CVE-2006-1666

SQL injection vulnerability in forum.php in Arab Portal 2.0.1 stable allows remote attackers to execute arbitrary SQL commands via the mineID parameter...

CVE-2006-1666

CVE-2006-1666 describes a SQL injection vulnerability in the forum.php component of Arab Portal 2.0.1 stable. The issue allows remote attackers to inject and execute arbitrary SQL commands through the mineID parameter. The NVD entry lists a CVSS v2 base score of 7.5 (HIGH), with network attack ve...

Design/Logic Flaw

PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the incstat parameter, a different vulnerability than CVE-2006-0076. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2006-0094

PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the incstat parameter, a different vulnerability than CVE-2006-0076. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2006-0094

PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the incstat parameter, a different vulnerability than CVE-2006-0076. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Remote file inclusion

PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter...

CVE-2006-0076

This CVE (CVE-2006-0076) relates to oaBoard 1.0: a PHP remote file inclusion flaw in forum.php where an input parameter inc can be controlled via URL to include a PHP file. The underlying issue is unsafely including external input as code, enabling arbitrary PHP execution if a remote file is incl...

CVE-2005-4218

PHPWebThings 1.4 is affected by a SQL injection in forum.php via the msg parameter. The root cause is improper input sanitization in the forum.php handler, enabling an attacker to modify or exfiltrate data through crafted SQL. OpenVAS note indicates that remote attackers could potentially access ...

CVE-2005-3872

The CVE-2005-3872 entries describe multiple SQL injection vulnerabilities in Ugroup 2.6.2 and earlier. The flaws allow remote attackers to execute arbitrary SQL commands through parameters in forum.php (FORUM_ID) and topic.php (TOPIC_ID, FORUM_ID, CAT_ID). Affected software: Ugroup 2.6.2 and earl...

Ugroup 2.6.2 SQL inj. vuln.

Ugroup 2.6.2 SQL inj. vuln. Vuln. dicovered by : r0t Date: 28 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/ugroup-262-sql-inj-vuln.html Vendor:http://www.realsoftstudio.com/Ugroup/ affected version:2.6.2 and prior Product Description: A Software discussion platform written in PH...

UGroup 2.6.2 - 'forum.php?FORUM_ID' SQL Injection

source: https://www.securityfocus.com/bid/15591/info UGroup is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

UGroup 2.6.2 - forum.php?FORUM_ID SQL Injection

UGroup 2.6.2 - forum.php?FORUMID SQL Injection source: https://www.securityfocus.com/bid/15591/info UGroup is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

CVE-2005-3816

Multiple SQL injection vulnerabilities in forum.php in freeForum 1.1 and earlier and earlier allow remote attackers to execute arbitrary SQL commands via the 1 cat parameter or 2 thread parameter in thread mode...

CVE-2005-3816

CVE-2005-3816 describes multiple SQL injection vulnerabilities in freeForum 1.1 and earlier, exploitable via the cat or thread parameters in thread mode, allowing remote execution of arbitrary SQL commands. Affected product: freeForum (forum.php). Root cause: insufficient input handling leading t...

CVE-2005-3815

CVE-2005-3815 affects Orca Forum 4.3b and earlier, where a SQL injection flaw in forum.php (msg parameter) allows remote attackers to execute arbitrary SQL commands. The vulnerability is confirmed in multiple sources (NVD/CVE records). The available documents do not specify a remediation or patch...

freeForum 1.x "cat" "thread" SQL inj.

freeForum 1.x "cat" "thread" SQL inj. Vuln. dicovered by : r0t Date: 23 nov. 2005 Orginal advsiory:http://pridels.blogspot.com/2005/11/freeforum-1x-cat-and-thread-sql-inj.html Vendor:http://soft.zoneo.net/freeForum/ affected version: 1.1 and prior Vuln. description: Input passed to the "cat" and...

CVE-2005-3686

CVE-2005-3686 describes an SQL injection vulnerability in the Unclassified NewsBoard (UNB) product. The issue resides in the search.inc.php component and is exploitable via the forum.php path using the (1) DateFrom or (2) DateUntil parameters. The root cause is improper handling of user-supplied ...

CVE-2005-3585

The connected OpenVAS entries confirm a concrete SQL injection in PhpWebThings 1.4.x through forum.php (parameter: forum). Exploitation could allow remote attackers to view usernames/password hashes and potentially gain administrative access; root cause is improper input sanitization in the forum...

CVE-2005-3584

Cross-site scripting XSS vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to inject arbitrary web script or HTML via the forum parameter...

phpWebThings144.txt

Vulnerable: phpWebThings 1.4.4 http://phpwebthings.org The bug reside in : forum.php Exploit : http://xxx.com/forum.php?forum=XSS http://xxx.com/forum.php?forum=SQL Example : XSS http://xxx.com/forum.php?forum='alertdocument.cookie SQL For Passowrd http://xxx.com/forum.php?forum=-1 union select...