CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

Directory traversal

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

CVE-2020-35709

BloofoxCMS 0.5.2.1 is vulnerable to a directory traversal issue: admins can upload arbitrary .php files to ../media/images/ via admin/index.php?mode=tools&page=upload when uploading with Content-Type: application/octet-stream. This leads to uploading PHP payloads on the server; exact exploitation...

PT-2020-17398

Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue allows admins to upload arbitrary .php files to ../media/images/ via the "admin/index.php?mode=tools&page=upload" URI, which is a directory traversal issue. This is achieved by using a...

CVE-2020-35709: Improper Limitation of a Pathname to a Restricted Directory

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

File Upload Vulnerability in bloofoxCMS v0.5.1

bloofoxCMS is an open source, easy to use small content management system. A file upload vulnerability exists in bloofoxCMS v0.5.1. An attacker can exploit this vulnerability to upload a malicious php file in the user's avatar upload area to gain control of the web server...

bloofoxCMS 0.5.0 Cross Site Scripting

Affected software: bloofox cms Type of vulnerability:xss URL:bloofox.com Discovered by: provensec Website: provensec.com version: 0.5.0 Proof of concept http://demo.bloofox.com/admin/index.php?mode=content&page=media&action=edit&file=%22%3E%3Cimg%20src=d%20onerror=confirm1;%3E&type=1%27...

BloofoxCMS 0.2.2 Img_Popup.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/23487/info BloofoxCMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

bloofoxCMS 0.3 Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/27361/info bloofoxCMS is prone to a directory-traversal vulnerability, a SQL-injection vulnerability, and an authentication-bypass vulnerability. The SQL-injection vulnerability occurs because the application fails to...

BloofoxCMS Registration Plugin SQL Injection Vulnerability

No description provided by source. Vulnerability ID: HTB22658 Reference: http://www.htbridge.ch/advisory/sqlinjectioninbloofoxcmsregistrationplugin.html Product: BloofoxCMS Vendor: bloofox.com http://bloofox.com/ Vulnerable Version: 0.3.5 and probably prior versions Vendor Notification: 13 Octobe...

bloofoxCMS 0.3.5 'search' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/36700/info bloofoxCMS is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input passed through the 'search' parameter. An attacker may leverage this issue ...

BloofoxCMS 0.3.5 - Information Disclosure Vulnerabilities

No description provided by source. Vulnerability ID: HTB22660 Reference: http://www.htbridge.ch/advisory/informationdisclosureinbloofoxcms1.html Product: BloofoxCMS Vendor: bloofox.com http://bloofox.com/ Vulnerable Version: 0.3.5 and probably prior versions Vendor Notification: 13 October 2010...

bloofoxCMS "fileurl"跨站脚本和跨站请求伪造漏洞

bloofox CMS是一款内容管理系统。 1由于通过"fileurl"参数传递到admin/index.php的输入当"mode"设置为"settings"，"page"设置为"editor"在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 2应用程序允许用户通过未验证的HTTP请求执行某些操作，攻击者可以欺骗用户登录访问特制网页并添加新的项目。 0 bloofoxCMS 0.5 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.bloofox.com...

bloofoxCMS多个安全漏洞

Bugtraq ID:65019 bloofox CMS是一款内容管理系统。 bloofox CMS不正确过滤用户提交的输入，允许远程攻击者利用漏洞进行SQL注入，文件包含，跨站请求伪造攻击。 0 bloofox CMS 0.5.0 目前没有详细解决方案提供： http://www.bloofox.com/download.21.html EXPLOIT http://localhost/admin/index.php?mode=settings&page=editor&fileurl=config.php !/usr/bin/perl Title : bloofoxCMS V0.5.0...

bloofoxCMS 0.5.0 CSRF / LFI / SQL Injection

bloofoxCMS V0.5.0 - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.bloofox.com/download.21.html 1...

bloofoxCMS 0.5.0 CSRF / PHP Code Injection

!/usr/bin/perl Title : bloofoxCMS V0.5.0 - Csrf inject php code Author : AtT4CKxT3rR0r1ST Contact : [email protected] , [email protected] Home : http://www.iphobos.com/blog/ Script : http://www.bloofox.com/download.21.html Version : 0.5.0 Dork : "Powered by bloofoxCMS" Vulnerability In Languag...

BloofoxCMS - adminindex.php Cross-Site Request Forgery (Add Admin)

BloofoxCMS - adminindex.php Cross-Site Request Forgery Add Admin source: https://www.securityfocus.com/bid/65019/info bloofoxCMS is prone to the following security vulnerabilities: 1. Multiple SQL-injection vulnerabilities 2. Multiple cross-site request forgery vulnerabilities 3. A local...