar Fereidani Discovered by : IRCRASH Dr.Crash Or Khashayar Fereidani Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani -...

ActualAnalyzer Server <=8.23 - Remote File Include Vulnerability

----------------------------------------------------------------- Vendor: ActualScripts URL: http://actualscripts.com ----------------------------------------------------------------- Credits: Discovered by: 'Aesthetico' http://www.majorsecurity.de...

ActualAnalyzer688.txt

======================================================================================= XOR Crew :: Security Advisory 4/10/2006 ======================================================================================= ActualAnalyzer Pro v6.88 - Remote Command Execution Vulnerability...

[Full-disclosure] [XPA] ActualAnalyzer Pro v6.88 - Remote Command Execution Vulnerability

======================================================================================= XOR Crew :: Security Advisory 4/10/2006 ======================================================================================= ActualAnalyzer Pro v6.88 - Remote Command Execution Vulnerability...

ActualAnalyzer Pro <= 6.88 (rf) Remote File Include Exploit

Exploit for unknown platform in category web applications =========================================================== ActualAnalyzer Pro " ."turl:" ."hurl:" ."cmd:" ."" .""; if !isset$POST'submit' echo $form; else $file = fopen "test.txt", "w+"; fwrite$file, ""; fclose$file; $file = fopen...

ActualAnalyzer Pro 6.88 - rf Remote File Inclusion

ActualAnalyzer Pro 6.88 - rf Remote File Inclusion " ."turl:" ."hurl:" ."cmd:" ."" .""; if !isset$POST'submit' echo $form; else $file = fopen "test.txt", "w+"; fwrite$file, ""; fclose$file; $file = fopen $turl.$hurl, "r"; if !$file echo "Unable to get output.\n"; exit; echo $form; while !feof $fi...

ActualAnalyzer Server 8.23 - 'rf' Remote File Inclusion

Title: ActualAnalyzer Server =8.23 - Remote File Include Vulnerability ----------------------------------------------------------------- Vendor: ActualScripts URL: http://actualscripts.com ----------------------------------------------------------------- Credits: Discovered by: 'Aesthetico'...

ActualAnalyzer Pro &lt;= 6.88 (rf) Remote File Include Exploit

No description provided by source. ?php // No hard feelings ReZEN, I just post them when I get them. /str0ke / ActualAnalyzer Remote File Inclusion Exploit c0ded by ReZEN Sh0uts: xorcrew.net, ajax, gml, subterrain, D2K url: http://www.xorcrew.net/ReZEN example: turl: http://www.target.com/path to...

ActualAnalyzer Server &lt;= 8.23 (rf) Remote File Include Vulnerability

No description provided by source. Title: ActualAnalyzer Server =8.23 - Remote File Include Vulnerability ----------------------------------------------------------------- Vendor: ActualScripts URL: http://actualscripts.com ----------------------------------------------------------------- Credits...

ActualAnalyzer Server <= 8.23 (rf) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ==================================================================== ActualAnalyzer Server = 8.23 rf Remote File Include Vulnerability ==================================================================== Title: ActualAnalyzer Server =8.23 ...

ActualAnalyzer Server 8.23 - rf Remote File Inclusion

ActualAnalyzer Server 8.23 - rf Remote File Inclusion Title: ActualAnalyzer Server =8.23 - Remote File Include Vulnerability ----------------------------------------------------------------- Vendor: ActualScripts URL: http://actualscripts.com...

ActualAnalyzer Pro 6.88 - 'rf' Remote File Inclusion

" ."turl:" ."hurl:" ."cmd:" ."" .""; if !isset$POST'submit' echo $form; else $file = fopen "test.txt", "w+"; fwrite$file, ""; fclose$file; $file = fopen $turl.$hurl, "r"; if !$file echo "Unable to get output.\n"; exit; echo $form; while !feof $file $line .= fgets $file, 1024.""; $tpos1 =...