9935 matches found
CVE-2006-2282: Undefined Security Weakness
Cross-site scripting XSS vulnerability in X7 Chat 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the URL of an avatar, possibly related to the avatar parameter in register.php...
x7chatphp.txt
!/usr/bin/php -q -d shortopentag=on works regardless of magicquotesgpc settings\r\n"; echo " if avatar uploads are enabled default\r\n"; echo "dork: intitle:"X7 Chat Help Center" | "Powered By X7 Chat"\r\n\r\n"; if $argc4 echo "Usage: php ".$argv0." host path cmd OPTIONS\r\n"; echo "host:...
Directory traversal
Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. dot dot sequences in the helpfile parameter...
CVE-2006-2156
Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. dot dot sequences in the helpfile parameter...
CVE-2006-2156
CVE-2006-2156: Directory traversal in X7 Chat (2.0 and earlier) allows remote inclusion of arbitrary files via .. sequences in the help_file parameter of help/index.php (unsanitized input used in include). Related entry CVE-2008-4718 describes a different vector in help/mini.php for 2.0.1 A1 and ...
CVE-2006-2156
Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. dot dot sequences in the helpfile parameter...
X7 Chat help/index.php help_file Parameter Local File Inclusion
The remote host is running X7 Chat, a web-based chat program written in PHP. The version of X7 Chat installed on the remote host fails to properly sanitize input to the 'helpfile' parameter of the 'help/index.php' script before using it in a PHP 'includeonce' function. Provided PHP's...
CVE-2006-2156: Undefined Security Weakness
Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. dot dot sequences in the helpfile parameter...
X7 Chat <= 2.0 (help_file) Remote Commands Execution Exploit
Exploit for unknown platform in category web applications ============================================================ X7 Chat works regardless of magicquotesgpc settings\r\n"; echo " if avatar uploads are enabled default\r\n"; echo "dork: intitle:"X7 Chat Help Center" | "Powered By X7...
X7 Chat <= 2.0 (help_file) Remote Commands Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "X7 Chat =2.0 "helpfile" arbitrary local inclusion\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n"; echo "- works regardless of magicquotesgpc settings\r\n"; echo " if avatar...
X7 Chat 2.0 - help_file Remote Command Execution
X7 Chat 2.0 - helpfile Remote Command Execution !/usr/bin/php -q -d shortopentag=on works regardless of magicquotesgpc settings\r\n"; echo " if avatar uploads are enabled default\r\n"; echo "dork: intitle:"X7 Chat Help Center" | "Powered By X7 Chat"\r\n\r\n"; if $argc4 echo "Usage: php...
X7 Chat 2.0 - 'help_file' Remote Command Execution
!/usr/bin/php -q -d shortopentag=on works regardless of magicquotesgpc settings\r\n"; echo " if avatar uploads are enabled default\r\n"; echo "dork: intitle:"X7 Chat Help Center" | "Powered By X7 Chat"\r\n\r\n"; if $argc4 echo "Usage: php ".$argv0." host path cmd OPTIONS\r\n"; echo "host:...
CVE-2006-2095: Undefined Security Weakness
Phex before 2.8.6 allows remote attackers to cause a denial of service application hang by initiating multiple chat requests to a single user and then logging off...
PCPINChat-5.0.4.txt
!/usr/bin/php -q -d shortopentag=on works with magicquotesgpc = Off\r\n"; echo "dork: "powered by PCPIN.com"\r\n\r\n"; if $argc "" OR login = "" or isnull1/0/ AND password = "somehash" AND activated = "1" LIMIT 1 ii arbitrary local inclusion: now you can upload smilies with php code inside, we...
CVE-2006-1963
Directory traversal vulnerability in main.php in PCPIN Chat 5.0.4 and earlier allows remote authenticated users to include and execute arbitrary PHP code via a ".." dot dot in a language cookie, as demonstrated by uploading then accessing a smiliefile image that actually contains PHP code...
CVE-2006-1962
SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field login parameter to main.php...
Sql injection
SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field login parameter to main.php...
Directory traversal
Directory traversal vulnerability in main.php in PCPIN Chat 5.0.4 and earlier allows remote authenticated users to include and execute arbitrary PHP code via a ".." dot dot in a language cookie, as demonstrated by uploading then accessing a smiliefile image that actually contains PHP code...
CVE-2006-1962
SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field login parameter to main.php...
CVE-2006-1962
CVE-2006-1962 affects PCPIN Chat 5.0.4 and earlier. The vulnerability is an SQL injection in the login path: user input in the username field (login parameter to main.php) can be manipulated to execute arbitrary SQL commands on the backend. This is exploitable remotely and can impact confidential...