Gregarius ajax.php rsargs[] Parameter Array SQL Injection

The remote host is running Gregarius, a web-based RSS / RDF / ATOM feed aggregator written in PHP. The version of Gregarius installed on the remote host fails to sanitize user-supplied input to the 'rsargs' parameter array of the 'ajax.php' script before using it in a database query. An...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Gregarius 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 rssquery parameter to search.php or 2 tag parameter to tags.php...

Sql injection

Multiple SQL injection vulnerabilities in Gregarius 0.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 folder parameter to feed.php or 2 rssquery parameter to search.php...

CVE-2006-1042

Multiple SQL injection vulnerabilities in Gregarius 0.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 folder parameter to feed.php or 2 rssquery parameter to search.php...

CVE-2006-1041

Multiple cross-site scripting XSS vulnerabilities in Gregarius 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 rssquery parameter to search.php or 2 tag parameter to tags.php...

CVE-2006-1041

CVE-2006-1041 affects Gregarius 0.5.2 with multiple cross-site scripting (XSS) vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML via the following parameters: (1) rss_query in search.php and (2) tag in tags.php. The reports indicate XSS could enable executi...

CVE-2006-1042

CVE-2006-1042 affects Gregarius 0.5.2. The vulnerability is a SQL injection in the web UI, exploitable via the 1) folder parameter to feed.php or 2) rss_query parameter to search.php, enabling remote attackers to execute arbitrary SQL commands. The provided sources describe multiple SQL injection...

CVE-2006-1041

Multiple cross-site scripting XSS vulnerabilities in Gregarius 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 rssquery parameter to search.php or 2 tag parameter to tags.php...

CVE-2006-1042

Multiple SQL injection vulnerabilities in Gregarius 0.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 folder parameter to feed.php or 2 rssquery parameter to search.php...

CVE-2006-1041: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Gregarius 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 rssquery parameter to search.php or 2 tag parameter to tags.php...

CVE-2006-1042: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Gregarius 0.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 folder parameter to feed.php or 2 rssquery parameter to search.php...

gregariusXSSSQL.txt

http://gregarius.net/ Gregarius is a web-based RSS/RDF/ATOM feed aggregator, designed to run on your web server, allowing you to access your news sources from wherever you want. XSS in search.php: search.php?rssquery=alert1&rssquerymatch=exact XSS in tags.php: tags.php?tag=alert1 SQL Injection in...

Gregarius 0.5.2 XSS and SQL Injection Vulnerabilities

http://gregarius.net/ Gregarius is a web-based RSS/RDF/ATOM feed aggregator, designed to run on your web server, allowing you to access your news sources from wherever you want. XSS in search.php: search.php?rssquery=scriptalert1/script&rssquerymatch=exact XSS in tags.php:...