CVE-2008-0447

CVE-2008-0447 describes an SQL injection in Foojan WMS PHP Weblog 1.0, caused by unsanitized input in the story parameter of index.php. This enables remote attackers to potentially modify or read database data; CVSS v2 base score 7.5 (HIGH) with network access, low attack complexity, and no authe...

efront-312-xss.txt

fuzion / // /\ / / : //\ /| : : .. / \ | | :: :: \ / | | :| || \ / | | || || |\ / | | || || | / | \ | || || | / /\ \ | || || | / / \ -/ -/ | |// \ --/ \ / / / / \ / \/ Product: efront e-learning LMS 3.1.2 http://www.efrontlearning.net/ Vulnerable: http://site/index.php?message=xss...

CVE-2008-0432

The CVE-2008-0432 entry concerns a Cross-site Scripting (XSS) vulnerability in phpAutoVideo before or

CVE-2008-0395

Kayako SupportSuite 3.11.01 is affected by CVE-2008-0395: an information-disclosure flaw where a direct request to syncml/index.php prints the PHP $_SERVER superglobal, allowing remote attackers to obtain server configuration information. The vulnerability is triggered through an accessible endpo...

Code injection

stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php...

CVE-2008-0390

CVE-2008-0390 affects AuraCMS 1.62 and Mod Block Statistik for AuraCMS. The vulnerability is a remote code-injection via the X-Forwarded-For header in a stat action to index.php, allowing an attacker to inject arbitrary PHP code into online.db.txt and later execute online.db.txt through a crafted...

SetCMS 3.6.5 (setcms.org) Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl SetCMS v3.6.5 setcms.org remote commands execution exploit by RST/GHC o4.o9.2oo6 coded by 1dt.w0lf THIS IS UNPUBLISHED RST/GHC EXPLOIT CODE KEEP IT PRIVATE про багу: file: functions.php FUNCTION ip global $userid; ifgetenv'HTTPCLIENTIP' $userip =...

Kayako SupportSuite syncml/index.php Direct Request Remote Information Disclosure

The version of Kayako SupportSuite installed on the remote host returns PHP's '$SERVER' superglobal variable in response to a request for Kayako's 'syncml/index.php' page. This variable contains information about the remote web server, some of which might be sensitive. %NASLMINLEVEL 70300 C Tenab...

SLAED CMS 2.5 Lite - newlang Local File Inclusion

SLAED CMS 2.5 Lite - newlang Local File Inclusion SLAED CMS 2.5 Lite Local file inclusion Script url http://www.slaed.net/uploads/files/public/SLAEDCMS2.5Lite.zip Lets code in function/sources.php: 780: // Format language 781: function getlang$module="" 782: global $multilingual, $currentlang,...

SLAED CMS 2.5 Lite - 'newlang' Local File Inclusion

SLAED CMS 2.5 Lite Local file inclusion Script url http://www.slaed.net/uploads/files/public/SLAEDCMS2.5Lite.zip Lets code in function/sources.php: 780: // Format language 781: function getlang$module="" 782: global $multilingual, $currentlang, $language, $usercookiet; 783: if...

Sql injection

Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magicquotesgpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via 1 the mohit parameter to a inc/receivertwo.php; and allow remote attackers to execute arbitrary SQL commands via 2 the id parameter to...

CVE-2008-0371

Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magicquotesgpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via 1 the mohit parameter to a inc/receivertwo.php; and allow remote attackers to execute arbitrary SQL commands via 2 the id parameter to...

PHPEcho CMS 'index.php' SQL注入漏洞

BUGTRAQ ID: 27326 CNCAN ID:CNCAN-2008012107 PHPEcho CMS是一款基于PHP的WEB应用程序。 PHPEcho CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'index.php'脚本对用户提交的'id'参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 PHPEcho CMS PHPEcho CMS 2.0-rc3 目前没有详细解决方案提供：...

Invision Gallery <= 2.0.7 Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ====================================================== Invision Gallery "r57ig207" ; $mw-geometry '420x510' ; $mw-resizable0,0; $mw-Label-text = '!', -font = 'Webdings 22'-pack; $mw-Label-text = 'Invision Gallery 'Verdana 7...

SetCMS 3.6.5 (setcms.org) Remote Command Execution Exploit

Exploit for unknown platform in category web applications ========================================================== SetCMS 3.6.5 setcms.org Remote Command Execution Exploit ========================================================== !/usr/bin/perl SetCMS v3.6.5 setcms.org remote commands executio...

BLOG:CMS 4.2.1.c &#40;DIR_PLUGINS&#41; Multiple Remote File Include

Name : BLOG:CMS 4.2.1.c DIRPLUGINS Multiple Remote File Include Download From : http://dfn.dl.sourceforge.net/sourceforge/blogcms/blogcms.4.2.1.c.7z Or Here http://blogcms.com Found By : RoMaNcYxHaCkEr We Are H-T TeaM Houssamix - ToXiC Home Page : Not Yet : Tryag.cc/cc No-Hack.net V99x.com/vb...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 admin.php or 2 index.php in photo/...

Sql injection

SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via the parentid parameter...

CVE-2008-0359

Multiple cross-site scripting XSS vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 admin.php or 2 index.php in photo/...

CVE-2008-0358

CVE-2008-0358 affects Pixelpost 1.7. The vulnerability is a SQL injection in the index.php component, exploitable via the remote input parameter parent_id . The underlying cause is insufficient sanitization of the user-supplied value, allowing an attacker to inject arbitrary SQL commands through ...