217 matches found
CVE-2005-4448
FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash possibly via CVE-2005-2813, then calculating the credentials and...
CVE-2005-4449
verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting the code into the body parameter. NOTE: if a FlatNuke administrator is normally assumed to be able to modify arbitrary content, th...
CVE-2005-4448
FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash possibly via CVE-2005-2813, then calculating the credentials and...
CVE-2005-4448
CVE-2005-4448 concerns FlatNuke 2.5.6 where authentication credentials are verified using an MD5 checksum of the admin name and the hashed password instead of the plaintext password. This allows an attacker who can obtain the password hash (notably via CVE-2005-2813) to compute credentials and in...
CVE-2005-4449
The CVE-2005-4449 entry concerns verify.php in FlatNuke 2.5.6 , where remote authenticated administrators can modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting code via the body parameter. This describes a privilege-elevation-like issue within an authenti...
CVE-2005-4448: Undefined Security Weakness
FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash possibly via CVE-2005-2813, then calculating the credentials and...
CVE-2005-4449: Undefined Security Weakness
verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting the code into the body parameter. NOTE: if a FlatNuke administrator is normally assumed to be able to modify arbitrary content, th...
flatnuke256_xpl.txt
?php ---flatnuke256xpl.php 4.32 10/12/2005 Flatnuke 2.5.6 privilege escalation / remote commands execution exploit works with magicquotesgpc off, try this with 2.5.5: http://www.milw0rm.com/id.php?id=1140 coded by rgod at http://rgod.altervista.org mail: retrogod at aliceposta it original advisor...
CVE-2005-4208
Directory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. dot dot and null byte %00 in the id parameter of the read module...
CVE-2005-4208
Directory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. dot dot and null byte %00 in the id parameter of the read module...
CVE-2005-4208
CVE-2005-4208 affects FlatNuke 2.5.6 (and potentially earlier 2.5.x) where an attacker can trigger a directory traversal via the id parameter to the read/index.php script, enabling remote arbitrary file access (dot dot and null byte %00). The issue stems from improper sanitization of user input, ...
CVE-2005-4208: Undefined Security Weakness
Directory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. dot dot and null byte %00 in the id parameter of the read module...
FlatNuke index.php id Parameter Traversal Arbitrary File Access
The remote host is running FlatNuke, a content management system written in PHP and using flat files rather than a database for its storage. The version of FlatNuke installed on the remote host suffers fails to remove directory traversal sequences user input to the 'id' parameter of the 'index.ph...
Flatnuke 2.5.6 privilege escalation / remote commands execution exploit
?php ---flatnuke256xpl.php 4.32 10/12/2005 Flatnuke 2.5.6 privilege escalation / remote commands execution exploit works with magicquotesgpc off, try this with 2.5.5: http://www.milw0rm.com/id.php?id=1140 coded by rgod at http://rgod.altervista.org mail: retrogod at aliceposta it original advisor...
Flatnuke 2.5.6 - Privilege Escalation Remote Command Execution
Flatnuke 2.5.6 - Privilege Escalation Remote Command Execution ?php ---flatnuke256xpl.php 4.32 10/12/2005 Flatnuke 2.5.6 privilege escalation / remote commands execution exploit works with magicquotesgpc off, try this with 2.5.5: http://www.milw0rm.com/id.php?id=1140...
Flatnuke 2.5.6 - Privilege Escalation / Remote Command Execution
?php ---flatnuke256xpl.php 4.32 10/12/2005 Flatnuke 2.5.6 privilege escalation / remote commands execution exploit works with magicquotesgpc off, try this with 2.5.5: http://www.milw0rm.com/id.php?id=1140 https://www.exploit-db.com/exploits/1140/ coded by rgod at http://rgod.altervista.org mail:...
Flatnuke 2.5.6 Privilege Escalation / Remote Commands Execution Exploit
Exploit for unknown platform in category web applications ======================================================================= Flatnuke 2.5.6 Privilege Escalation / Remote Commands Execution Exploit ======================================================================= FlatNuke 2.5.5 remote...
Flatnuke 2.5.6 Privilege Escalation / Remote Commands Execution Exploit
No description provided by source. ?php ---flatnuke256xpl.php 4.32 10/12/2005 Flatnuke 2.5.6 privilege escalation / remote commands execution exploit works with magicquotesgpc off, try this with 2.5.5: http://www.milw0rm.com/id.php?id=1140 coded by rgod at http://rgod.altervista.org mail: retrogo...
CVE-2005-3361
Cross-site scripting XSS vulnerability in forum/index.php in FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the nome parameter in a login operation, a variant of CVE-2005-3306...
CVE-2005-3361
XSS in FlatNuke 2.5.6: forum/index.php vulnerable to script injection via the nome parameter in login operation. Remote attacker could inject arbitrary script/HTML. No remediation details provided in the documents.