EUVD-2006-4866

Malware in sbrugna...

CVE-2006-4877

The CVE-2006-4877 entry concerns David Bennett PHP-Post (PHPp) 1.0 and earlier, where a variable overwrite vulnerability exists due to the use of PHP extract in multiple vectors. The affected components are the PHPp pages index.php, profile.php, and header.php, with the demonstrated vector involv...

CVE-2006-4878: Undefined Security Weakness

Directory traversal vulnerability in footer.php in David Bennett PHP-Post PHPp 1.0 and earlier allows remote attackers to read and include arbitrary local files via a .. dot dot sequence in the template parameter. NOTE: this was later reported to affect 1.0.1, and demonstrated for code execution ...

CVE-2006-4879: Undefined Security Weakness

SQL injection vulnerability in profile.php in David Bennett PHP-Post PHPp 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter...

CVE-2006-4877: Undefined Security Weakness

Variable overwrite vulnerability in David Bennett PHP-Post PHPp 1.0 and earlier allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function, as demonstrated by the tableprefix parameter in 1 index.php, 2 profile.php, and 3 header.php...

CVE-2006-4881: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in David Bennett PHP-Post PHPp 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the replyuser parameter in a pm.php; 2 the txtjumpto parameter in b dropdown.php; the 3 txterror and 4 txttemplatenotexist parameter...