Advanced Poll : PHP Code Injection, File Include, Phpinfo

Informations : °°°°°°°°°°°°° Language : PHP Product : Advanced Poll Version : 2.0.2 Textfile Website : http://www.proxy2.de Problems : - PHP Code Injection - File Include - Phpinfo PHP Code/Location : °°°°°°°°°°°°°°°°°°° comments.php :...

CVE-2003-1181

Advanced Poll 2.0.2 allows remote attackers to obtain sensitive information via an HTTP request to info.php, which invokes the phpinfo function...

Advanced Poll info.php Remote Information Disclosure

The remote host is running Chien Kien Uong's Advanced Poll, a simple Poll system using PHP. By default, this utility includes a file named 'info.php' that makes a call to 'phpinfo' and displays a lot of information about the remote host and how PHP is configured. An attacker may use this flaw to...

Advanced Poll

Product : Advanced Poll Version : 2.02 WebSite : http://www.proxy2.de Problem : phpinfo Description: ------------ /polldir/db/misc/: info.php =========== ?php phpinfo; ? =========== /polldir/textfile/misc/: info.php =========== ?php phpinfo; ? =========== Exploits: --------...

Advanced Poll 2.0 - Remote Information Disclosure

Advanced Poll 2.0 - Remote Information Disclosure source: https://www.securityfocus.com/bid/7171/info It has been reported that an information disclosure vulnerability exists in Advanced Poll. Because of this, a remote user to potentially access privileged information that could lead to further...

Advanced Guestbook

Product : Advanced Guestbook Version : 2.3.1 WebSite : http://www.proxy2.de Problem : phpinfo Description: ------------ phpinfo.php =========== ?php phpinfo; ? =========== Exploit: -------- http://somehost/book/phpinfo.php...

Advanced Poll 2.0 - Remote Information Disclosure

source: https://www.securityfocus.com/bid/7171/info It has been reported that an information disclosure vulnerability exists in Advanced Poll. Because of this, a remote user to potentially access privileged information that could lead to further attack against the host and it's users...

CVE-2002-2138

RFC-NETBIOS in HP Advanced Server/9000 B.04.05 through B.04.09, when running HP-UX 11.00 or 11.11, allows remote attackers to cause a denial of service panic via a malformed UDP packet on port 139...

CVE-2002-1994

advserver.exe in Advanced Web Server AdvServer Professional 1.030000 allows remote attackers to cause a denial of service via multiple HTTP requests containing a single carriage return/line feed CRLF sequence...

CVE-2002-2396

Buffer overflow in Advanced TFTP atftp 0.5 and 0.6, if installed setuid or setgid, may allow local users to execute arbitrary code via a long argument to the -g option...

SPGPartenaires 3.0.1 - ident.php SQL Injection

SPGPartenaires 3.0.1 - ident.php SQL Injection source: https://www.securityfocus.com/bid/6455/info Several vulnerabilities have been discovered in SPGPartenaires. The vulnerabilities are due to insufficient sanitization of the 'pass' and 'SPGP' variables used to construct SQL queries in various P...

SPGPartenaires 3.0.1 - delete.php SQL Injection

SPGPartenaires 3.0.1 - delete.php SQL Injection source: https://www.securityfocus.com/bid/6455/info Several vulnerabilities have been discovered in SPGPartenaires. The vulnerabilities are due to insufficient sanitization of the 'pass' and 'SPGP' variables used to construct SQL queries in various...

Code Injection in phpBB Advanced Quick Reply Mod

Software: phpBB Advanced Quick Reply Mod I've found a security hole in this sofware Code Injection. You can download this software at http://phpbbhacks.com/viewhack.php?id=586 Hackers can exploit this Mod to inject some shell code to hack your forum, your website or your server local exploit...

Important: Red Hat Security Advisory: ypserv security update

Updated ypserv packages which fix a memory leak are now available for Red Hat Linux Advanced Server. Updated 08 Jan 2003 Added fixed packages for the Itanium IA64 architecture. Updated 06 Feb 2003 Added fixed packages for Advanced Workstation 2.1 ypserv is an NIS authentication server. ypserv...

CVE-2002-0923

CVE-2002-0923 affects CGIScript.net csNews.cgi. Multiple OpenVAS/Nessus/NVD records indicate that some csNews.cgi deployments are vulnerable to remote access via the Advanced Settings parameters (pheader, pfooter), enabling reading of arbitrary files and potentially elevating privileges. The vuln...

Important: Red Hat Security Advisory: mailman security update

Updated mailman packages are now available for Red Hat Linux Advanced Server. These updates resolve a cross-site scripting vulnerability present in versions of Mailman prior to 2.0.11. Two cross-site scripting vulnerabilities have been discovered in versions of Mailman prior to version 2.0.11...

CGIscript.net - csNews.cgi - Multiple Vulnerabilities

CGIscript.net - csNews.cgi - Multiple Vulnerabilities --------------------------------------------------------------------- Date : June 11, 2002 Product : csNews.cgi csNews standard csNews.cgi csNews Pro Vendor : WWW.CGIscript.NET, LLC. Homepage : http://www.cgiscript.net/ DISCUSSION:...

CVE-1999-1044

Vulnerability in Advanced File System Utility advfs in Digital UNIX 4.0 through 4.0d allows local users to gain privileges...

CVE-2001-1514

ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to 1 child processes created with and 2 child processes that call the CreateProcess function and are executed with or end with the CFX extension...

Advanced Poll does not adequately authenticate users

Overview Advanced Poll is a polling system written in PHP for use on web sites. When a flat file database is used, Advanced Poll does not adequately authenticate users, thereby allowing any user to gain Advanced Poll administrative privileges. Description On versions of Advanced Poll older than...