1107 matches found
British Columbia Institute of Technology CodeIgniter HTTP Packet Header Injection Vulnerability
British Columbia Institute of Technology CodeIgniter is the British Columbia Institute of Technology British Columbia Institute of Technology for PHP web developers to use a set of application development framework and toolkit . An HTTP packet header injection vulnerability exists in the...
CodeIgniter: If the developer forgets to remove the built in controller welcome.php it helps the attacker to identify that the site is built with Codeigniter
The attacker can check the website's backend technology simply by typing sitename/index.php/welcome/index it will display the codeigniter welcome page if the developer dosen't removed the built in controller and view welcome.php and welcomemessage.php i attaching a screenshot below as a proof of...
codeigniter -- input validation bypass
The CodeIgniter changelog reports: Security: Fixed a potential object injection in Cache Library 'apc' driver when save is used with $raw = TRUE...
CVE-2014-8684
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes...
CVE-2014-8686
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...
Code injection
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...
Design/Logic Flaw
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes...
CVE-2014-8684
CVE-2014-8684 affects CodeIgniter before 3.0 and Kohana 3.2.3 and earlier, and 3.3.x through 3.3.2. The issue arises from using standard string comparison operators to compare cryptographic hashes, which enables remote attackers to spoof session cookies and conduct PHP object injection attacks. E...
CVE-2014-8686
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...
CVE-2014-8686
CodeIgniter vulnerability CVE-2014-8686 (CodeIgniter before 2.2.0) allows attackers to decode and manipulate the ci_session cookie by falling back to a custom XOR-based scheme when the PHP Mcrypt extension is unavailable. Public references describe exploitation via extracting the encryption key, ...
Arbitrary Code Execution
bcit-ci/codeigniter is vulnerable to arbitrary code execution. A flaw in system/libraries/Email.php allows attackers to leveraging control over the email - from field to insert sendmail command-line arguments...
FreeBSD : codeigniter -- input validation bypass (aaedf196-6436-11e7-8b49-002590263bf5)
The CodeIgniter changelog reports : Form Validation Library rule validemail could be bypassed if idntoascii is available. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-201...
codeigniter -- input validation bypass
The CodeIgniter changelog reports: Form Validation Library rule validemail could be bypassed if idntoascii is available...
CICMS V2.1 suffers from sql injection vulnerability
CICMS system is developed by php+mysql, based on CodeIgniter, and is mainly used for enterprise building. CICMS V2.1 suffers from a sql injection vulnerability. An attacker can exploit this vulnerability to obtain the server's password...
FreeBSD : codeigniter -- multiple vulnerabilities (df0144fb-295e-11e7-970f-002590263bf5)
The CodeIgniter changelog reports : Fixed a header injection vulnerability in common function setstatusheader under Apache thanks to Guillermo Caminer from Flowgate. Fixed byte-safety issues in Encrypt Library DEPRECATED when mbstring.funcoverload is enabled. Fixed byte-safety issues in Encryptio...
Seagate Business NAS - Unauthenticated Remote Command Execution Exploit
Exploit for linux platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class MetasploitModule 'Seagate Business NAS Unauthenticated Remote...
codeigniter -- multiple vulnerabilities
The CodeIgniter changelog reports: Fixed a header injection vulnerability in common function setstatusheader under Apache thanks to Guillermo Caminer from Flowgate. Fixed byte-safety issues in Encrypt Library DEPRECATED when mbstring.funcoverload is enabled. Fixed byte-safety issues in Encryption...
FreeBSD : codeigniter -- multiple vulnerabilities (71ebbc50-01c1-11e7-ae1b-002590263bf5)
The CodeIgniter changelog reports : Fixed an XSS vulnerability in Security Library method xssclean. Fixed a possible file inclusion vulnerability in Loader Library method vars. Fixed a possible remote code execution vulnerability in the Email Library when 'mail' or 'sendmail' are used thanks to...
Takas Classified Cogeigniter PHP Classified Ad Script 1.1 SQL Injection
Exploit Title: Takas Classified a Codeigniter PHP Classified Ad Script v1.1 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://artifectx.com/ Software Buy: https://codecanyon.net/item/takas-classified-codeigniter-php-classified-ad-script/15227824 Demo:...
Takas Classified 1.1 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Takas Classified – Codeigniter PHP Classified Ad Script v1.1 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://artifectx.com/ Software Buy:...