CVE-2009-4154

Directory traversal vulnerability in includes/feedcreator.class.php in Elxis CMS allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2009-4154

The CVE-2009-4154 entry concerns a directory traversal in Elxis CMS, triggered by .. in the filename parameter of includes/feedcreator.class.php, allowing remote attackers to read arbitrary files. The connected documents confirm the vulnerable component and path, but do not provide patch versions...

Elxis CMS File Disclosure

Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg Elxis CMS Local File Disclosure Vulnerability Script Site : http://www.elxis.org Code : contentType."; charset=".$this-encoding; line 640 Header"Content-Disposition: inline; filename=".basename$filename; line 641 readfile$filename, "r"; line 642 di...

CVE-2008-4648

Cross-site scripting XSS vulnerability in index.php in Elxis CMS 2008.1 revision 2204 allows remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO or the 2 option, 3 Itemid, 4 id, 5 task, 6 bid, and 7 contactid parameters. NOTE: the error might be located in...

CVE-2008-4649

Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

Session fixation

Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2008-4649

Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2008-4648

Cross-site scripting XSS vulnerability in index.php in Elxis CMS 2008.1 revision 2204 allows remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO or the 2 option, 3 Itemid, 4 id, 5 task, 6 bid, and 7 contactid parameters. NOTE: the error might be located in...

CVE-2008-4649

CVE-2008-4649 describes a session fixation vulnerability in Elxis CMS 2008.1 revision 2204, where remote attackers can hijack user sessions by supplying a crafted PHPSESSID parameter. The issue specifically affects Elxis CMS and enables session hijacking, as reflected in the description. The CVSS...

CVE-2008-4648

CVE-2008-4648 is a Cross-site Scripting (XSS) vulnerability in Elxis CMS 2008.1 revision 2204. The issue allows remote attackers to inject arbitrary web script or HTML through the following request parameters: PATH_INFO, option, Itemid, id, task, bid, and contact_id. Notes indicate the flaw may o...

elxis-xss.txt

. . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com Greetings to --d3hydr8 -r45c4l -baltazar -sinner01 -C1c4Tr1Z -Gabitzu and all darkc0de members ; Author: swappie aka faithlove Home :...

Elxis CMS 2008.1 - modulesmod_language.php Multiple Cross-Site Scripting Vulnerabilities

Elxis CMS 2008.1 - modulesmodlanguage.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/31764/info Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The...

Elxis CMS 2008.1 - PHPSESSID Variable Session Fixation

Elxis CMS 2008.1 - PHPSESSID Variable Session Fixation source: https://www.securityfocus.com/bid/31764/info Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a...

Elxis CMS 2008.1 - '/modules/mod_language.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/31764/info Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation vulnerability. An attacker may leverage...

Elxis CMS 2008.1 - PHPSESSID Variable Session Fixation

source: https://www.securityfocus.com/bid/31764/info Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation vulnerability. An attacker may leverage...

Sql injection

SQL injection vulnerability in modbanners.php in Elxis CMS before 2006.4 20070613 allows remote attackers to execute arbitrary SQL commands via the mbtracker cookie. NOTE: the product was patched without updating the version number; later downloads of 2006.4 are not affected...

CVE-2007-3250

SQL injection vulnerability in modbanners.php in Elxis CMS before 2006.4 20070613 allows remote attackers to execute arbitrary SQL commands via the mbtracker cookie. NOTE: the product was patched without updating the version number; later downloads of 2006.4 are not affected...

CVE-2007-3250

The CVE-2007-3250 issue affects Elxis CMS (mod_banners.php) where an SQL injection is possible via the mb_tracker cookie. It targets installations running before 2006.4 (20070613); the product was patched without updating the version number, and later downloads of 2006.4 are not affected. Remedia...

CVE-2007-3250

SQL injection vulnerability in modbanners.php in Elxis CMS before 2006.4 20070613 allows remote attackers to execute arbitrary SQL commands via the mbtracker cookie. NOTE: the product was patched without updating the version number; later downloads of 2006.4 are not affected...

Elxis CMS Banner Module MB_Tracker SQL注入漏洞

Elxis CMS Banner是一款基于PHP的WEB应用程序。 Elxis CMS Banner不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于脚本对用户提交的COOKIE参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 Elxis Elxis CMS 2006.4 Elxis Elxis CMS 2006.3 Elxis Elxis CMS 2006.2 Elxis Elxis CMS 2006.1 补丁下载： Elxis Elxis CMS 2006.3...