CVE-2007-3328: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Interact 2.4 beta 1 allow remote attackers to inject arbitrary web script or HTML via the 1 modulekey parameter to a kb/kb.php, b quiz/runquiz.php, c quiz/quiz.php, d forum/forum.php, e forum/byname.php, and f journal/journalview.php in modules...

Interact multiple XSS vuln.

Interact multiple XSS vuln. Vuln. discovered by : r0t Date: 21 June 2007 vendor:www.interactole.org orginal advisory: http://pridels-team.blogspot.com/2007/06/interact-multiple-xss-vuln.html affected versions: tested on "Interact 2.4 beta 1" other versions also can be affected. Interact contains ...

Interact远程文件包含漏洞

Interact是一款基于PHP的WEB应用程序。 Interact不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于多个脚本对用户提交的'CONFIGBASEPATH'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Interact Learning Community Environment Interact 2.2 http://www.interactlms.org/spaces/space.php?spacekey=1&javascript=1...

CVE-2006-4448

Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 CONFIGBASEPATH parameter in a admin/autoprompter.php and b includes/common.inc.php, and the 2 CONFIGLANGUAGECPATH parameter ...

CVE-2006-4448

CVE-2006-4448 concerns PHP remote file inclusion in Interact 2.2/2.x when register_globals is on. The vulnerable vectors are (1) CONFIG[BASE_PATH] via admin/autoprompter.php and includes/common.inc.php, and (2) CONFIG[LANGUAGE_CPATH] via admin/autoprompter.php. This allows arbitrary PHP code exec...

CVE-2006-4448

Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 CONFIGBASEPATH parameter in a admin/autoprompter.php and b includes/common.inc.php, and the 2 CONFIGLANGUAGECPATH parameter ...

CVE-2006-4448: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 CONFIGBASEPATH parameter in a admin/autoprompter.php and b includes/common.inc.php, and the 2 CONFIGLANGUAGECPATH parameter ...

interact <= 2.2 (CONFIG[BASE_PATH]) Remote File Include Vulnerability

/ + + - - - Romanian Electronic Network Security Lab Team ThE Best Romanian Hacking Team - - + + + - Cce-interact = 2.2.0 CONFIGBASEPATH Remote File Include Vulnerability + + + - Script name: Interact - Online Learning and Collaboration System v. 2.2.0 - Script site:...

cce-interact220.txt

/ + + - - - Romanian Electronic Network Security Lab Team ThE Best Romanian Hacking Team - - + + + - Cce-interact admin/autoprompter.php line 33-38: .... requireonce$CONFIG'BASEPATH'.'/modules/forum/autoprompt/prompt.inc.php'; requireonce$CONFIG'LANGUAGECPATH'.'/forumstrings.inc.php'; $rs =...

interact <= 2.2 (CONFIG[BASE_PATH]) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ===================================================================== interact admin/autoprompter.php line 33-38: .... requireonce$CONFIG'BASEPATH'.'/modules/forum/autoprompt/prompt.inc.php'; requireonce$CONFIG'LANGUAGECPATH'.'/f...

interact &lt;= 2.2 (CONFIG[BASE_PATH]) Remote File Include Vulnerability

No description provided by source. / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Cce-interact = 2.2.0 CONFIGBASEPATH Remote File Include Vulnerability + + + - Script name: Interact - Online Learning and Collaboration System v. 2.2.0 - Script site:...

Interact 2.2 - CONFIG[base_path] Remote File Inclusion

Interact 2.2 - CONFIGbasepath Remote File Inclusion / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Cce-interact admin/autoprompter.php line 33-38: .... requireonce$CONFIG'BASEPATH'.'/modules/forum/autoprompt/prompt.inc.php'; requireonce$CONFIG'LANGUAGECPATH'.'/forumstrings.inc.php'; $rs ...

Interact 2.2 - 'CONFIG[base_path]' Remote File Inclusion

/ + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Cce-interact admin/autoprompter.php line 33-38: .... requireonce$CONFIG'BASEPATH'.'/modules/forum/autoprompt/prompt.inc.php'; requireonce$CONFIG'LANGUAGECPATH'.'/forumstrings.inc.php'; $rs = $CONN-Execute"SELECT $CONFIG'DBPREFIX'posts.postke...

Cross site scripting

Cross-site scripting XSS vulnerability in Interact 2.1.1 allows remote attackers to inject arbitrary web script or HTML via 1 the searchterms parameter to a search.php, and 2 the firstname, 3 lastname, 4 email, 5 password, and 6 confirmpassword parameters to b userinput.php. NOTE: the provenance ...

Information disclosure

login.php in Interact 2.1.1 generates different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1642

Cross-site scripting XSS vulnerability in Interact 2.1.1 allows remote attackers to inject arbitrary web script or HTML via 1 the searchterms parameter to a search.php, and 2 the firstname, 3 lastname, 4 email, 5 password, and 6 confirmpassword parameters to b userinput.php. NOTE: the provenance ...

CVE-2006-1643

SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party...

CVE-2006-1644

login.php in Interact 2.1.1 generates different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party...

CVE-2006-1643

SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party...