BASE base_qry_common.php file include

Added: 06/23/2006 CVE: CVE-2006-2685 BID: 18298 OSVDB: 25770 Background Snort is an open-source intrusion detection system. The Basic Analysis and Security Engine BASE is a web interface for analyzing Snort results. Problem If the registerglobals PHP option is enabled, the baseqrycommon.php scrip...

PT-2006-3973 · Unknown · Doublespeak

Name of the Vulnerable Software and Affected Versions: DoubleSpeak version 0.1 Description: The issue allows remote attackers to execute arbitrary PHP code via the configprivate parameter in multiple files, such as "index.php", "faq.php", and "hardware.php", when register globals is enabled...

Docebo Kms 3.0.3, Remote command execution

----------------------------------------------------- Advisory id: FSA:009 Author: Federico Fazzi Date: 09/06/2006, 7:09 Sinthesis: Docebo Kms 3.0.3, Remote command execution Type: high Product: http://www.docebolms.org/ Patch: unavailable ----------------------------------------------------- 1...

[MajorSecurity #8]DreamAccount <= 3.1 - Remote File Include Vulnerability

MajorSecurity 8DreamAccount = 3.1 - Remote File Include Vulnerability ------------------------------------------------------------------------- Software: DreamAccount Version: =3.1 Type: Remote File Include Vulnerability Date: June, 3rd 2006 Vendor: dreamcost Page: http://dreamcost.com Risc: High...

PT-2006-3760 · Squirrelmail +1 · Squirrelmail +1

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions 1.4.6 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter, under specific conditions where register globals is enabled and magic quotes gpc is...

Claroline Multiple Script includePath Parameter Remote File Inclusion

The remote host is running Claroline, an open source, web-based, collaborative learning environment written in PHP. The version of Claroline installed on the remote host fails to sanitize input to the 'includePath' parameter before using it to include PHP code in the...

DotClear <= 1.2.4 (prepend.php) Arbitrary Remote Inclusion Exploit

Exploit for unknown platform in category web applications ================================================================== DotClear = 1.2.4 prepend.php Arbitrary Remote Inclusion Exploit ================================================================== !/usr/bin/php -q -d shortopentag=on ? ech...

Remote file inclusion

PHP remote file inclusion vulnerability in Ottoman 1.1.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the defaultpath parameter in 1 error.php, 2 index.php, and 3 classes/mainclass.php...

Remote file inclusion

PHP remote file inclusion vulnerability in METAjour 2.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the 1 systempath parameter in a large number of files in the a app/edocument/, b app/eproject/, c app/erek/, and d extension/ directories, and the 2...

CVE-2006-2767

PHP remote file inclusion vulnerability in Ottoman 1.1.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the defaultpath parameter in 1 error.php, 2 index.php, and 3 classes/mainclass.php...

CVE-2006-2730

PHP remote file inclusion vulnerability in admin/libactionstep.php in Hot Open Tickets HOT 11012004ver2f, when registerglobals is enabled, allows remote attackers to include arbitrary files via the GLOBALSCLASSPATH parameter. NOTE: this issue might be resultant from a global overwrite vulnerabili...

CVE-2006-2730

PHP remote file inclusion vulnerability in admin/libactionstep.php in Hot Open Tickets HOT 11012004ver2f, when registerglobals is enabled, allows remote attackers to include arbitrary files via the GLOBALSCLASSPATH parameter. NOTE: this issue might be resultant from a global overwrite vulnerabili...

Remote file inclusion

PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSAAINCPATH parameter in 1 cached.php3, 2 cron.php3, 3 discussion.php3, 4 filldisc.php3, 5 filler.php3, 6 fillform.php3, 7 go.php3, 8 hiercons.php3, 9...

CVE-2006-2681

CVE-2006-2681 describes a PHP remote file inclusion in SocketMail Lite and Pro 2.2.6 and earlier. When both register_globals and magic_quotes are enabled, an attacker can supply a URL in the site_path parameter to (1) index.php or (2) inc-common.php to execute arbitrary PHP code on the server. Th...

Activity MOD Plus 1.1.0 - &#039;phpBB Mod&#039; File Inclusion

phpBB 2.x Activity MOD Plus File Inclusion Vulnerability Contacts ICQ: 10072 MSN/Mail: [email protected] web: www.nukedx.com This exploits works on phpBB 2.x Activity MOD Plus Original advisory can be found at: http://www.nukedx.com/?viewdoc=38 Succesful exploitation needs registerglobals on GET ...

UBB.threads addpost_newpoll.php thispath Parameter Remote File Inclusion

The version of UBB.threads installed on the remote host fails to sanitize input to the 'thispath' parameter before using it in a PHP include function in the 'addpostnewpoll.php' script. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated attacker may be able to exploit this fl...

CVE-2006-2583

CVE-2006-2583 is a PHP remote file inclusion vulnerability in Nucleus CMS (affected: Nucleus 3.22 and earlier). It allows remote attackers to execute arbitrary PHP code by supplying a URL via the GLOBALS[DIR_LIBS] parameter in nucleus/libs/PLUGINADMIN.php. Related records note this as a reproduci...

CVE-2006-2570

PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS"CLPath" parameter to 1 reconfig.php and 2 srxclr.php. NOTE: this might be due to a globals overwrite issue...

CVE-2006-2578

admin/cron.php in eSyndicat Directory 1.2, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to include arbitrary files and possibly execute arbitrary PHP code via a null-terminated value in the pathtoconfig parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in 1 GLOBALSwhereframework to a lib.simplesel.php, b lib.filelist.php, c tree.documents.php, d lib.repo.php, and e lib.ph...