Sql injection

Multiple SQL injection vulnerabilities in the login function in system/classpermissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to admin/index.php...

CVE-2008-0428

Multiple SQL injection vulnerabilities in the login function in system/classpermissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to admin/index.php...

CVE-2008-0427

CVE-2008-0427 describes a directory traversal vulnerability in bloofoxCMS 0.3, where the file.php component permits remote attackers to read arbitrary files by supplying a .. payload in the file parameter. The issue, as documented, is a path traversal flaw in the web application (no further root-...

CVE-2008-0428

Multiple SQL injection vulnerabilities in the login function of bloofoxCMS 0.3 (system/class_permissions.php) allow remote attackers to inject arbitrary SQL via the username or password parameters to admin/index.php. Affects the login routine due to improper input sanitization; documented under C...

CVE-2008-0428: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the login function in system/classpermissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to admin/index.php...

CVE-2008-0427: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

BloofoxCMS 0.3 - Multiple Input Validation Vulnerabilities

BloofoxCMS 0.3 - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/27361/info bloofoxCMS is prone to a directory-traversal vulnerability, a SQL-injection vulnerability, and an authentication-bypass vulnerability. The SQL-injection vulnerability occurs because the...

BloofoxCMS 0.3 - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/27361/info bloofoxCMS is prone to a directory-traversal vulnerability, a SQL-injection vulnerability, and an authentication-bypass vulnerability. The SQL-injection vulnerability occurs because the application fails to sufficiently sanitize user-supplied...

CVE-2007-2310

Cross-site scripting XSS vulnerability in plugins/spaw/imgpopup.php in BloofoxCMS 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in plugins/spaw/imgpopup.php in BloofoxCMS 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter...

CVE-2007-2310

Cross-site scripting XSS vulnerability in plugins/spaw/imgpopup.php in BloofoxCMS 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter...

CVE-2007-2311

PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the contentphp parameter. NOTE: this issue has been disputed by a reliable third party, stating that contentphp is initialized before use...

CVE-2007-2311

CVE-2007-2311 describes a PHP remote file inclusion in BlooFoxCMS 0.2.2, specifically in install/index.php, allowing an attacker to execute arbitrary PHP code via a URL placed in the content_php parameter. The root cause is the handling of user-controlled content_php leading to code execution; th...

CVE-2007-2310

The CVE-2007-2310 entry concerns a Cross-site Scripting (XSS) vulnerability in BloofoxCMS 0.2.2, specifically in the plugins/spaw/img_popup.php component. The underlying issue is an input handling flaw in the img_url parameter that allows an attacker to inject arbitrary web script or HTML, enabli...

PT-2007-3644 · Bloofox · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BlooFoxCMS version 0.2.2 Description: The issue concerns a PHP remote file inclusion vulnerability in the install/index.php file of BlooFoxCMS. This vulnerability potentially allows remote attackers to execute arbitrary PHP code via a URL in...

CVE-2007-2311: Undefined Security Weakness

PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the contentphp parameter. NOTE: this issue has been disputed by a reliable third party, stating that contentphp is initialized before use...

CVE-2007-2310: Undefined Security Weakness

Cross-site scripting XSS vulnerability in plugins/spaw/imgpopup.php in BloofoxCMS 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter...

bloofox-rfi.txt

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...

bloofox-xss.txt

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...

bloofoxCMS 0.2.2 Remote File Include Vulnerabilitiy

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...