CVE-2006-6511

dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain 1 feature, 2 editor, 3 newswire, 4 otherpress, 5 admin, 6 pbook, 7 media, or 8 mod, which are...

CVE-2006-6511

The CVE-2006-6511 entry concerns the product dadaIMC .99.3, where an insufficiently restrictive FilesMatch directive in the installed .htaccess allows remote attackers to execute arbitrary PHP code. Specifically, uploaded files whose names contain any of the words: feature, editor, newswire, othe...

[Full-disclosure] DadaIMC default configuration vulnerability

The instructions for installing Dada into a shared environment lists the following .htaccess file: http://www.dadaimc.org/mod/documentation/display/4/index.php FilesMatch "feature|editor|newswire|otherpress|admin|pbook|media|mod" ForceType application/x-httpd-php /FilesMatch The problem is that t...

[SA12955] dadaIMC "Post An Article" Script Insertion Vulnerability

TITLE: dadaIMC "Post An Article" Script Insertion Vulnerability SECUNIA ADVISORY ID: SA12955 VERIFY ADVISORY: http://secunia.com/advisories/12955/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: dadaIMC 0.x...