Code injection

uploadhandler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a writepost action to the...

CVE-2011-2745

The CVE-2011-2745 issue affects the swfupload extension used by Chyrp 2.0 and earlier. It arises because upload_handler.php relies on client-side JavaScript to restrict allowed file extensions, enabling remote authenticated users to upload a .php file and subsequently execute arbitrary PHP code v...

CVE-2011-2745

uploadhandler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a writepost action to the...

Directory traversal

Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, a different vulnerability than CVE-2011-2744...

CVE-2011-2743

Multiple cross-site scripting XSS vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to 1 the default URI or 2 includes/javascript.php, or the 3 title or 4 body parameter to admin/help.php...

CVE-2011-2780

Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, a different vulnerability than CVE-2011-2744...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to 1 the default URI or 2 includes/javascript.php, or the 3 title or 4 body parameter to admin/help.php...

CVE-2011-2743

CVE-2011-2743 corresponds to XSS vulnerabilities in Chyrp <= 2.1.1. The issues affect the admin/help.php (title/body) and the default URI or includes/javascript.php via the action parameter, allowing remote script/HTML injection. Root cause is improper input handling in these parameters. Impac...

CVE-2011-2743

Multiple cross-site scripting XSS vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to 1 the default URI or 2 includes/javascript.php, or the 3 title or 4 body parameter to admin/help.php...

CVE-2011-2780

CVE-2011-2780 is a directory traversal in Chyrp 2.x (2.0 and earlier) targeting includes/lib/gz.php. The exploitable vector is a crafted value in the file parameter (../) to read arbitrary files. The connected Nuclei template confirms the existence of a local file inclusion vulnerability and note...

CVE-2011-2744

Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the action parameter to the default URI...

Directory traversal

Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the action parameter to the default URI...

CVE-2011-2744

Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the action parameter to the default URI...

CVE-2011-2744

CVE-2011-2744 is a directory traversal vulnerability in Chyrp 2.1 and earlier. The flaw allows remote attackers to include and execute local files via a encoded ../ in the action parameter to the default URI. The NVD entry lists a CVSS v2 base score of 6.8 (MEDIUM) with network access, requiring ...

EUVD-2011-2719

Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the action parameter to the default URI...

Chyrp < 2.1.1 Multiple Vulnerabilities

Chyrp is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[oCERT-2011-001] Chyrp input sanitization errors

2011-001 Chyrp input sanitization errors Description: The Chyrp framework, an open source blogging engine, suffers from cross-site scripting XSS and local file inclusion LFI vulnerabilities. Insufficient input sanitization on the parameters passed to pages related to administration settings, the...

Open Source CERT Security Advisory 2011.001

File 1: oCERT-2011-001 File 2: JAHx113.txt ================================================== 2011-001 Chyrp input sanitization errors Description: The Chyrp framework, an open source blogging engine, suffers from cross-site scripting XSS and local file inclusion LFI vulnerabilities. Insufficient...

Chyrp 2.x - includesJavaScript.php?action Cross-Site Scripting

Chyrp 2.x - includesJavaScript.php?action Cross-Site Scripting source: https://www.securityfocus.com/bid/48672/info Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability...

Chyrp 2.x - '/admin/help.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/48672/info Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability. An attacker may leverage these issues to execute arbitrary...