SQL injection vulnerability in e107

Vulnerability ID: HTB22603 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityine1071.html Product: e107 Website System Vendor: e107 http://www.e107.org/ Vulnerable Version: 0.7.23 and Probably Prior Versions Vendor Notification: 03 September 2010 Vulnerability Type: SQL Injectio...

CVE-2010-3456: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in download.php in EnergyScripts ES Simple Download 1.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2009-4960

Directory traversal vulnerability in modules/backup/download.php in Lanai Core 0.6 allows remote attackers to read arbitrary files via a .. dot dot in the f parameter...

CVE-2009-4960: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in modules/backup/download.php in Lanai Core 0.6 allows remote attackers to read arbitrary files via a .. dot dot in the f parameter...

CVE-2010-2334: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in themes/default/download.php in Yamamah Photo Gallery 1.00, as distributed before 20100618, allows remote attackers to read arbitrary files via a .. dot dot in the download parameter...

Yamamah Photo Gallery 1.00 Local File Disclosure

|=---------------------------------------------------------------------------=| Yamamah Photo Gallery 1.00 download.php Local File Disclosure Vulnerability |=---------------------------------------------------------------------------=| |=------------------------------= by mat...

Yamamah Photo Gallery 1.00 (download.php) Local File Disclosure

Exploit for php platform in category web applications ============================================================================= Yamamah Photo Gallery 1.00 download.php Local File Disclosure Vulnerability =============================================================================...

Yamamah Photo Gallery 1.00 - 'download.php' Local File Disclosure

|=---------------------------------------------------------------------------=| Yamamah Photo Gallery 1.00 download.php Local File Disclosure Vulnerability |=---------------------------------------------------------------------------=| |=------------------------------= by mat...

PHPCMS2008 1 0 0 5 2 7 version website management system to download an arbitrary file vulnerability-vulnerability warning-the black bar safety net

Phpcms is a PHP-based+Mysql architecture of the web content management system, it is an open-source PHP development platform. Phpcms uses a modular approach to the development, functional and easy to use to facilitate the expansion, for medium to large sites provide heavyweight website Building...

PHPCMS2008 100527版本网站管理系统下载任意文件漏洞

phpcms2008sp4 下载任意文件漏洞发布后，27号官方的补丁是这样的： down.php ifpregmatch'/.php/i',$f || strpos$f, ":\" showmessage'地址有误'; //12行 没补丁前是这样的： ifpregmatch'/.php$/',$f || strpos$f, ":\" showmessage'地址有误'; //12行 可以看出两者的区别。 但同样是这个文件中： parsestr$ak;//8行 知道这里还有更好的利用方法了，再看文件： download.php if$m $fileurl =...

CVE-2010-1498

Multiple SQL injection vulnerabilities in dlstats before 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 download.php and 2 viewfile.php...

CVE-2010-1498

Multiple SQL injection vulnerabilities affect the dl_stats package before version 2.0. The issue allows remote attackers to execute arbitrary SQL commands by supplying a crafted id parameter to two PHP endpoints: download.php and view_file.php. This conclusion is supported by CVE-2010-1498 record...

CVE-2010-1498: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in dlstats before 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 download.php and 2 viewfile.php...

CVE-2009-4726

Directory traversal vulnerability in download.php in Quickdev 4 PHP allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2009-4726: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in download.php in Quickdev 4 PHP allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2010-0696: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos JwallVideos plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ modified dot dot in the file parameter...

Joomla (Jw_allVideos) Remote File Download Vulnerability

Securitylab.ir Application Info: Name: Joomla jwallvideos Plugin Version: 1.0 Vulnerability Info: Type: Remote File Download Risk: Medium Vulnerability: http://site.com/plugins/content/jwallvideos/includes/download.php?file=./../.../file.php Discoverd By: Pouya Daneshmand Website:...

Sql injection

SQL injection vulnerability in download.php in Nicecoder iDesk allows remote attackers to execute arbitrary SQL commands via the catid parameter, a different vector than CVE-2005-3843...

CVE-2009-4624

SQL injection vulnerability in download.php in Nicecoder iDesk allows remote attackers to execute arbitrary SQL commands via the catid parameter, a different vector than CVE-2005-3843...

CVE-2009-4624

CVE-2009-4624 affects Nicecoder iDesk via a SQL injection in download.php that is exploitable through the cat_id parameter. The vulnerability is in the application layer where user-supplied cat_id can cause arbitrary SQL execution, with impact described as arbitrary SQL commands being run by an a...