boastMachine v3.1 Version - Remote File Include Vulnerabilities

SaVSaK.CoM | SpC-x - The-BeKiR | boastMachine v3.1 Version - Remote File Include Vulnerabilities Risk : High Class: Remote Script : boastMachine Credits : SpC-x Thanks : The-BeKiR - Ejder - FasTBoY - ERNE - RMx - Nukedx - Str0ke Code : includeonce dirnameFILE."/config.php"; includeonce...

Boastmachine.txt

Advisory : Cross Site Scripting in Boastmachine http://boastology.com/ Release Date : 17/05/2005 Last Modified : 17/05/2005 Author : Yunus Emre Yilmaz http://yns.zaxaz.com Application : BoastMachine v3.1 maybe older versions Risk : High Problem : Form action values in admin.php and index.php mayb...

CVE-2006-2491

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

Cross site scripting

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

CVE-2006-2491

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

EUVD-2006-2491

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

CVE-2006-2491

BoastMachine (bMachine) 3.1 and earlier is affected by CVE-2006-2491, a cross-site scripting (XSS) flaw in index.php and bmc/admin.php. The vulnerability arises because user-supplied data in the query string is not properly filtered when accessed via $_SERVER["PHP_SELF"], enabling remote attacker...

BoastMachine 3.1 - admin.php Cross-Site Scripting

BoastMachine 3.1 - admin.php Cross-Site Scripting source: https://www.securityfocus.com/bid/18012/info BoastMachine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute...

BoastMachine 3.1 - 'admin.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18012/info BoastMachine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the...

CVE-2006-0131

boastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php and 2 sidemenu.php, which reveals the path in an error message...

Information disclosure

boastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php and 2 sidemenu.php, which reveals the path in an error message...

CVE-2006-0131

boastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php and 2 sidemenu.php, which reveals the path in an error message...

CVE-2006-0131

The provided documents describe a vulnerability in boastMachine 3.1 where remote attackers can disclose sensitive information by directly requesting footer.php and side_menu.php, revealing the path in an error message. Affected component: the web application’s error handling/output of these scrip...

[ECHO_ADV_25$2006] Full path disclosure on boastMachine v3.1

/ / | | / // / | | Y / | / / /| / / / / / / .OR.ID ECHOADV25$2006 --------------------------------------------------------------------------- ECHOADV25$2006 Full path disclosure on boastMachine v3.1 --------------------------------------------------------------------------- Author : M.Hasran...

CVE-2005-1580

users.ini.php in BoastMachine 3.0 does not properly restrict the types of files that can be uploaded, which allows remote attackers to execute arbitrary code...

CVE-2005-1580

BoastMachine 3.0 is affected by an arbitrary file upload via users.ini.php due to improper file type restriction, enabling remote code execution. Connected records also indicate a vulnerability class lasting into newer versions; remediation noted in Nessus: upgrade to BoastMachine 3.1 or later to...

[SA15312] BoastMachine File Upload Vulnerability

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: BoastMachine File Upload Vulnerability SECUNIA ADVISOR...

boastMachine users.inc.php File Extension Validation Arbitrary File Upload

The remote host is running boastMachine, an open source publishing tool written in PHP. According to its banner, the version of boastMachine installed on the remote host allows authenticated users to upload arbitrary files and then run them subject to the privileges of the web server user...

CVE-2005-1580

users.ini.php in BoastMachine 3.0 does not properly restrict the types of files that can be uploaded, which allows remote attackers to execute arbitrary code...

BoastMachine < 3.1 users.inc.php Arbitrary File Upload

Binary data 2897.prm...