Invision Gallery Index.PHP IMG参数SQL注入漏洞

Invision Gallery是一款基于Invision的一个图库模块。 Invision Gallery不充分过滤用户提交的URI输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'Index.PHP'脚本对用户提交的'IMG'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Invision Power Services Invision Gallery 2.0.7 目前没有解决方案提供： http://www.invisionpower.com/ip.dynamic/products/gallery/index.html...

Bitfolge Snif Index.PHP远程文件包含漏洞

Bitfolge Snif是一款基于PHP的WEB应用程序。 Bitfolge Snif不充分过滤用户提交的URI输入，远程攻击者可以利用漏洞以WEB进程权限执行任意指令。 问题是'index.php'脚本对用户提交的'externalConfig'参数缺少过滤，指定远程服务器上的任意文件作为包含对象，可导致以进程权限执行任意指令。 Bitfolge snif 1.5.2 http://www.bitfolge.de/snif-en.html?PHPSESSID=a7c62b8ceb6d1273df1486a4d061214c...

CVE-2006-6248

index.php in GPhotos 1.5 allows remote attackers to obtain sensitive information via an invalid rep parameter, which reveals the full path in an error message...

CVE-2006-6279

index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message...

CVE-2006-6278

CVE-2006-6278 is a cross-site scripting (XSS) vulnerability in the index.php of @lex Guestbook 4.0.1 , exploitable via the skin parameter to inject arbitrary web script or HTML. Affected software: @lex Guestbook 4.0.1 (index.php). The documents confirm the vulnerability and payload type but do no...

CVE-2006-6248

index.php in GPhotos 1.5 allows remote attackers to obtain sensitive information via an invalid rep parameter, which reveals the full path in an error message...

CVE-2006-6278

Cross-site scripting XSS vulnerability in index.php in @lex Guestbook 4.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter...

CVE-2006-6279

index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message...

CVE-2006-6285

CVE-2006-6285 affects Kai Blankenhorn Bitfolge (snif) up to version 1.5.2. The issue is a PHP remote file inclusion vulnerability in index.php via the externalConfig parameter, enabling arbitrary PHP code execution. Note: CVE entries and third parties dispute the vulnerability because externalCon...

CVE-2006-6279

Vulnerability CVE-2006-6279 affects @lex Guestbook 4.0.1. The issue occurs in index.php where a skin parameter referencing a nonexistent skin causes an error message that reveals the installation path, enabling information disclosure to remote attackers. The NVD entry lists this as a medium-sever...

CVE-2006-6248

GPhotos 1.5 contains a vulnerability in index.php where the invalid rep parameter can trigger an error message that reveals the full filesystem path. This CVE (CVE-2006-6248) is documented with a remote information disclosure impact (confidentiality) and a network attack vector, but no concrete r...

CVE-2006-6285: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Kai Blankenhorn Bitfolge simple and nice index file aka snif 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the externalConfig parameter. NOTE: CVE and other third parties dispute this vulnerability...

CVE-2006-6271: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in PHPOLL 0.96 allow remote attackers to inject arbitrary web script or HTML via the language parameter to 1 index.php, 2 info.php; and 3 index.php, 4 votanti.php, 5 risultaticonfig.php, 6 modificaband.php, 7 bandeditor.php, and 8 configeditor.php...

CVE-2006-6248: Undefined Security Weakness

index.php in GPhotos 1.5 allows remote attackers to obtain sensitive information via an invalid rep parameter, which reveals the full path in an error message...

CVE-2006-6279: Undefined Security Weakness

index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message...

CVE-2006-6278: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in @lex Guestbook 4.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter...

CVE-2006-6232

CVE-2006-6232 describes a PHP remote file inclusion vulnerability in DreamAccount 3.1, affecting admin/index.php via a URL in the path parameter. The underlying issue is a RFI in the path handling, allowing an attacker to execute arbitrary PHP code on the server. Documented impact is partial conf...

CVE-2006-6230: Undefined Security Weakness

SQL injection vulnerability in vuBB 0.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a register action to index.php, a different vulnerability than CVE-2006-0962...

CVE-2006-6232: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/index.php in DreamAccount 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2006-6218

Multiple SQL injection vulnerabilities in index.php in dev4u CMS allow remote attackers to execute arbitrary SQL commands via the 1 seiteid, 2 gruppeid.php, and 3 gotarget parameters...