e107 <= 0.7.20 Code Execution Vulnerability

Exploit for multiple platform in category web applications =========================================== e107 agent"Mozilla/5.0"; if $proxy print " Using proxy $proxy \n"; $ua-envproxy'1'; my $req = new HTTP::Request POST = $path; $req-contenttype'application/x-www-form-urlencoded';...

e107 - Code Exection

Exploit Title: e107 Code Exec Date: 05/22/10 Author: [email protected] Software Link: http://e107.org/edownload.php Version: e107 agent"Mozilla/5.0"; if $proxy print " Using proxy $proxy \n"; $ua-envproxy'1'; my $req = new HTTP::Request POST = $path;...

e107 BBCode arbitrary PHP code execution vulnerability-vulnerability warning-the black bar safety net

e107 is a php written content management system. e107 in the bbcode phpallows execution of arbitrary PHP code. Since this method is more dangerous, e107 configuration generally prohibit all users access the bbcode, the administrator can be for a specific group of users on-demand activation of thi...

e107 BBCode任意PHP代码执行漏洞

BUGTRAQ ID: 40252 e107是用php编写的内容管理系统。 e107中的bbcode php允许执行任意PHP代码。由于这种方式比较危险，e107的配置通常禁止所有用户访问这个bbcode，管理员可以对特定的用户组按需激活这个功能。 e107中的访问控制检查没有在bbcode解析器内部而是在一些调用bbcode解析器的外部功能中实现，例如： function posttoHTML$text, $modifier = true, $extra = '' ... //If user is not allowed to use php change to entities...

e107 BBCode Arbitrary PHP Code Execution

The installation of e107 on the remote host allows unauthenticated access to the special 'php' BBCode, which supports execution of arbitrary PHP code. An unauthenticated, remote attacker can leverage this to execute arbitrary PHP, subject to the privileges under which the web server operates...

e107 content management system usersettings. php page there is SQL injection vulnerability-vulnerability warning-the black bar safety net

e107 is a php written content management system. e107 of the usersettings. php page existsSQL injectionvulnerabilities: if $ret == ’ $loginname = striptags$POST’loginname’; if !$ loginname $loginname = $udata’userloginname’; else if! checkclass$pref’displaynameclass’, $udata’userclasslist’, $peer...

e107 0.7.20 Usersettings页面SQL注入漏洞

e107是用php编写的内容管理系统。 e107的usersettings.php页面存在SQL注入漏洞： if $ret == '' $loginname = striptags$POST'loginname'; if !$loginname $loginname = $udata'userloginname'; else if!checkclass$pref'displaynameclass', $udata'userclasslist', $peer $newusername = "username = '$loginname', "; $username = $loginname...

FreeBSD Ports: e107

The remote host is missing an update to the system as announced in the referenced advisory. VID a4746a86-4c89-11df-83fb-0015587e2cc1 OpenVAS Vulnerability Test $ Description: Auto generated from VID a4746a86-4c89-11df-83fb-0015587e2cc1 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

FreeBSD Ports: e107

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

IP address spoofing in e107

Vulnerability ID: HTB22343 Reference: http://www.htbridge.ch/advisory/ipaddressspoofingine107.html Product: e107 Website System Vendor: e107 Vulnerable Version: 0.7.19 and Probably Prior Versions Vendor Notification: 05 April 2010 Vulnerability Type: Application Logic Error Status: Not Fixed,...

CSRF in e107

Vulnerability ID: HTB22344 Reference: http://www.htbridge.ch/advisory/xsrfcsrfine107.html Product: e107 Website System Vendor: e107 Vulnerable Version: 0.7.19 and Probably Prior Versions Vendor Notification: 05 April 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vend...

Secunia Research: e107 Content Management Plugin Script Insertion Vulnerability

====================================================================== Secunia Research 19/04/2010 - e107 Content Management Plugin Script Insertion Vulnerability - ====================================================================== Table of Contents Affected...

e107 CMS 0.7.19 - Cross-Site Request Forgery

e107 CMS 0.7.19 - Cross-Site Request Forgery Vulnerability ID: HTB22344 Reference: http://www.htbridge.ch/advisory/xsrfcsrfine107.html Product: e107 Website System Vendor: e107 Vulnerable Version: 0.7.19 and Probably Prior Versions Vendor Notification: 05 April 2010 Vulnerability Type: CSRF...

e107 0.7.19 Source IP Address Spoof

Vulnerability ID: HTB22343 Reference: http://www.htbridge.ch/advisory/ipaddressspoofingine107.html Product: e107 Website System Vendor: e107 Vulnerable Version: 0.7.19 and Probably Prior Versions Vendor Notification: 05 April 2010 Vulnerability Type: Application Logic Error Status: Not Fixed,...

e107 version 0.7.19 XSRF vulnerability

Exploit for php platform in category web applications ====================================== e107 version 0.7.19 XSRF vulnerability ====================================== Product: e107 Website System Vendor: e107 Vulnerable Version: 0.7.19 and Probably Prior Versions Vendor Notification: 05 April...

e107 0.7.x - e107_adminbanner.php SQL Injection

e107 0.7.x - e107adminbanner.php SQL Injection source: https://www.securityfocus.com/bid/39609/info e107 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

FreeBSD : e107 -- code execution and XSS vulnerabilities (a4746a86-4c89-11df-83fb-0015587e2cc1)

Secunia Research reported two vulnerabilities in e107 : The first problem affects installations that have the Content Manager plugin enabled. This plugin does not sanitize the 'contentheading' parameter correctly and is therefore vulnerable to a cross site scripting attack. The second vulnerabili...

e107 0.7.x - '/e107_admin/banner.php' SQL Injection

source: https://www.securityfocus.com/bid/39609/info e107 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or...

e107 CMS 0.7.19 - Cross-Site Request Forgery

Vulnerability ID: HTB22344 Reference: http://www.htbridge.ch/advisory/xsrfcsrfine107.html Product: e107 Website System Vendor: e107 Vulnerable Version: 0.7.19 and Probably Prior Versions Vendor Notification: 05 April 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vend...

CVE-2010-0996

Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required...