CVE-2008-3603

SQL injection vulnerability in index.php in Vacation Rental Script 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a sections action...

Vacation Rental Script 'index.php' SQL注入漏洞

BUGTRAQ ID:30626 CNCAN ID：CNCAN-2008081206 Vacation Rental Script是一款基于PHP的WEB应用程序。 Vacation Rental Script不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息或操作数据库。 问题是由于'index.php'脚本不正确过滤"id"参数，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，可获得敏感信息或操作数据库。 vacationrentalscript.com Vacation Rentals Script 3.0 目前没有解决方案提供：...

CVE-2008-3603: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Vacation Rental Script 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a sections action...

CVE-2008-3601: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Quicksilver Forums 1.4.1 allows remote attackers to execute arbitrary SQL commands via the forums array parameter in a search action...

Sql injection

Multiple SQL injection vulnerabilities in phsBlog 0.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 eid parameter to comments.php, 2 cid parameter to index.php, and the 3 urltitle parameter to entries.php...

CVE-2008-3593: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in SyzygyCMS 0.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...

CVE-2008-3588: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in phsBlog 0.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 eid parameter to comments.php, 2 cid parameter to index.php, and the 3 urltitle parameter to entries.php...

CVE-2008-3564

The CVE-2008-3564 entry concerns multiple directory traversal flaws in Dayfox Blog 4’s index.php. The vulnerability allows remote attackers to include and execute arbitrary local files by manipulating the dot-dot sequences in the (1) p, (2) cat, and (3) archive parameters. In some environments th...

CVE-2008-3570

CVE-2008-3570 affects Africa Be Gone (ABG) 1.0a. The vulnerability is a PHP remote file inclusion in index.php exploited via the abg_path parameter, enabling an attacker to execute arbitrary PHP code by supplying a URL. The capabilites and impact are described in the NVD entry (base score 7.5, HI...

CVE-2008-3566

CVE-2008-3566 describes a cross-site scripting (XSS) vulnerability in ZoneO-soft freeForum 1.7. The issue allows remote attackers to inject arbitrary web script or HTML via the acuparam parameter to (1) the default URI, (2) index.php, or (3) the PATH_INFO to index.php. The available documents con...

CVE-2008-3566: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ZoneO-soft freeForum 1.7 allows remote attackers to inject arbitrary web script or HTML via the acuparam parameter to 1 the default URI or 2 index.php, or 3 the PATHINFO to index.php. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-3562: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in the Contact module in Chupix CMS 0.1.0, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the mods parameter. NOTE: the provenance of this information is unknown; the details...

CVE-2008-3570: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in Africa Be Gone ABG 1.0a allows remote attackers to execute arbitrary PHP code via a URL in the abgpath parameter...

CVE-2008-3564: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 p, 2 cat, and 3 archive parameters. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC...

CVE-2008-3572: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Pligg 9.9.5 allows remote attackers to inject arbitrary web script or HTML via the category parameter...

CVE-2008-3581: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Qsoft K-Links allows remote attackers to inject arbitrary web script or HTML via the loginmessage parameter in a login action...

CVE-2008-3556

Multiple SQL injection vulnerabilities in index.php in Battle.net Clan Script 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 showmember parameter in a members action and the 2 thread parameter in a board action. NOTE: vector 1 might be the same as CVE-2008-2522...

CVE-2008-3556

Multiple SQL injection vulnerabilities in index.php in Battle.net Clan Script 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 showmember parameter in a members action and the 2 thread parameter in a board action. NOTE: vector 1 might be the same as CVE-2008-2522...

CVE-2008-3556

CVE-2008-3556 covers multiple SQL injection vulnerabilities in index.php of Battle.net Clan Script 1.5.2. Exploitation targets include the showmember parameter in the members action and the thread parameter in the board action, enabling remote execution of arbitrary SQL commands. The entry notes ...

CVE-2008-3556: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in Battle.net Clan Script 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 showmember parameter in a members action and the 2 thread parameter in a board action. NOTE: vector 1 might be the same as CVE-2008-2522...