Pie Web M{a,e}sher 0.5.3 - Multiple Remote File Inclusion Vulnerability

No description provided by source. =========================================================================================== o Pie Web Ma,esher 0.5.3 Multiple Remote File Inclusion Vulnerability Software : Pie Web Ma,esher version 0.5.3 Vendor : http://pie.ekkaia.org/ Download :...

WordPress cache_lastpostdate Arbitrary Code Execution

No description provided by source. $Id: phpwordpresslastpost.rb 9671 2010-07-03 06:21:31Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and term...

MyNews 4.2.2 Week_Events.PHP Remote File Include Vulnerability

No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register import re class TestPOCPOCBase: vulID = '83309' ssvid version = '1.0' author = 'kikay' vulDate = '2007-04-12' createDate ...

ezContents 2.0.3 review_summary.php GLOBALS[admin_home] Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/19776/info ezContents is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote fi...

WHMCS 5.2.8 – SQL Injection Vulnerability-vulnerability warning-the black bar safety net

Google Dork: "powered by WHMCS" Exploit Author: g00n Xploiter.net Vendor Homepage: http://www.whmcs.com/ Software Link: http://www.whmcs.com/ Version: 5.2.8 Tested on: Windows, Linux Vulnerable file: /includes/dbfunctions.php POC: selectquery function is vulnerable due to Register Globals Example...

WHMCompleteSolution (WHMCS) 5.2.8 - SQL Injection

WHMCompleteSolution WHMCS 5.2.8 - SQL Injection Exploit Title: WHMCS 5.2.8 SQL Injection Google Dork: "powered by WHMCS" Date: 10/18/2013 Exploit Author: g00n Xploiter.net Vendor Homepage: http://www.whmcs.com/ Software Link: http://www.whmcs.com/ Version: 5.2.8 Tested on: Windows, Linux Vulnerab...

WHMCompleteSolution (WHMCS) 5.2.8 - SQL Injection

Exploit Title: WHMCS 5.2.8 SQL Injection Google Dork: "powered by WHMCS" Date: 10/18/2013 Exploit Author: g00n Xploiter.net Vendor Homepage: http://www.whmcs.com/ Software Link: http://www.whmcs.com/ Version: 5.2.8 Tested on: Windows, Linux Vulnerable file: /includes/dbfunctions.php POC:...

phpMyAdmin <= 4.0.4.1 import.php GLOBALS变量注入漏洞

CVECAN ID: CVE-2013-4729 phpmyadmin是MySQL数据库的在线管理工具，主要功能包括在线创建数据表、运行SQL语句、搜索查询数据以及导入导出数据等。 phpMyAdmin 4.0.4.1之前版本内的import.php没有正确限制文件格式定义数据输入权限，可使经过身份验证的远程用户修改GLOBALS超级全局数组，然后通过特制的请求更改配置。 0 phpMyAdmin = 4.0.4.1 厂商补丁： phpMyAdmin ---------- phpMyAdmin已经为此发布了一个安全公告（PMASA-2013-7）以及相应补丁:...

phpMyAdmin 4.x < 4.0.4.1 import.php GLOBALS Variable Injection Configuration Parameter Manipulation (PMASA-2013-7)

According to its self-identified version number, the phpMyAdmin 4.x install hosted on the remote web server is earlier than 4.0.4.1 and, therefore, contains a flaw where the 'import.php' script does not properly sanitize input. This could allow attackers to inject arbitrary GLOBALS variables and...

CVE-2013-4729

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...

DEBIAN-CVE-2013-4729

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...

CVE-2013-4729

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...

CVE-2013-4729

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...

phpMyAdmin -- Global variable scope injection

The phpMyAdmin development team reports: The import.php script was vulnerable to GLOBALS variable injection. Therefore, an attacker could manipulate any configuration parameter. This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents...

Global variable scope injection.

PMASA-2013-7 Announcement-ID: PMASA-2013-7 Date: 2013-06-30 Updated: 2013-07-01 Summary Global variable scope injection. Description The import.php script was vulnerable to GLOBALS variable injection. Therefore, an attacker could manipulate any configuration parameter. Severity We consider this...

phpMyAdmin '$GLOBALS' 数组未授权访问漏洞(CVE-2013-3241)

BUGTRAQ ID: 59461 CVECAN ID: CVE-2013-3241 phpmyadmin是MySQL数据库的在线管理工具，主要功能包括在线创建数据表、运行SQL语句、搜索查询数据以及导入导出数据等。 phpMyAdmin 4.0.0-rc3之前版本内的export.php根据POST超全局数组的内容覆盖了全局变量，经过身份验证的远程用户通过特制的请求利用此漏洞注入任意值。 Php script "export.php" line 20: ------------------------ source code start...

[祝PKAV以及wooyun所有白帽子元旦快乐]anwsion缺陷大结合.

简要描述： foreach处理不当爆路径,程序设置缺陷,绕过全局变量的包含----变量覆盖 详细说明： 1.foreach处理不当爆路径 http://wenda.anwsion.com/search/ajax/searchresult/ 缺陷: searchresult AS $key = $val 代码没有检测$this-searchresult是否为空,是否没数组.... \wenda\views\default\inbox\readmessage.tpl.htm list AS $key = $val 缺陷一样. 2程序设置缺陷...

CVE-2011-5130

dev/less.php in Family Connections CMS FCMS 2.5.0 - 2.7.1, when registerglobals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv1 parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSgcampsiteDir parameter to 1 include/phorumload.php, 2 conf/installconf.php, or 3...

CVE-2012-1933

Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSgcampsiteDir parameter to 1 include/phorumload.php, 2 conf/installconf.php, or 3...