PHPBandManager 0.8 - 'index.php?pg' Remote File Inclusion

author:koray greetz:cigicigi.net script:http://sourceforge.net/projects/phpbandmanager allowurlfopen:on or registerglobals:on vuln; /bandmanager/suite/index.php include$GET'pg'.".php"; example; http://www.victim.com/suite/index.php?pg=shell link? milw0rm.com 2007-04-26...

PHPBandManager 0.8 - index.php?pg Remote File Inclusion

PHPBandManager 0.8 - index.php?pg Remote File Inclusion author:koray greetz:cigicigi.net script:http://sourceforge.net/projects/phpbandmanager allowurlfopen:on or registerglobals:on vuln; /bandmanager/suite/index.php include$GET'pg'.".php"; example; http://www.victim.com/suite/index.php?pg=shell...

Cross site scripting

Cross-site scripting XSS vulnerability in YA Book 0.98-alpha allows remote attackers to inject arbitrary web script or HTML via the City field in a sign action in index.php...

CVE-2007-2265

CVE-2007-2265 is an XSS vulnerability in YA Book 0.98-alpha, exploitable through the City field in a sign action in index.php. The available documents indicate remote script/HTML injection leading to partial confidentiality/integrity/availability impact as described by CVSS metrics, but no patch ...

Ripe Website Manager (<= 0.8.4) - SQL Injection Vulnerability and Cross-Site Scripting Exploit

!-- Ripe Website Manager = 0.8.4 - SQL Injection Vulnerability and Cross-Site Scripting Exploit Vulnerable Variable: ripeformpost Cross-Site Scripting and SQL Injection possible Vulnerable File: contact/index.php Vulnerable: Ripe Website Manager = 0.8.4 Google d0rk: "Powered by Ripe Website...

Gizzar <= (basePath) Remote File Include Vulnerability

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= Gizzar = basePath Remote File Include Vulnerability Download: http://mesh.dl.sourceforge.net/sourceforge/gizzar/gizzar-03162002.tar.gz Discover: BorN To K!LL =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= Bug in: index.php code:...

CVE-2007-2148

Direct static code injection vulnerability in admin/save.php in Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter, as demonstrated by head.html and foot.html, which are included and executed...

CVE-2007-2155

Directory traversal vulnerability in template.php in in phpFaber TopSites 3 allows remote attackers to read arbitrary files via a .. dot dot in the modify parameter in a template action to admin/index.php...

CVE-2007-2148

Direct static code injection vulnerability in admin/save.php in Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter, as demonstrated by head.html and foot.html, which are included and executed...

gizzar-rfi.txt

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= Gizzar = basePath Remote File Include Vulnerability Download: http://mesh.dl.sourceforge.net/sourceforge/gizzar/gizzar-03162002.tar.gz Discover: BorN To K!LL =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= Bug in: index.php code:...

Anthologia 0.5.2 (index.php ads_file) Remote File Inclusion Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=- ANTHOLOGIA 0.5.2 -=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=- Author : Dj7xpl / Dj7xplatYahoodotcom Type : Remote File Inclusion Vuln Download: http://www.dbfweb.com/download/anthologia-last.tgz Page:...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Sitebar 3.3.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 writerFile parameter to index.php and the 2 file parameter to Integrator.php...

Directory traversal

Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the themeurl parameter to 1 index.php, 2 page.php, 3 search.php, 4 single.php, and 5 archives.php...

CVE-2007-2106

Directory traversal vulnerability in index.php in Kai Content Management System K-CMS 1.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the currenttheme parameter...

CVE-2007-2104

CVE-2007-2104 affects iXon CMS 0.30. The vulnerability is a directory traversal in the theme_url parameter that allows remote attackers to include and execute arbitrary local files via a .. traversal in (1) index.php, (2) page.php, (3) search.php, (4) single.php, and (5) archives.php. Impact is d...

CVE-2007-2104

Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the themeurl parameter to 1 index.php, 2 page.php, 3 search.php, 4 single.php, and 5 archives.php...

CVE-2007-2090

CVE-2007-2090 is a Cross-site scripting (XSS) vulnerability in TuMusika Evolution 1.6, fixed by abusing index.php via the msg parameter to inject arbitrary script/HTML. The vulnerability’s CVSS v2 base score is 6.8 (Medium) with partial impact on confidentiality, integrity, and availability, and ...

CVE-2007-2084

CVE-2007-2084 affects MobilePublisherphp version 1.1.2 and is described as a PHP remote file inclusion vulnerability in the admin directory. The issue permits an attacker to supply a URL in the auth_method parameter to any of the admin PHP files (index.php, list.php, postreview.php, reindex.php, ...

CVE-2007-2105

CVE-2007-2105 affects Monkey CMS 0.0.3. The vulnerability is a directory traversal in admin/index.php that lets an attacker cause local-file inclusion and execution by supplying … in the admin_skin parameter, enabling arbitrary code execution on the server. The NVD entry reports a CVSS v2 base sc...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools SunShop Shopping Cart before 3.5.1 allow remote attackers to execute arbitrary PHP code via a URL in the abspath parameter to 1 index.php or 2 checkout.php...