CVE-2006-0315

index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allows remote attackers to conduct directory traversal attacks, and produces resultant cross-site scripting XSS and path disclosure...

CVE-2006-0315

CVE-2006-0315 affects EZDatabase prior to 2.1.2. The vulnerability stems from improper cleansing of the p parameter when constructing and including a .php filename, enabling directory traversal. This can lead to cross-site scripting (XSS) and path disclosure. The available connected documents pro...

EZDatabase 2.1.1 - index.php Cross-Site Scripting

EZDatabase 2.1.1 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/16257/info EZDatabase is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to ha...

EZDatabase 2.1.1 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16257/info EZDatabase is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser o...

Design/Logic Flaw

Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the dbid parameter to visitorupload.php, as demonstrated using phpinfo and include function calls...

CVE-2006-0214

Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the dbid parameter to visitorupload.php, as demonstrated using phpinfo and include function calls...

CVE-2006-0214

Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the dbid parameter to visitorupload.php, as demonstrated using phpinfo and include function calls...

CVE-2006-0214

CVE-2006-0214 affects ezDatabase 2.0 and earlier. A vulnerability in the application’s PHP code allows remote attackers to execute arbitrary PHP via an eval injection in the db_id parameter to visitorupload.php, demonstrated with phpinfo and include() calls. The connected documents confirm the fl...

[Full-disclosure] EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerability

Synopsis: EZDatabase directory transversal, XSS and path disclosure vulnerability Product: EZDatabase http://www.ezdatabase.org Version: Confirmed on EZDatabase 2.1.2 Author: Josh Zlatin-Amishav Date: January 15, 2006 Background: Written in PHP and MySQL, ezDatabase is the foundation for your...

ezDatabase 2.0 and below

ezDatabase 2.0 and below ezDatabase 2.0 and below ========================================= www.ezdatabase.org "ezDatabase is the foundation for your online databases. It is a powerful web based application that allows even non-technical users to create online databases for their website...

ezDatabase20.txt

ezDatabase 2.0 and below ezDatabase 2.0 and below ========================================= www.ezdatabase.org "ezDatabase is the foundation for your online databases. It is a powerful web based application that allows even non-technical users to create online databases for their website...

EZDatabaseRemote 2.0 - PHP Script Code Execution

EZDatabaseRemote 2.0 - PHP Script Code Execution source: https://www.securityfocus.com/bid/16237/info ezDatabase is prone to a remote PHP script code execution vulnerability. An attacker can exploit this issue to execute arbitrary malicious PHP code and execute it in the context of the Web server...

EZDatabaseRemote 2.0 - PHP Script Code Execution

source: https://www.securityfocus.com/bid/16237/info ezDatabase is prone to a remote PHP script code execution vulnerability. An attacker can exploit this issue to execute arbitrary malicious PHP code and execute it in the context of the Web server process. These may facilitate a compromise of th...

CVE-2005-4304

index.php in ezDatabase 2.1.2 and earlier allows remote attackers to obtain sensitive information via an invalid catid parameter, which leaks the full pathname in an error message. NOTE: these details are uncertain because the original report has terminology problems and lack of relevant details...

CVE-2005-4302

Directory traversal vulnerability in index.php in ezDatabase 2.1.2 and earlier allows remote attackers to include arbitrary local files via ".." sequences in the p parameter...

CVE-2005-4303

SQL injection vulnerability in index.php for ezDatabase 2.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the dbid parameter...

CVE-2005-4304

index.php in ezDatabase 2.1.2 and earlier allows remote attackers to obtain sensitive information via an invalid catid parameter, which leaks the full pathname in an error message. NOTE: these details are uncertain because the original report has terminology problems and lack of relevant details...

CVE-2005-4302

The CVE-2005-4302 entry concerns a directory traversal vulnerability in ezDatabase

CVE-2005-4303

SQL injection vulnerability in index.php for ezDatabase 2.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the dbid parameter...

CVE-2005-4304

CVE-2005-4304 affects ezDatabase versions up to 2.1.2 and earlier. The issue is triggered by an invalid cat_id parameter in index.php, leading to leakage of a full pathname in an error message. The description notes uncertainty about details due to report terminology problems and partial feedback...