eFiction 3.1.1 - 'path_to_smf' Remote File Inclusion

To ConTacT mE @ www.Asb-May.net/bb ScRiPt:-http://www.efiction.org/downloads/eFiction31.zip GrEaTz To:-ToOofa-HaCk.eGy All AsB-MaY DisCoverY ExPloIts GrOup Discovered By:- ThE dE@Th logout.php:- includeonce$pathtosmf."Sources/Subs-Auth.php"; getsessionvars.php:- requireonce$pathtosmf."SSI.php";...

CVE-2006-4427

index.php in eFiction before 2.0.7 allows remote attackers to bypass authentication and gain privileges by setting the 1 adminloggedin, 2 loggedin, and 3 level parameters to "1"...

CVE-2006-4427

index.php in eFiction before 2.0.7 allows remote attackers to bypass authentication and gain privileges by setting the 1 adminloggedin, 2 loggedin, and 3 level parameters to "1"...

CVE-2006-4427

Vulnerability summary (CVE-2006-4427) : In eFiction prior to version 2.0.7, remote attackers can bypass authentication and gain privileges by setting the parameters (adminloggedin, loggedin, level) to “1” in index.php. This constitutes a privilege-escalation flaw in the authentication logic. The ...

eFiction < 2.0.7 Remote Admin Authentication Bypass Vulnerability

eFiction vulnerability I am releasing this to the public. Vendor was notified. Someone is also illegally defacing these websites under MY name, which is a shame because they ripped it from a private discussion on g00ns.net. This proof of concept is not to be used to illegally hack websites. I do...

eFiction 2.0.7 - Remote Admin Authentication Bypass

eFiction 2.0.7 - Remote Admin Authentication Bypass eFiction vulnerability I am releasing this to the public. Vendor was notified. Someone is also illegally defacing these websites under MY name, which is a shame because they ripped it from a private discussion on g00ns.net. This proof of concept...

eFiction < 2.0.7 Remote Admin Authentication Bypass Vulnerability

No description provided by source. eFiction vulnerability I am releasing this to the public. Vendor was notified. Someone is also illegally defacing these websites under MY name, which is a shame because they ripped it from a private discussion on g00ns.net. This proof of concept is not to be use...

eFiction < 2.0.7 Remote Admin Authentication Bypass Vulnerability

Exploit for unknown platform in category web applications ================================================================= eFiction 2.0.7 Remote Admin Authentication Bypass Vulnerability ================================================================= eFiction vulnerability I am releasing this ...

eFiction < 2.0.7 - Remote Admin Authentication Bypass

eFiction vulnerability I am releasing this to the public. Vendor was notified. Someone is also illegally defacing these websites under MY name, which is a shame because they ripped it from a private discussion on g00ns.net. This proof of concept is not to be used to illegally hack websites. I do...

eFiction < 2.0.2 Multiple Remote Vulnerabilities (SQLi, XSS, Disc)

The remote host is running eFiction, an open source application in PHP for writers. The installed version of eFiction is affected by numerous flaws : - Members may be able to upload files containing arbitrary PHP code disguised as image files and then run that code on the remote host subject to t...

CVE-2005-4174

eFiction 1.0, 1.1, and 2.0, in unspecified environments, might allow remote attackers to conduct unauthorized operations by directly accessing 1 install.php or 2 upgrade.php. NOTE: it is unclear whether this is a vulnerability in eFiction itself or the result of incorrect system administration...

CVE-2005-4173

eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information by accessing phpinfo.php, which executes the PHP phpinfo function...

CVE-2005-4167

Cross-site scripting XSS vulnerability in eFiction 1.0 and 1.1 allows remote attackers to inject arbitrary web script or HTML via the let parameter in a viewlist action to titles.php...

CVE-2005-4171

The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a filename with a .php extension that contains a GIF header, which passes the image validity check but executes any PHP...

CVE-2005-4172

eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information via a direct request to storyblock.php without arguments, which leaks the full pathname in the resulting PHP error message...

CVE-2005-4170

SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands via the uid parameter to viewuser.php...

CVE-2005-4168

Multiple SQL injection vulnerabilities in eFiction 1.0, 1.1, and 2.0 allow remote attackers to execute arbitrary SQL commands via 1 the let parameter in a viewlist action to titles.php and 2 the username...

CVE-2005-4169

Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 let parameter in a viewlist action to authors.php and 2 sid parameter to viewstory.php...

CVE-2005-4170

An SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands through the uid parameter to viewuser.php. This CVE-2005-4170 (NVD entry) has a base score of 7.5 (HIGH) with NETWORK access, LOW complexity, no authentication, and partial impacts on confiden...

CVE-2005-4172

CVE-2005-4172 affects eFiction 1.0, 1.1, and 2.0. The issue allows remote attackers to obtain sensitive information by requesting storyblock.php with no arguments, causing a PHP error message that leaks the full pathname. This is an information-disclosure flaw arising from an error message reveal...