CVE-2008-0159

SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the eggblogpassword parameter in a cookie...

CVE-2008-0156

CVE-2008-0156: Absolute path traversal in Million Dollar Script 2.0.14 (index.php) lets remote attackers read arbitrary files via encoded '/' sequences in the link parameter. Affected: Million Dollar Script 2.0.14; root cause: improper handling of encoded path separators. Impact: read access to a...

CVE-2008-0155

The CVE-2008-0155 entry concerns a Cross-site Scripting (XSS) vulnerability in EvilBoard 0.1a (Alpha). The affected component is index.php; the issue is triggered by the c parameter, allowing an attacker to inject arbitrary web script or HTML. Public references (NVD, CVE records) confirm the vuln...

CVE-2008-0147

CVE-2008-0147 affects SmallNuke versions up to 2.0.4 where magic_quotes_gpc is disabled. The SQL injection is triggered in index.php via the user_email parameter and possibly the username parameter in a Members action, allowing remote attackers to execute arbitrary SQL commands. This entry lists ...

sysHotel On Line Remote File Disclosure Vulnerability.

-------------------------------------------------------------- sysHotel On Line Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.syshotelonline.it/ author : p4imi0 contact : [email protected] exploit :...

syshotelonline-disclose.txt

-------------------------------------------------------------- sysHotel On Line Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.syshotelonline.it/ author : p4imi0 contact : [email protected] exploit :...

Million Dollar Script 2.0.14 Remote File Disclosure Vulnerability.

-------------------------------------------------------------- Million Dollar Script 2.0.14 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.milliondollarscript.com author : p4imi0 contact : [email protected] exploit :...

mds-disclose.txt

-------------------------------------------------------------- Million Dollar Script 2.0.14 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.milliondollarscript.com author : p4imi0 contact : [email protected] exploit :...

Shop-Script 2.0 index.php Remote File Disclosure Vulnerability

Exploit for unknown platform in category web applications ============================================================== Shop-Script 2.0 index.php Remote File Disclosure Vulnerability ============================================================== Shop-Script 2.0 index.php Remote File Disclosure...

Code injection

cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb...

CVE-2007-6652

cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb...

CVE-2007-6648

Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter...

Sql injection

SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter...

CVE-2007-6647

SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter...

CVE-2007-6664

SQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter...

CVE-2007-6639

CVE-2007-6639 describes a SQL injection vulnerability in IPTBB 0.5.4 and earlier, where the id parameter in the viewdir action of index.php can be exploited to execute arbitrary SQL commands remotely. Affected software is IPTBB (0.5.4 and earlier). The root cause is improper input handling in the...

NetRisk 1.9.7 - LocalRemote File Inclusion

NetRisk 1.9.7 - LocalRemote File Inclusion NetRisk = 1.9.7 Remote/Local File Inclusion Vulnerability AUTHOR : S.W.A.T. HOME : http://svvat.ir Download : http://phprisk.org/netrisk1.9.7.zip DorKs : inurl:index.php?page=gamebrowser EXPLOIT : http://server.com/Path/index.php?page=SHELL...

NetRisk 1.9.7 - Local/Remote File Inclusion

NetRisk = 1.9.7 Remote/Local File Inclusion Vulnerability AUTHOR : S.W.A.T. HOME : http://svvat.ir Download : http://phprisk.org/netrisk1.9.7.zip DorKs : inurl:index.php?page=gamebrowser EXPLOIT : http://server.com/Path/index.php?page=SHELL http://server.com/Path/index.php?page=-LFI- GREETZ :...

w-Agora 'index.php' SQL注入漏洞

BUGTRAQ ID: 27070 CNCAN ID:CNCAN-2008010213 w-Agora是一款基于PHP的WEB应用程序。 w-Agora不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'index.php'脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 W-Agora 4.2.1 目前没有解决方案提供： http://www.w-agora.net/en/index.php...

Discuz! "$_SERVER['PHP_SELF']" XSS Vulnerability

在common.inc.php文件的69行： $PHPSELF = $SERVER'PHPSELF' ? $SERVER'PHPSELF' : $SERVER'SCRIPTNAME'; $SCRIPTFILENAME = strreplace'\\', '/', isset$SERVER'PATHTRANSLATED' ? $SERVER'PATHTRANSLATED' : $SERVER'SCRIPTFILENAME'; $boardurl = 'http://'.$SERVER'HTTPHOST'.pregreplace"//+api|archiver|wap?/$/i",...