SimplePHPBlog Hacking

How to hack a server with Simple PHP Blog uploading an htacess file from imguploadcgi.php page. Tested on v0.4.9 by Demential http://www.hackish.eu mailto: [email protected] video here: http://hackish.eu/video/phpblog.avi vlc download: http://www.videolan.org/vlc/...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Streamline PHP Media Server 1.0-beta4 allow remote attackers to execute arbitrary PHP code via a URL in the slthemeunixpath parameter to 1 adminfooter.php, 2 infofooter.php, 3 themefooter.php, 4 browsefooter.php, 5 accountfooter.php, or 6...

CVE-2007-5015

CVE-2007-5015 affects Streamline PHP Media Server 1.0-beta4. The vulnerability is a set of remote file inclusion flaws in the core/theme/includes/ footer files (admin_footer.php, info_footer.php, theme_footer.php, browse_footer.php, account_footer.php, search_footer.php) that can be triggered via...

CVE-2007-4948

Multiple PHP remote file inclusion vulnerabilities in Webmedia Explorer webmex 3.2.2 allow remote attackers to execute arbitrary PHP code via 1 a URL in the pathinclude parameter to includes/rss.class.php, 2 a URL in the pathtemplate parameter to a templates/main.tpl.php or b...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Webmedia Explorer webmex 3.2.2 allow remote attackers to execute arbitrary PHP code via 1 a URL in the pathinclude parameter to includes/rss.class.php, 2 a URL in the pathtemplate parameter to a templates/main.tpl.php or b...

cPanel 10.9.1 XSS

Aria-Security Team cPanel 10.9.1 XSS /frontend/x/htaccess/changepro.html?protected=1&resname=XSSGOESHERE click on Go Back... Voila! Credits: Aria-Security Team http://aria-security.net http://outlaw.aria-security.info...

Authentication flaw

MySQLDumper 1.21b through 1.23 REV227 uses a "Limit GET" statement in the .htaccess authentication mechanism, which allows remote attackers to bypass authentication requirements via HTTP POST requests...

MySQLDumper Apache访问控制验证绕过漏洞

MySQLDumper是一款备份MySQL数据库的备份脚本。 在Apache访问控制文件中存在配置错误，远程攻击者可以利用漏洞绕过验证删除Apache的访问控制文件，获得对保护文件的访问。 由于MySQLDumper包含的main.php对用户提交的 HTTP POST请求缺少验证，攻击者可以利用漏洞删除.htaccess/.htpasswd文件，访问受保护的文件信息。 MySQLDumper MySQLDumper Typo3-Extension 0.0.5 MySQLDumper MySQLDumper 1.23prereleaseREV MySQLDumper MySQLDumpe...

MySQLDumper vulnerability: Bypassing Apache based access control possible

A critical security issue has been found in the Open Source PHP backup tool MySQLDumper 0. The issue allows to bypass an Apache based access control created with MySQLDumper. Through this an attacker can easily gain full control about all features of MySQLDumper. The authors of MySQLDumper were...

CVE-2007-3378

The 1 sessionsavepath, 2 iniset, and 3 errorlog functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safemode and openbasedir restrictions and possibly execute arbitrary commands, as demonstrated using a phpvalue, b...

CVE-2007-3378

The 1 sessionsavepath, 2 iniset, and 3 errorlog functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safemode and openbasedir restrictions and possibly execute arbitrary commands, as demonstrated using a phpvalue, b...

Design/Logic Flaw

The 1 sessionsavepath, 2 iniset, and 3 errorlog functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safemode and openbasedir restrictions and possibly execute arbitrary commands, as demonstrated using a phpvalue, b...

CVE-2007-3378

CVE-2007-3378 affects PHP 4.4.7 and earlier and PHP 5.2.3 and earlier, when processed via .htaccess. The vulnerability allows remote attackers to bypass safe_mode and open_basedir restrictions and potentially execute arbitrary commands via directives like php_value/php_flag in .htaccess. Connecte...

CVE-2007-3378

The 1 sessionsavepath, 2 iniset, and 3 errorlog functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safemode and openbasedir restrictions and possibly execute arbitrary commands, as demonstrated using a phpvalue, b...

PHP .Htaccess Safe_Mode和Open_Basedir限制绕过漏洞

BUGTRAQ ID: 24661 CVE ID:CVE-2007-3378 CNCVE ID:CNCVE-20073378 PHP是一款广泛使用的WEB开发脚本语言。 PHP存在'safemode'和'openbasedir'限制绕过问题，远程攻击者可以利用漏洞写文件到未授权系统位置。 当使用PHP作为Apache模块，可以通过在.htaccess文件中使用指示进行培植二十时亿兆时毫...

Remote file inclusion

PHP remote file inclusion vulnerability in saf/lib/PEAR/PhpDocumentor/Documentation/tests/bug-559668.php in Sitellite CMS 4.2.12 and earlier might allow remote attackers to execute arbitrary PHP code via a URL in the FORUMLIB parameter. NOTE: by default, access to the PhpDocumentor directory tree...

Directory traversal

Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings, and execute arbitrary PHP local files or read arbitrary local templates, via a .. dot dot in a lang cookie, followed by a filename without its .php extension, as demonstrated via a...

CVE-2007-0609

Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings, and execute arbitrary PHP local files or read arbitrary local templates, via a .. dot dot in a lang cookie, followed by a filename without its .php extension, as demonstrated via a...

CVE-2007-0609

Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings, and execute arbitrary PHP local files or read arbitrary local templates, via a .. dot dot in a lang cookie, followed by a filename without its .php extension, as demonstrated via a...

shoutpro-pwn.txt

?php echo "\n"; echo " Special Greetings To - Timq,Warpboy,The-Maggot \n"; echo "\n\n\n"; //Writes Files - Under 100 bytes to meet requireme...