CVE-2007-5835

CVE-2007-5835 affects BosDev BosNews 4 and 5, where Install.php does not require authentication for replacing an existing installation or creating a new admin account. The described impact is denial of service via overwritten files and the possibility of obtaining administrative access. No explic...

CVE-2007-5835

Install.php in BosDev BosNews 4 and 5 does not require authentication for replacing an existing product installation or creating a new admin account, which allows remote attackers to cause a denial of service overwritten files and possibly obtain administrative access...

CVE-2007-5835: Undefined Security Weakness

Install.php in BosDev BosNews 4 and 5 does not require authentication for replacing an existing product installation or creating a new admin account, which allows remote attackers to cause a denial of service overwritten files and possibly obtain administrative access...

CVE-2003-1459: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in ttCMS 2.2 and ttForum allow remote attackers to execute arbitrary PHP code via the 1 template parameter in News.php or 2 installdir parameter in install.php...

Design/Logic Flaw

install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified...

CVE-2007-5593

install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified...

CVE-2007-5593: Improper Control of Generation of Code

install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified...

CVE-2007-4711: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Toms Gaestebuch 1.00 allow remote attackers to inject arbitrary web script or HTML via the 1 homepage, 2 mail, and 3 name parameters in a show action to a form.php; the 4 language and 5 anzeigebreite parameters to b admin/header.php; and the 6...

tomsgb10-xss.txt

Software: Guestbook Title: Toms Gästebuch 1.00 Version: 1.0 Type: XSS Date: Sat Aug 11 21:52:08 CEST 2007 Vendor: Fitz Thomas Page: http://www.toms-seiten.at/ vulnerability: ---------------------------- http://example.com/form.php?action=show&homepage=XSS&mail=XSS&name=XSS...

Gstebuch Version 1.5 Remote Command Execution Vulnerability

Gastebuch Version 1.5 Remote Command Execution Vulnerability ----------------------------------------------------------------------- Script : Gastebuch Version Version : 1.5 Site : http://www.mapos-scripts.de/downloads.php?download=11 Founder : Rizgar Contact : [email protected] and...

CVE-2007-1451: Undefined Security Weakness

GuppY 4.0 allows remote attackers to delete arbitrary files via a direct request to install/install.php, then selecting "Installation propre" cleanup.php and then "Suppression des fichiers d'installation" delete.php...

CVE-2007-1073

CVE-2007-1073 involves a static code injection in mcRefer’s install.php. The bgcolor parameter is inserted into mcrconf.inc.php, enabling remote PHP code execution. The vulnerability affects install.php in mcRefer and can lead to complete compromise of affected systems. The available documents do...

CVE-2007-1073: Undefined Security Weakness

Static code injection vulnerability in install.php in mcRefer allows remote attackers to execute arbitrary PHP code via the bgcolor parameter, which is inserted into mcrconf.inc.php...

CVE-2007-0875

SQL injection vulnerability in install.php in mcRefer allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this issue has been disputed by a third party, stating that the file does not use a SQL database...

CVE-2007-0875

The vulnerability CVE-2007-0875 affects mcRefer’s install.php, where a SQL injection could allow remote execution of arbitrary SQL via unspecified vectors. A third party disputes that the file uses a SQL database. The connected sources do not provide a confirmed fix or affected versions; exploita...

PT-2007-2317 · Mcrefer · Mcrefer

Name of the Vulnerable Software and Affected Versions: mcRefer affected versions not specified Description: The issue concerns a SQL injection vulnerability in the install.php file of mcRefer, potentially allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. However...

CVE-2007-0875: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in install.php in mcRefer allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this issue has been disputed by a third party, stating that the file does not use a SQL database...

CVE-2007-0704

PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP code via a URL in the skindir parameter, a different vector than CVE-2006-4669. NOTE: the documentation says to remove install.php after installation...

Remote file inclusion

PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP code via a URL in the skindir parameter, a different vector than CVE-2006-4669. NOTE: the documentation says to remove install.php after installation...

CVE-2007-0704: Undefined Security Weakness

PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP code via a URL in the skindir parameter, a different vector than CVE-2006-4669. NOTE: the documentation says to remove install.php after installation...