Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Fusebox Framework: crossite scripting...

CVE-2008-2284

PHP remote file inclusion vulnerability in fusebox5.php in Fusebox 5.5.1 allows remote attackers to execute arbitrary PHP code via a URL in the FUSEBOXAPPLICATIONPATH parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-2284

CVE-2008-2284 describes a PHP remote file inclusion in Fusebox 5.5.1 (Fusebox 5.x) where an attacker can cause arbitrary PHP execution by supplying a URL to the FUSEBOX_APPLICATION_PATH parameter. Root cause: improper handling of user-supplied URLs enabling remote file inclusion. Documented impac...

CVE-2008-2284

PHP remote file inclusion vulnerability in fusebox5.php in Fusebox 5.5.1 allows remote attackers to execute arbitrary PHP code via a URL in the FUSEBOXAPPLICATIONPATH parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Fusebox 5.5.1 - fusebox5.php Remote File Inclusion

Fusebox 5.5.1 - fusebox5.php Remote File Inclusion source: https://www.securityfocus.com/bid/29163/info Fusebox is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue can allow an attacker to compromise the application a...

Fusebox 5.5.1 - 'fusebox5.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/29163/info Fusebox is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks are also...

Cross site scripting

Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter...

CVE-2006-0242

Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter...

CVE-2006-0242

CVE-2006-0242 corresponds to a Cross-site scripting vulnerability in PHP Fusebox 4.0.6, affecting index.php where the fuseaction parameter can be used to inject arbitrary web script or HTML. The vulnerability is triggered remotely via the fuseaction parameter, enabling partial confidentiality and...

CVE-2006-0242

Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter...

IndonesiaHack Advisory HTML injection in PHP Fusebox

site:www.phpxplorer.org ------------------------------------------------ http://victim/folder/system/action.php?sShare=guest&sAction=../../../../../../../../../../../../etc/passwd00 ------------------------------------------------- example:...

PHP Fusebox 3.0 - index.php Cross-Site Scripting

PHP Fusebox 3.0 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/15924/info PHP Fusebox is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to ha...

PHP Fusebox 3.0 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/15924/info PHP Fusebox is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser ...

CVE-2005-2480

Cross-site scripting XSS vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm...

CVE-2005-2480

The CVE-2005-2480 entry concerns Fusebox running on ColdFusion (Fusebox 4.1.0). The vulnerability is a cross-site scripting (XSS) flaw where the fuseaction parameter is not quoted in an error page, enabling an attacker to inject arbitrary script/HTML (demonstrated via index.cfm). Connected docume...

CVE-2005-2481

ColdFusion Fusebox 4.1.0 allows remote attackers to obtain sensitive information via an invalid fuseaction parameter, which leaks the full server path in an error message, as demonstrated using the "?" question mark character...

CVE-2005-2481

ColdFusion Fusebox 4.1.0 allows remote attackers to obtain sensitive information via an invalid fuseaction parameter, which leaks the full server path in an error message, as demonstrated using the "?" question mark character...

CVE-2005-2481

CVE-2005-2481 affects ColdFusion Fusebox 4.1.0. The issue is that a malformed or invalid fuseaction parameter allows remote attackers to cause an error message that leaks the full server path. Documents confirm the affected product and the nature of the information disclosure, but do not provide ...

fuseXSS.txt

This was discovered by myself over the weekend. I cant find out what versions of fusebox this vulnerability is in but seeing as it affects the main fusebox page I can only assume it is the latest v4.1.0 and possibly some older versions. According to the Fusebox site, What is Fusebox? Fusebox is a...

Fusebox index.cfm fuseaction Parameter XSS

The remote host is running Fusebox, a framework for building web-based applications in Cold Fusion and PHP. The installed web application appears to have been created using Fusebox in such a way that it fails to sanitize user-supplied input to the 'fuseaction' parameter before using it in...