9379 matches found
Fusion SBX <= 1.2 Remote Command Execution Exploit
No description provided by source. / Fusion SBX = 1.2 exploit sileFSBXxpl This exploit use vulnerability found into Fusion SBX and create new variable and call it with a malicious function stored in config.php. This exploit utilize injection of three diverse procedures for execution of arbitrary...
Fusion SBX <= 1.2 Remote Command Execution Exploit
Exploit for unknown platform in category web applications ================================================== Fusion SBX = 1.2 Remote Command Execution Exploit ================================================== / Fusion SBX = 1.2 exploit sileFSBXxpl This exploit use vulnerability found into Fusion...
Fusion SBX 1.2 - Remote Command Execution
Fusion SBX 1.2 - Remote Command Execution / Fusion SBX include include include include include defi...
Fusion SBX 1.2 - Remote Command Execution
/ Fusion SBX include include include include include define PORT 80 // port of web server void inf...
Fusion News comments.php X-Forwarded-For HTTP Header Arbitrary Code Injection
The version of Fusion News installed on the remote host suffers from a flaw that allows a remote attacker to execute arbitrary PHP code subject to the privileges of the web server userid. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...
Fusion News v3.6.1 - remote shell exploit
? $copyr = " !!! PRIVATE !!! PRIVATE !!! PRIVATE !!! PRIVATE !!! PRIVATE !!! oooo...oooo.oooooooo8.ooooooooooo .8888o..88.888........88..888..88 .88.888o88..888oooooo.....888 .88...8888.........888....888 o88o....88.o88oooo888....o888o Network security team nst.void.ru Title: Fusion News v3.6.1...
[EXPL] Fusion SBX Remote Command Execution (Exploit 2)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
CVE-2005-1596
index.php in Fusion SBX 1.2 and earlier does not properly use the extract function, which allows remote attackers to bypass authentication by setting the islogged parameter or execute arbitrary code via the maxname2 parameter...
CVE-2005-1596
Fusion SBX 1.2 and earlier contain an authentication bypass and remote code execution vulnerability in index.php due to improper use of the extract function. By setting is_logged, an attacker can bypass authentication; by manipulating maxname2, arbitrary code may be executed. Affected versions ar...
CVE-2005-1596
index.php in Fusion SBX 1.2 and earlier does not properly use the extract function, which allows remote attackers to bypass authentication by setting the islogged parameter or execute arbitrary code via the maxname2 parameter...
CVE-2005-0829
Cross-site scripting XSS vulnerability in setuser.php of the Digitanium addon to PHP-Fusion 5.01 allows remote attackers to inject arbitrary web script or HTML via the 1 username or 2 userpass parameters...
CVE-2005-0345
viewthread.php in php-fusion 4.x does not check the 1 forumid or 2 forumcat parameters, which allows remote attackers to view protected forums via the threadid parameter...
CVE-2005-0829
The CVE-2005-0829 entry concerns a Cross-site scripting (XSS) vulnerability in the Digitanium addon to PHP-Fusion 5.01, specifically in setuser.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the user_name or user_pass parameters. Based on the provided do...
CVE-2005-0829
Cross-site scripting XSS vulnerability in setuser.php of the Digitanium addon to PHP-Fusion 5.01 allows remote attackers to inject arbitrary web script or HTML via the 1 username or 2 userpass parameters...
phpFusion501.txt
Note added to this advisory - This is not part of PHP Fusion v5.01 This is an available mod addon supplied by the main developer Digitanium for an IIS Compatibility. This setuser.php will not implemented into PHP Fusion until v5.02 and is not mainstream accross the fusion community. I have notifi...
PHP-Fusion < 5.0.2 setuser.php HTML Injection Vulnerability
Binary data 2726.prm...
[PersianHacker.NET 200503-10]PHP-Fusion v5.01 Html Injection Vulnerability
PersianHacker.NET 200503-10PHP-Fusion v5.01 Html Injection Vulnerability Date: 2005 March Bug Number: 10 PHP-Fusion a light-weight open-source content management system CMS written in PHP. It utilises a mySQL database to store your site content and includes a simple, comprehensive adminstration...
PHP-Fusion 45 - Setuser.php HTML Injection
PHP-Fusion 45 - Setuser.php HTML Injection source: https://www.securityfocus.com/bid/12853/info PHP-Fusion is reportedly affected by a HTML injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input passed to the 'setuser.php' script before usin...
PHP-Fusion 4/5 - 'Setuser.php' HTML Injection
source: https://www.securityfocus.com/bid/12853/info PHP-Fusion is reportedly affected by a HTML injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input passed to the 'setuser.php' script before using it in dynamically generated content. This...
phpfusionXSS.txt
I found an exploit in the current version of php-fusion which allows you to input XSS in the IMG tag. I reported it already to php-fusion and they created a fix for this. Here it goes: By converting the text ie. javascript:alert'test' to their ascii values, the strings between the img/img tags...