107 matches found
Woltlab Burning Board 2.3.4 - File Disclosure
Woltlab Burning Board 2.3.4 - File Disclosure Exploit Title: Woltlab Burning Board 2.3.4 File Disclosure Vulnerability Date: 2010-11-12 Author: SFX Version: 2.3.4 CVE : N/A After you've used the Exploit to get the admin account: goto: http://lolcathost/wbb/acp/avatar.php?action=readfolder import:...
Yamamah Photo Gallery 1.00 - 'download.php' Local File Disclosure
|=---------------------------------------------------------------------------=| Yamamah Photo Gallery 1.00 download.php Local File Disclosure Vulnerability |=---------------------------------------------------------------------------=| |=------------------------------= by mat...
Discuz! 7.0-7.2 & Phpwind7. 5 Background tasteless vulnerability-vulnerability warning-the black bar safety net
| Transfer from t00ls A lot of people there, spread out, and then sent to. Now the loophole if the initiative is published, is definitely“no. do not publish”, otherwise is definitely hiding unless someone else posted. DZ tasteless that need the Creator's permission, the Creator of the password is...
PHPhotoalbum 0.5 - SQL Injection
Title: PHPhotoalbum Remote sql injection Vulnerability Tested on: windows http://server/PHPhotoalbum/thumbnails.php?album=-1+union+select+user+from+mysql.user-- http://server/PHPhotoalbum/thumbnails.php?album=-1+union+select+loadfile/directory hex/config.inc.php+from+mysql.user--...
OBOphiX <= 2.7.0 (fonctions_racine.php) Remote File Inclusion Vuln
No description provided by source. OBOphiX fonctionsracine.php = 2.7.0 Remote File Include Vulnerability + Author : EA Ngel + Location : Manado - Indonesia + Situs : wwwdotmanadocodingdotnet + Contact : [email protected] + Download Script :...
OBOphiX <= 2.7.0 (fonctions_racine.php) Remote File Inclusion Vuln
Exploit for unknown platform in category web applications ================================================================== OBOphiX = 2.7.0 fonctionsracine.php Remote File Inclusion Vuln ================================================================== OBOphiX fonctionsracine.php = 2.7.0 Remote...
phpMyAdmin setup.php脚本PHP代码注入漏洞
BUGTRAQ ID: 34236 CVECAN ID: CVE-2009-1151 phpMyAdmin是用PHP编写的工具，用于通过WEB管理MySQL。 phpMyAdmin的Setup脚本用于生成配置。如果远程攻击者向该脚本提交了特制的POST请求的话，就可能在生成的config.inc.php 配置文件中包含任意PHP代码。由于配置文件被保存到了服务器上，未经认证的远程攻击者可以利用这个漏洞执行任意PHP代码。 phpMyAdmin phpMyAdmin 3.x phpMyAdmin phpMyAdmin 2.11.x 厂商补丁： phpMyAdmin ----------...
PHP-agenda <= 2.2.5 Remote File Overwriting
Salvatore "drosophila" Fresta + Application: PHP-agenda + Version: = 2.2.5 + Website: http://php-agenda.sourceforge.net + Bugs: A Remote File Overwriting + Exploitation: Remote + Date: 10 Apr 2009 + Discovered by: Salvatore "drosophila" Fresta + Author: Salvatore "drosophila" Fresta + Contact:...
PHP-Agenda 2.2.5 - Remote File Overwriting
Salvatore "drosophila" Fresta + Application: PHP-agenda + Version: PHP-agenda To execute commands: http://www.site.com/path/config.inc.php?cmd=uname -a + Fix You must delete install.php after installation. milw0rm.com 2009-04-10...
Simple PHP Newsletter 1.5 Local File Inclusion
--:local file include:-- --------------------------------- script:Simple PHP Newsletter 1.5 ---------------------------------------------- download from:http://quirm.net/download/23/ ---------------------------------------------- ............................................... vul:/mail.php line...
Simple PHP Newsletter 1.5 (olang) Local File Inclusion Vulnerabilities
No description provided by source. --:local file include:-- --------------------------------- script:Simple PHP Newsletter 1.5 ---------------------------------------------- download from:http://quirm.net/download/23/ ----------------------------------------------...
Directory traversal
Directory traversal vulnerability in config.inc.php in phpAbook 0.8.8b and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the userInfo cookie...
CVE-2008-4490
Directory traversal vulnerability in config.inc.php in phpAbook 0.8.8b and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the userInfo cookie...
CVE-2008-4490: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in config.inc.php in phpAbook 0.8.8b and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the userInfo cookie...
phpAbook 0.8.8b - cookie Local File Inclusion
phpAbook 0.8.8b - cookie Local File Inclusion phpAbook ... 61: if isset$HTTPCOOKIEVARS"userInfo" && $HTTPCOOKIEVARS"userInfo" != "" $userArray = explode" ", $HTTPCOOKIEVARS"userInfo"; $userName = $userArray0; $userID = $userArray1; $userLang = $userArray2;...
phpAbook 0.8.8b - 'cookie' Local File Inclusion
phpAbook ... 61: if isset$HTTPCOOKIEVARS"userInfo" && $HTTPCOOKIEVARS"userInfo" != "" $userArray = explode" ", $HTTPCOOKIEVARS"userInfo"; $userName = $userArray0; $userID = $userArray1; $userLang = $userArray2; include"include/lang/$userLang/inc.messages.php"; 67: x: INCLUDE exploit:...
webcp 0.5.7 - filelocation Remote File Disclosure
webcp 0.5.7 - filelocation Remote File Disclosure webcp 0.5.7 sendfile.php filelocation Remote File Disclosure Vulnerability Script : http://www.web-cp.net/releases/webcp-0.5.7.tar.gz Demo : http://gyrbo.madoka.be/web-cp/ Vuln : if $tf = fopen$filelocation, "r" // Date in the past POC :...
CVE-2008-3457
Cross-site scripting XSS vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify...
CVE-2008-3457: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify...
phpMyAdmin多个跨站脚本漏洞
BUGTRAQ ID: 30420 CNCAN ID：CNCAN-2008073002 phpMyAdmin是一款基于PHP的管理MySQL的应用程序。 phpMyAdmin不正确过滤用户提交的参数，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 -phpMyAdmin应允许帧显示到其他页中，可导致钓鱼攻击。 -setup.php存在跨站脚本攻击，可导致覆写config/config.inc.php文件。 phpMyAdmin phpMyAdmin 2.11.7 phpMyAdmin phpMyAdmin 2.11.5 1 phpMyAdmin phpMyAdmin 2.11.4...