Jax Petition Book (languagepack) Remote File Include Vulnerabilities

------------------------------------------------------------------------------------------------------------------ AYYILDIZ.ORG PreSents... Script: Jax Petition Book Download: jtr.de/scripting/php/guestbook/petitionbook20v1.0.3.06.zip Contact: ilker Kandemir ilkerkandemiratmynet.com...

jax-rfi.txt

------------------------------------------------------------------------------------------------------------------ AYYILDIZ.ORG PreSents... Script: Jax Petition Book Download: jtr.de/scripting/php/guestbook/petitionbook%20v1.0.3.06.zip Contact: ilker Kandemir...

CVE-2006-6882

Cross-site scripting XSS vulnerability in golden book allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-6882

Technical details for CVE-2006-6882 are not publicly available in the provided documents. No affected products, versions, or remediation are disclosed here. Monitor for updates from official advisories.

CVE-2006-6882: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in golden book allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-4575

Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the 1 lastname, 2 firstname, 3 passwordOld, 4 passwordNew, 5 id, 6 language, 7 defaultLetter, 8 newuserPass, 9 newuserType, 10 newuserEmail parameters in a user.php; the 1...

CVE-2006-4576

Cross-site scripting XSS vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer...

CVE-2006-4578

export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information...

CVE-2006-4579

Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a .. dot dot in the language parameter...

CVE-2006-4581

Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts...

CVE-2006-4582

Cross-site request forgery CSRF vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

CVE-2006-4575

The CVE-2006-4575 entry describes multiple SQL injection vulnerabilities in The Address Book 1.04e. Affected components include user.php (parameters: lastname, firstname, passwordOld, passwordNew, id, language, defaultLetter, newuserPass, newuserType, newuserEmail), search.php (parameters: goTo, ...

CVE-2006-4578

The Address Book 1.04e is affected by CVE-2006-4578 via export.php, which dumps MySQL contents and writes username and password hash information to a publicly accessible file. Root cause is the dump exposing credentials in publicly accessible storage, enabling remote attackers to obtain sensitive...

CVE-2006-4579

CVE-2006-4579 describes a directory traversal vulnerability in The Address Book 1.04e, where the language parameter can be manipulated with ".." to include arbitrary files. The issue arises in users.php and could allow remote attackers to cause file inclusion, with the documented impact: partial ...

CVE-2006-4580

The CVE concerns The Address Book 1.04e: register.php allows remote attackers to bypass the 'Allow User Self-Registration' setting by supplying mode=confirm, enabling creation of arbitrary users. This is a client-side/configuration abuse affecting user provisioning, with the root cause described ...

CVE-2006-4581

The CVE-2006-4581 entry concerns The Address Book 1.04e, with an unrestricted file upload vulnerability. The issue arises because the product validates the Content-Type header but does not validate the file extension, enabling remote attackers to upload arbitrary PHP scripts. The impact described...

CVE-2006-4582

The CVE-2006-4582 entry describes a Cross-site request forgery (CSRF) vulnerability affecting The Address Book 1.04e. The issue allows remote attackers to perform unauthorized actions as other users, demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

CVE-2006-4577

CVE-2006-4577 affects The Address Book 1.04e. It contains multiple cross-site scripting (XSS) vulnerabilities allowing an attacker to inject arbitrary scripts via: (1) email, (2) websites, (3) groupAddName in save.php; (4) errorMsg in index.php; (5) goTo and (6) search in search.php. CVSS v2 base...

CVE-2006-4576

The vulnerability CVE-2006-4576 is an XSS in The Address Book 1.04e where remote attackers can inject arbitrary web script by uploading an HTML file with a GIF/JPG extension, which is then rendered by Internet Explorer. The provided connected documents confirm the affected product/version and the...

CVE-2006-4577: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the 1 email, 2 websites, and 3 groupAddName parameters in a save.php; the 4 errorMsg parameter in b index.php; and the 5 goTo and 6...