CVE-2008-5214: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in service/calendrier.php in ClanLite 2.2006.05.20 allows remote attackers to inject arbitrary web script or HTML via the annee parameter...

CVE-2008-1798

The CVE-2008-1798 issue affects Dragoon 0.1, specifically the calendrier.php routine in forum/kietu/libs. An attacker can craft a value for cal[lng] containing a .. sequence to trigger directory traversal, enabling the inclusion and execution of arbitrary local files. This is a server-side file i...

CVE-2008-1798: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in forum/kietu/libs/calendrier.php in Dragoon 0.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the callng parameter...

dragoon-lfi.txt

Script Name :Dragoon CMS Download : http://sourceforge.net/project/showfiles.php?groupid=118780 Error : $cal'lng'=$GET'lng'; include'../lang/'.$cal'lng'.'.php'; Vul Code : http://site/path/forum/kietu/libs/calendrier.php?callng=LFI...

Dragoon 0.1 - lng Local File Inclusion

Dragoon 0.1 - lng Local File Inclusion Script Name :Dragoon CMS Download : http://sourceforge.net/project/showfiles.php?groupid=118780 Error : $cal'lng'=$GET'lng'; include'../lang/'.$cal'lng'.'.php'; Vul Code : http://site/path/forum/kietu/libs/calendrier.php?callng=LFI milw0rm.com 2008-04-04...