EUVD-2008-1378

Malware in sbrugna...

CVE-2008-1371: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the droot parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2006-5767: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/xhtml.php in Drake CMS 0.2.2 alpha rev.846 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the droot parameter...