mysql_error() XSS Vulnerability

不正确使用mysqlerror导致的Vul。当然前提是$db可以覆盖，那么就很鸡肋了，或者就不能叫Vul了，O∩∩OJust For Fun mysqlerror http://hi.baidu.com/menzhi007/blog/item/7583dc0390316d7d3912bbbf.html ?php $db='menzhi007'; extract$GET; $link = mysqlconnect"localhost", "root", ""; mysqlselectdb$db, $link; echo mysqlerror$link; ?...

e107 download.php "extract()"漏洞

CNCAN ID：CNCAN-2008081109 e107是一款基于PHP的WEB应用程序。 e107不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息或操作数据库。 问题是由于'download.php'脚本不安全使用"extract"函数，允许通过POST方法传递输入来覆盖任意变量，这可导致修改部分SQL查询并执行任意PHP代码。 e107 0.x E107 CVS库已经修正此漏洞： http://e107.org/...

Phpcms 2 0 0 7 remote file inclusion vulnerability-vulnerability warning-the black bar safety net

zzPhpcms 2 0 0 7 remote file include vulnerability url:http://www. wolvez. org/forum/redirect. php? tid=1 8 2&goto=lastpost This vulnerability is a more common variable coverage holes, where the transfer is due to the discovery of this vulnerability if it is a white box that you want to have a...

Fuzzylime CMS 3.01 - 'commrss.php' Remote Code Execution

Conditions: None Greetz: Inphex, hEEGy and austeN Explanations Ok, so today we will go for a walk in the fuzzylime cms maze ... Finding vulns was easy, but finding a no condition vuln was quite harder ... First, we look to the code/content.php file:...

Phpcms 2007 common.inc.php远程文件包含漏洞

该cms的核心配置文件/include/common.inc.php有缺陷 -------------------------------------------- //23行开始 @extract$POST, EXTROVERWRITE; @extract$GET, EXTROVERWRITE; unset$POST, $GET; ------------------------------------------------ 这里extract函数会导致变量覆盖，可能引发一系列的问题...

AZL-6828 CVE-2007-4559 affecting package python3 for versions less than 3.9.19-1

Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive, a related issue to CVE-2001-1267...

AZL-6822 CVE-2007-4559 affecting package python2 for versions less than 2.7.18-8

Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive, a related issue to CVE-2001-1267...

PSF-2007-2 Directory path traversal in extract() and extractall() tarfile functions via '..' (dot dot) sequences

Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive, a related issue to CVE-2001-1267...

CVE-2007-0975

CVE-2007-0975 affects Ian Bezanson Apache Stats prior to 0.0.3 beta. The vulnerability is a variable extraction issue: the extract function on the _REQUEST superglobal can overwrite critical variables. The impact is stated as unknown in the source material. CVSS 2.0 base score is 5.0 (Medium). No...

Design/Logic Flaw

Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function...

CVE-2007-0930

Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function...

CVE-2006-6661

Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code via multiple vectors that use the extract function, as demonstrated by the 1 f, 2 newmessage, 3 newusername, 4 adminuser, and ...

CVE-2006-6661

This CVE affects PHP-Update (blog.php)

CVE-2006-6661

Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code via multiple vectors that use the extract function, as demonstrated by the 1 f, 2 newmessage, 3 newusername, 4 adminuser, and ...

CVE-2006-6213

index.php in PEGames uses the extract function to overwrite critical variables, which allows remote attackers to conduct PHP remote file inclusion attacks via the absurl parameter, which is later extracted to overwrite a previously uncontrolled value...

CVE-2006-6097

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPENAMES record with a symbolic link, which is not properly handled by the extractarchive function in extract.c and extractmangle function in...

CVE-2006-6097

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPENAMES record with a symbolic link, which is not properly handled by the extractarchive function in extract.c and extractmangle function in...

CVE-2006-6097

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPENAMES record with a symbolic link, which is not properly handled by the extractarchive function in extract.c and extractmangle function in...

CVE-2006-4877

The CVE-2006-4877 entry concerns David Bennett PHP-Post (PHPp) 1.0 and earlier, where a variable overwrite vulnerability exists due to the use of PHP extract in multiple vectors. The affected components are the PHPp pages index.php, profile.php, and header.php, with the demonstrated vector involv...

CVE-2006-4877

Variable overwrite vulnerability in David Bennett PHP-Post PHPp 1.0 and earlier allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function, as demonstrated by the tableprefix parameter in 1 index.php, 2 profile.php, and 3 header.php...