CVE-2011-3705

Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files...

Information disclosure

Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files...

CVE-2011-3705

Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files...

CVE-2011-3705

CVE-2011-3705 affects Arctic Fox CMS 0.9.4. Affected component is PHP files (notably acp/includes/edit.inc.php and similar) where a direct request to a PHP file can cause an error message that reveals the installation path, enabling information disclosure. The abuse is a remote attack that does n...

Arctic Fox CMS 0.9.4 Information Disclosure

Vulnerability ID: HTB22833 Reference: http://www.htbridge.ch/advisory/informationdisclosureinarcticfoxcms.html Product: Arctic Fox CMS Vendor: Michael Armbruster http://sourceforge.net/projects/arcticfox/ Vulnerable Version: 0.9.4 and probably prior versions Vendor Notification: 01 February 2011...

HTB22833: Information Disclosure in Arctic Fox CMS

Vulnerability ID: HTB22833 Reference: http://www.htbridge.ch/advisory/informationdisclosureinarcticfoxcms.html Product: Arctic Fox CMS Vendor: Michael Armbruster http://sourceforge.net/projects/arcticfox/ Vulnerable Version: 0.9.4 and probably prior versions Vendor Notification: 01 February 2011...

Information Disclosure Vulnerability in Arctic Fox CMS

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in Arctic Fox CMS which could be exploited to disclose potentially sensitive information. 1 Information disclosure vulnerability in Arctic Fox CMS The vulnerability exists due to insufficient handling of error messages in th...

Sql injection

SQL injection vulnerability in index.php in Arctic Issue Tracker 2.1.1 allows remote attackers to execute arbitrary SQL commands via the 1 matchingsid or 2 matchingstitle parameters in a Login action to an unspecified program, or 3 the matchingsid parameter in a search action to index.php, a...

CVE-2009-4350

SQL injection vulnerability in index.php in Arctic Issue Tracker 2.1.1 allows remote attackers to execute arbitrary SQL commands via the 1 matchingsid or 2 matchingstitle parameters in a Login action to an unspecified program, or 3 the matchingsid parameter in a search action to index.php, a...

CVE-2009-4350

CVE-2009-4350 is a SQL injection vulnerability in Arctic Issue Tracker 2.1.1 (index.php). The issue allows remote attackers to inject arbitrary SQL via (1) matchings[id] or (2) matchings[title] in a Login action to an unspecified program, or (3) matchings[id] in a search action to index.php. This...

CVE-2009-4350

SQL injection vulnerability in index.php in Arctic Issue Tracker 2.1.1 allows remote attackers to execute arbitrary SQL commands via the 1 matchingsid or 2 matchingstitle parameters in a Login action to an unspecified program, or 3 the matchingsid parameter in a search action to index.php, a...

Arctic Issue Tracker Cross Site Scripting

/\ == \ /\ \ /\ \ \ \ alert/XSS/&matchings%5Btitle%[email protected] OR simple .. http://localhost/index.php?cmd=search and type at "ID:" XSS code .. ------------------------------------------------------------------------------------------ Demo :...

Unfixed XSS vulnerability at arctic-change2008.com

Security researcher Camilo-TcK, has submitted on 29/05/2009 a cross-site-scripting XSS vulnerability affecting arctic-change2008.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 18/07/2010. It is...

Sql injection

SQL injection vulnerability in index.php in Arctic Issue Tracker 2.0.0 allows remote attackers to execute arbitrary SQL commands via the filter parameter...

CVE-2008-3250

SQL injection vulnerability in index.php in Arctic Issue Tracker 2.0.0 allows remote attackers to execute arbitrary SQL commands via the filter parameter...

CVE-2008-3250

SQL injection vulnerability in index.php in Arctic Issue Tracker 2.0.0 allows remote attackers to execute arbitrary SQL commands via the filter parameter...

CVE-2008-3250

The CVE-2008-3250 entry describes a SQL injection in Arctic Issue Tracker 2.0.0, exploitable through the filter parameter in index.php to remotely execute arbitrary SQL commands. The NVD entry lists a CVSS v2 base score of 7.5 (HIGH). No specific patch/version details or exploits are provided in ...

Arctic Issue Tracker 2.0.0 (index.php filter) SQL Injection Exploit

Exploit for unknown platform in category web applications...

arctic-sql.txt

!/usr/bin/perl use IO::Socket; print q ----------------------------------------------- Arctic Issue Tracker v2.0.0 exploit by ldma SubCode use: arctic.pl server dir sample: $perl arctic.pl localhost /arctic/ ----------------------------------------------- ; $webpage = $ARGV0; $directory = $ARGV1;...

Arctic Issue Tracker 2.0.0 - 'filter' SQL Injection (2)

!/usr/bin/perl use IO::Socket; print q ----------------------------------------------- Arctic Issue Tracker v2.0.0 exploit by ldma SubCode use: arctic.pl server dir sample: $perl arctic.pl localhost /arctic/ ----------------------------------------------- ; $webpage = $ARGV0; $directory = $ARGV1;...