Simple PHP Blog install05.php blog_language Parameter Local File Inclusion

The version of Simple PHP Blog installed on the remote host fails to sanitize input to the 'bloglanguage' parameter of the 'install05.php' script before using it in a PHP 'requireonce' function. An unauthenticated attacker may be able to exploit this issue to view arbitrary files or to execute...

CVE-2006-1243: Undefined Security Weakness

Directory traversal vulnerability in install05.php in Simple PHP Blog SPB 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the bloglanguage parameter, as demonstrated by injecting PHP sequences in...