Piwigo任意文件泄露和任意文件删除漏洞

BUGTRAQ ID: 58016 Piwigo是用PHP编写的相册脚本。 Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。 0 Piwigo Piwigo 2.4.6 厂商补丁： Piwigo ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://piwigo.org/bugs/view.php?id=2843...

CVE-2006-7243

PHP before 5.3.4 accepts a NUL (\0) in a pathname, enabling context-dependent bypass of access restrictions (example: .php\0.jpg) via file_exists; remediation involves upgrading to a fixed PHP version (5.3.4+; later advisories note 5.4.41+/5.5.x+/5.6.x fixes). The CVE-2015-4025/4026 entries ackno...

CVE-2006-7243: Improper Input Validation

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the fileexists function...

CVE-2006-7243

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the fileexists function...

Joomla Seber Cart 1.0.0.1x Local File Disclosure

========================================================================================================= o Joomla Component Seber Cart Local File Disclosure Vulnerability Software : comsebercart version 1.0.0.1x Vendor : http://www.seber.com.au/ Author : AntiSecurity NoGe Vrs-hCk OoNBoY Paman zx...

Joomla Component Seber Cart (getPic.php) Local File Disclosure Vulnerability

No description provided by source. ========================================================================================================= o Joomla Component Seber Cart Local File Disclosure Vulnerability Software : comsebercart version 1.0.0.1x Vendor : http://www.seber.com.au/ Author :...

CodeDB 1.1.1 - list.php Local File Inclusion

CodeDB 1.1.1 - list.php Local File Inclusion Name : CodeDB list.php lang Local File Inclusion Vulnerability Author : cOndemned Greetz : ZaBeaTy, str0ke, irk4z, GregStar, doctor, Adish, Avantura ; Source : // list.php 2. $lang = htmlspecialchars$GET'lang'; // ok, but.... for what ? lol 7...

FireAnt 1.3 (index.php page) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications =============================================================== FireAnt 1.3 index.php page Local File Inclusion Vulnerability =============================================================== Name : FireAnt v1.3 Local File Inclusion...

FireAnt 1.3 - 'index.php' Local File Inclusion

Name : FireAnt v1.3 Local File Inclusion Vulnerability Author : cOndemned Dork : use Your brain : Greetz : ZaBeaTy, str0ke, GregStar, irk4z, Sandtalker & Avantura ; Source : // index.php 8. $page = "buglist"; //default page 9. if !empty$GET'page' 10. $page = striptags$GET'page'; 99. if...

CVE-2007-2679: Undefined Security Weakness

PHP file inclusion vulnerability in index.php in Ivan Peevski gallery 0.3 in Simple PHP Scripts sphp allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the fileexists function. NOTE: the provenance...

Arbitrary file deletion

PHP file inclusion vulnerability in php121db.php in PHP121 Instant Messenger 2.2 allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the php121dir parameter, which is accessed by the fileexists function...

CVE-2007-1935

CVE-2007-1935 affects ScarAdControl (ScarAdController) 1.1, where admin/index.php uses the site parameter and calls file_exists, enabling a remote attacker to execute arbitrary PHP code via UNC share or local file path. This is a PHP file inclusion vulnerability; the impact is described as arbitr...

CVE-2007-1908: Undefined Security Weakness

PHP file inclusion vulnerability in php121db.php in PHP121 Instant Messenger 2.2 allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the php121dir parameter, which is accessed by the fileexists function...

Mandrake Linux Security Advisory : php (MDKSA-2006:162)

The 1 fileexists and 2 imapreopen functions in PHP before 5.1.5 do not check for the safemode and openbasedir settings, which allows local users to bypass the settings CVE-2006-4481. Buffer overflow in the LWZReadByte function in ext/gd/libgd/gdgifin.c in the GD extension in PHP before 5.1.5 allo...

CVE-2006-6043

PHP file inclusion vulnerability in loginform-inc.php in Oliver formerly Webshare 1.2.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the confmotdfile parameter, which is accessed by the...

PHP多个安全漏洞.

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP中存在多个安全漏洞，具体如下： 1 fileexists、imapopen和imapreopen函数中缺少safemode和openbasedir验证； 2 在64位系统上strrepeat和wordwrap函数存在边界错误； 3 可通过cURL扩展和realpath缓存绕过openbasedir和safemode保护机制； 4 GD扩展处理畸形GIF图形时存在边界条件错误； 5 stripos函数中的错误可能导致界外内存读取； 6 64位系统上存在错误的memorylimit限制。...

[Full-disclosure] [ MDKSA-2006:162 ] - Updated php packages fix vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2006:162 http://www.mandriva.com/security/ Package : php Date : September 7, 2006 Affected: 2006.0, Corporate 3.0, Multi Network Firewall 2.0 Problem Description: The 1 fileexists and 2 imapreopen functions in PH...

CVE-2006-4481

The 1 fileexists and 2 imapreopen functions in PHP before 5.1.5 do not check for the safemode and openbasedir settings, which allows local users to bypass the settings. NOTE: the errorlog function is covered by CVE-2006-3011, and the imapopen function is covered by CVE-2006-1017...

CVE-2006-4481

The 1 fileexists and 2 imapreopen functions in PHP before 5.1.5 do not check for the safemode and openbasedir settings, which allows local users to bypass the settings. NOTE: the errorlog function is covered by CVE-2006-3011, and the imapopen function is covered by CVE-2006-1017...

CVE-2006-4481

The 1 fileexists and 2 imapreopen functions in PHP before 5.1.5 do not check for the safemode and openbasedir settings, which allows local users to bypass the settings. NOTE: the errorlog function is covered by CVE-2006-3011, and the imapopen function is covered by CVE-2006-1017...