CVE-2007-0704

PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP code via a URL in the skindir parameter, a different vector than CVE-2006-4669. NOTE: the documentation says to remove install.php after installation...

CVE-2007-0230

CS-Cart 1.3.3 contains a PHP remote file inclusion in install.php via the install_dir parameter, potentially allowing remote code execution. Several sources note that the vulnerability is disputed because install_dir is defined before use, and no specific exploit details are provided in the docum...

CVE-2007-0230: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in install.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the installdir parameter. NOTE: CVE and third parties dispute this vulnerability because installdir is defined before use...

PT-2007-1711 · Cs Cart · Cs-Cart

Name of the Vulnerable Software and Affected Versions: CS-Cart version 1.3.3 Description: A remote file inclusion issue in the install.php file allows remote attackers to execute arbitrary PHP code via a URL in the install dir parameter. Recommendations: For CS-Cart version 1.3.3, as a temporary...

CVE-2006-4979

The CVE-2006-4979 entry concerns a Direct static code injection vulnerability in cfgphpquiz/install.php for Walter Beschmout PhpQuiz 1.2 and earlier. The underlying flaw lets remote attackers inject arbitrary PHP code into config.inc.php by submitting modified configuration settings, enabling pot...

CVE-2006-4979: Undefined Security Weakness

Direct static code injection vulnerability in cfgphpquiz/install.php in Walter Beschmout PhpQuiz 1.2 and earlier allows remote attackers to inject arbitrary PHP code in config.inc.php via modified configuration settings...

CVE-2006-4865

Walter Beschmout PhpQuiz allows remote attackers to obtain sensitive information via a direct request to cfgphpquiz/install.php and other unspecified vectors...

phpquiz.txt

phpQuiz sensitive file install.php without authentification + Files containing interesting info passwords for sql db By : sn0oPy Risk : verry high Site : http://phpquiz.com/ Dork : intitle:"phpQuiz" | " Développé par PhpQuiz v.1.0 " | "© PhpQuiz" | inurl:"PhpQuiz" exploit :...

phpQuiz 0.1.2 - SQL Injection / Code Execution

Title: PHPQuiz Download File phpquiz/imgquiz/ folder is by defaut writable so after uploading a simple phpshell we can lanche cmd from : http://localhost/phpquiz/...

CVE-2006-4678

PHP remote file inclusion vulnerability in News Evolution 3.0.3 allows remote attackers to execute arbitrary PHP code via the NEAbsPath parameter in 1 install.php and 2 migrateNE2toNE3.php...

CVE-2006-4678: Undefined Security Weakness

PHP remote file inclusion vulnerability in News Evolution 3.0.3 allows remote attackers to execute arbitrary PHP code via the NEAbsPath parameter in 1 install.php and 2 migrateNE2toNE3.php...

CVE-2006-2540

Privacy leak in install.php for Diesel PHP Job Site sends sensitive information such as user credentials to an e-mail address controlled by the product developers...

CVE-2006-2540

The CVE-2006-2540 issue affects a Diesel PHP Job Site component (install.php) in which sensitive data (user credentials) is sent to an email address controlled by the product developers, causing a privacy leak. The published description identifies a leakage of credentials and other sensitive info...

CVE-2006-2540: Undefined Security Weakness

Privacy leak in install.php for Diesel PHP Job Site sends sensitive information such as user credentials to an e-mail address controlled by the product developers...

Linpha <= 1.0 multiple arbitrary local inclusion

------------- Linpha = 1.0 multiple arbitrary local inclusion ----------------- software: site: http://linpha.sourceforge.net/nuke/ description: " LinPHA is an easy to use, multilingual, flexible photo / image archive / album / gallery written in PHP. It uses a SQL database to store information...

VCardLITE-2.4.txt

=========================================================== Title: Vcard Lite Remote Vulnerabilitie Vulnerability discovery: Disruptor Date: 11/02/2006 Severity: Remote Users Can Execute Arbitrary Code. Affected version: . ------------------------------------------------------------- Fix 1-Remove...

CVE-2006-0644: Undefined Security Weakness

Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS aka CPG Dragonfly CMS 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in 1 the newlang parameter and 2 the installlang...

CPGNuke Dragonfly 9.0.6.1 - Remote Command Execution

this works regardless of magicquotesgpc settings Sun-Tzu: "Thus it may be known that the leader of armies is the arbiter of the people's fate, the man on whom it depends whether the nation shall be in peace or in peril." / a short explaination: install.php is not deleted after dragonfly...

CVE-2005-4174

eFiction 1.0, 1.1, and 2.0, in unspecified environments, might allow remote attackers to conduct unauthorized operations by directly accessing 1 install.php or 2 upgrade.php. NOTE: it is unclear whether this is a vulnerability in eFiction itself or the result of incorrect system administration...

CVE-2005-4174

eFiction 1.0, 1.1, and 2.0, in unspecified environments, might allow remote attackers to conduct unauthorized operations by directly accessing 1 install.php or 2 upgrade.php. NOTE: it is unclear whether this is a vulnerability in eFiction itself or the result of incorrect system administration...