188 matches found
CVE-2008-5880: Improper Authentication
admin/auth.php in Gobbl CMS 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "ok"...
Gobbl CMS 1.0 Insecure Cookie Handling
--------------------------- Gobbl Cms 1.0 I.Cookie Hand. --------------------------- Autore: x0r Evolution Team Email: [email protected] Demo Site:http://www.gobbl.net/ --------------------------- Bug In: \admin\auth.php ? include '../config.php'; $user = $POST'user'; $pass = $POST'pass'; if...
phpEmployment (php upload) Arbitrary File Upload Vulnerability
Exploit for unknown platform in category web applications ============================================================== phpEmployment php upload Arbitrary File Upload Vulnerability ============================================================== remote shell upload script: phpEmployment download...
Gobbl CMS 1.0 Insecure Cookie Handling Vulnerability
No description provided by source. --------------------------- Gobbl Cms 1.0 I.Cookie Hand. --------------------------- Autore: x0r Evolution Team Email: [email protected] Demo Site:http://www.gobbl.net/ --------------------------- Bug In: \admin\auth.php ? include '../config.php'; $user =...
Gobbl CMS 1.0 Insecure Cookie Handling Vulnerability
Exploit for unknown platform in category web applications ==================================================== Gobbl CMS 1.0 Insecure Cookie Handling Vulnerability ==================================================== --------------------------- Gobbl Cms 1.0 I.Cookie Hand...
Gobbl CMS 1.0 - Insecure Cookie Handling
--------------------------- Gobbl Cms 1.0 I.Cookie Hand. --------------------------- Autore: x0r Evolution Team Email: [email protected] Demo Site:http://www.gobbl.net/ --------------------------- Bug In: \admin\auth.php ? include '../config.php'; $user = $POST'user'; $pass = $POST'pass'; if...
Gobbl CMS 1.0 - Insecure Cookie Handling
Gobbl CMS 1.0 - Insecure Cookie Handling --------------------------- Gobbl Cms 1.0 I.Cookie Hand. --------------------------- Autore: x0r Evolution Team Email: [email protected] Demo Site:http://www.gobbl.net/ --------------------------- Bug In: \admin\auth.php ? include '../config.php'; $user...
CVE-2008-4162
Open redirect vulnerability in admin/auth.php in NooMS 1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the gsiteurl parameter...
CVE-2008-4162: Improper Link Resolution Before File Access
Open redirect vulnerability in admin/auth.php in NooMS 1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the gsiteurl parameter...
Unfixed XSS vulnerability at www.kondi.dk
Security researcher Pragmatk, has submitted on 31/08/2008 a cross-site-scripting XSS vulnerability affecting www.kondi.dk, which at the time of submission ranked 4584145 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/07/2009. It is currentl...
CVE-2007-5913
CVE-2007-5913 concerns dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier, where authentication is not required and remote attackers can (1) delete auth.inc.php via the suppr parameter and (2) re-create auth.inc.php to establish a new account/password using login and password parameters...
CVE-2007-5913: Improper Authentication
dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier does not require authentication, which allows remote attackers to 1 delete auth.inc.php via the suppr parameter, and 2 re-create the auth.inc.php file with contents that specify a new account name and password for JBC Explorer via the...
CVE-2003-1373: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in auth.php for PhpBB 1.4.0 through 1.4.4 allows remote attackers to read and include arbitrary files via .. dot dot sequences followed by NULL %00 characters in CGI parameters, as demonstrated using the lang parameter in prefs.php...
xcart-rfi.txt
xCart Remote file inclusion Download script : http://www.x-cart.com// Discovered By : aLiiF a.k.a arif @debuteam 07/09/2007 HomePage : http://www.debuteam.net// Thx to : Debu Newbie Payment Yogac nyubi Rozi ^S0ng0ku^ Kuris Sonix Toxicity newbi3 R4yn4ld0 DisJocKey s3ng0k homeedition Holong...
Design/Logic Flaw
The checklogout function in class/auth.php in Help Center Live hcl 2.1.3a sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to delete administrative users and have other unspecified impact via certain requests to 1...
CVE-2007-4240
Help Center Live (hcl) 2.1.3a contains an authentication bypass in the check_logout function of class/auth.php. When administrative credentials are missing, the function redirects but does not exit, enabling an unauthenticated attacker to trigger actions via requests to admin/departments.php, adm...
CVE-2007-4240: Undefined Security Weakness
The checklogout function in class/auth.php in Help Center Live hcl 2.1.3a sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to delete administrative users and have other unspecified impact via certain requests to 1...
CVE-2007-3627
Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...
CVE-2007-3627: Undefined Security Weakness
Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...