85 matches found
CVE-2008-6013: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Freeway before 1.4.3.210 allow remote attackers to execute arbitrary SQL commands via unspecified vectors involving the 1 advanced search result and 2 service resource pages...
CVE-2008-3841
Cross-site scripting XSS vulnerability in admin/searchlinks.php in Freeway eCommerce 1.4.1.171 allows remote attackers to inject arbitrary web script or HTML via the searchlink parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/searchlinks.php in Freeway eCommerce 1.4.1.171 allows remote attackers to inject arbitrary web script or HTML via the searchlink parameter...
CVE-2008-3841
Cross-site scripting XSS vulnerability in admin/searchlinks.php in Freeway eCommerce 1.4.1.171 allows remote attackers to inject arbitrary web script or HTML via the searchlink parameter...
CVE-2008-3841
Technical details about CVE-2008-3841 are not publicly available in the provided connected documents. The initial description notes an XSS in Freeway eCommerce 1.4.1.171, but no vendor/versions/impact/fix are elaborated here. Monitor for updates.
CVE-2008-3841: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin/searchlinks.php in Freeway eCommerce 1.4.1.171 allows remote attackers to inject arbitrary web script or HTML via the searchlink parameter...
Remote file inclusion
PHP remote file inclusion vulnerability in admin/createordernew.php in Freeway 1.4.1.171, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includepage parameter...
CVE-2008-3769
PHP remote file inclusion vulnerability in admin/createordernew.php in Freeway 1.4.1.171, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includepage parameter...
CVE-2008-3770
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 includes/eventsapplicationtop.php; 2 english/account.php, 3 french/account.php, a...
Directory traversal
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 includes/eventsapplicationtop.php; 2 english/account.php, 3 french/account.php, a...
CVE-2008-3769
PHP remote file inclusion vulnerability in admin/createordernew.php in Freeway 1.4.1.171, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includepage parameter...
CVE-2008-3770
Summary: CVE-2008-3770 and related entries describe directory traversal in Freeway. The connected records confirm that vulnerable components include Freeway before 1.4.2.197 (and for CVE-2008-3770, Freeway 1.4.1.171) and involve includes/languages and templates where a crafted language parameter ...
CVE-2008-3769
CVE-2008-3769 describes a PHP remote file inclusion vulnerability in Freeway 1.4.1.171, specifically in admin/create_order_new.php. When register_globals is enabled, an attacker can supply a URL in the include_page parameter to cause the application to include remote PHP code, enabling arbitrary ...
CVE-2008-3770
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 includes/eventsapplicationtop.php; 2 english/account.php, 3 french/account.php, a...
CVE-2008-3770: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 includes/eventsapplicationtop.php; 2 english/account.php, 3 french/account.php, a...
CVE-2008-3769: Improper Control of Generation of Code
PHP remote file inclusion vulnerability in admin/createordernew.php in Freeway 1.4.1.171, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includepage parameter...
DSECRG-08-036.txt
Digital Security Research Group DSecRG Advisory DSECRG-08-036 Application: Freeway eCommerce Versions Affected: 1.4.1.171 Vendor URL: http://www.openfreeway.org/ Bugs: RFI, Multiple LFI, XSS Exploits: YES Reported: 27.06.2008 Second report: 04.07.2008 Vendor response: 06.07.2008 Solution: YES Dat...
Freeway 1.4.1.171 - templatesFreewayboxesloginbox.php?language Traversal Local File Inclusion
Freeway 1.4.1.171 - templatesFreewayboxesloginbox.php?language Traversal Local File Inclusion source: https://www.securityfocus.com/bid/30731/info Freeway is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit the...
Freeway 1.4.1.171 - templatesFreewaymainpage_modulesmainpage.php?language Traversal Local File Inclusion
Freeway 1.4.1.171 - templatesFreewaymainpagemodulesmainpage.php?language Traversal Local File Inclusion source: https://www.securityfocus.com/bid/30731/info Freeway is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can...
Freeway 1.4.1.171 - frenchaccount_newsletters.php?language Traversal Local File Inclusion
Freeway 1.4.1.171 - frenchaccountnewsletters.php?language Traversal Local File Inclusion source: https://www.securityfocus.com/bid/30731/info Freeway is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these...