PT-2007-1947 · Freeforum · Freeforum

Name of the Vulnerable Software and Affected Versions: FreeForum version 0.9.0 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter in the index.php file. However, this issue has been disputed by third-party researchers, stating that the...

freeforum090-rfi.txt

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% FreeForum 0.9.0 =- index.php fpath Remote File Include Vulnerability Script: FreeForum Version: 0.9.0 URL: http://www.phpfreaks.com/scripts.php?action=gotoDownload&scriptid=616 Found By : BorN To K!LL %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Bug in : index.php...

FreeForum 0.9.0 <=- (index.php fpath) Remote File Include Vulnerability

FreeForum 0.9.0 =- index.php fpath Remote File Include Vulnerability Script: FreeForum Version: 0.9.0 URL: http://www.phpfreaks.com/scripts.php?action=gotoDownload&scriptid=616 Found By : BorN To K!LL Bug in : index.php code : include"$fpath/forum.php"; Explo!T :. ^^^^^ /index.php?fpath=SHe1L-CoD...

Advanced Guestbook <=- 2.4.2 (include_path) Remote File Include Vulnerability

Advanced Guestbook =- 2.4.2 includepath Remote File Include Vulnerability Script: Advanced Guestbook Version: 2.4.2 URL: http://proxy2.de/js/dl86d7a2.php Found By : BorN To K!LL Bug in : index.php , addentry.php , picture.php code :. requireonce $includepath."/admin/config.inc.php"; requireonce...

CVE-2007-0399: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in index.php in Simple Machines Forum SMF 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 recipient or 2 BCC field when selecting send in a pm action...

Mafia Scum Tools 2.0.0 (index.php gen) Remote File Include Exploit

No description provided by source. !/usr/bin/perl mafia-2-0-0 Index.phpRemote File Include Vulnerability &n...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in sabros.us 1.7 allows remote attackers to inject arbitrary web script or HTML via the tag parameter...

CVE-2007-0390

Cross-site scripting XSS vulnerability in index.php in sabros.us 1.7 allows remote attackers to inject arbitrary web script or HTML via the tag parameter...

Sql injection

Multiple SQL injection vulnerabilities in a index.php and b dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 ps, 2 us, 3 f, or 4 code parameter. NOTE: the us vector in index.php is already covered by CVE-2007-0346...

CVE-2007-0350

CVE-2007-0350 describes multiple SQL injection vulnerabilities in SmE FileMailer 1.21 and earlier, affecting index.php and dl.php. The flaw allows remote attackers to inject SQL via the (1) ps, (2) us, (3) f, or (4) code parameters, with the us parameter in index.php already covered by CVE-2007-0...

CVE-2006-6941

index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action parameter in an info operation, which discloses the path in an error message...

CVE-2007-0360: Undefined Security Weakness

PHP remote file inclusion vulnerability in lang/index.php in Oreon 1.2.3 RC4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the file parameter...

CVE-2007-0370: Undefined Security Weakness

Unrestricted file upload vulnerability in index.php in phpBP RC3 2.204 and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an imageform parameter specifying a multiple-extension filename...

CVE-2007-0390: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in sabros.us 1.7 allows remote attackers to inject arbitrary web script or HTML via the tag parameter...

CVE-2007-0385: Undefined Security Weakness

The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information the full path via "unvalidated output" in FAQ/index.php, possibly involving an undefined idcat variable...

CVE-2007-0350: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in a index.php and b dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 ps, 2 us, 3 f, or 4 code parameter. NOTE: the us vector in index.php is already covered by CVE-2007-0346...

CVE-2006-6941: Undefined Security Weakness

index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action parameter in an info operation, which discloses the path in an error message...

CVE-2007-0353: Undefined Security Weakness

Cross-site scripting XSS vulnerability in 1 index.php and 2 login.php in myBloggie 2.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO string...

CVE-2007-0372: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...

CVE-2007-0346

CVE-2007-0346: SQL injection vulnerability in SmE FileMailer 1.21’s index.php allows remote attackers to execute arbitrary SQL commands via the us parameter. Affected software: SmE FileMailer 1.21 (index.php). Root cause: unsafeguarded input in the us parameter enables SQL injection. Impact: pote...