Jetbox CMS 2.1 - '/view/search/?path' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23999/info Jetbox CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch...

Jetbox CMS 2.1 - view/supplynews Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/23999/info Jetbox CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch...

CVE-2006-4738

PHP remote file inclusion vulnerability in phpthumb.php in Jetbox CMS allows remote attackers to execute arbitrary PHP code via a URL in the includespath parameter. NOTE: The relativescriptpath vector is already covered by CVE-2006-2270...

CVE-2006-4739

Multiple cross-site scripting XSS vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the OriginalImageData parameter to phpthumb.php...

CVE-2006-4737

SQL injection vulnerability in index.php in Jetbox CMS allows remote attackers to inject arbitrary web script or HTML via the item parameter. NOTE: The view vector is already covered by CVE-2006-3586.2...

CVE-2006-4740

Jetbox CMS allows remote attackers to obtain sensitive information via a direct request for certain files, which reveal the path in an error message...

CVE-2006-4737

SQL injection vulnerability in index.php in Jetbox CMS allows remote attackers to inject arbitrary web script or HTML via the item parameter. NOTE: The view vector is already covered by CVE-2006-3586.2...

CVE-2006-4738

PHP remote file inclusion vulnerability in phpthumb.php in Jetbox CMS allows remote attackers to execute arbitrary PHP code via a URL in the includespath parameter. NOTE: The relativescriptpath vector is already covered by CVE-2006-2270...

CVE-2006-4739

Multiple cross-site scripting XSS vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the OriginalImageData parameter to phpthumb.php...

CVE-2006-4738

CVE-2006-4738 describes a PHP remote file inclusion in Jetbox CMS, specifically in phpthumb.php, allowing an attacker to execute arbitrary PHP code via a URL supplied to the includes_path parameter. The entry notes that the related relative_script_path vector is already covered by CVE-2006-2270. ...

CVE-2006-4740

Jetbox CMS allows remote attackers to obtain sensitive information via a direct request for certain files, which reveal the path in an error message...

CVE-2006-4737

Jetbox CMS contains an SQL injection in index.php via the item parameter, allowing remote injection of arbitrary web content. The description notes that the view-vector is already covered by CVE-2006-3586, indicating a related vulnerability in the same package. Root cause: unsanitized input used ...

CVE-2006-4739

Jetbox CMS contains multiple XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. The issue is demonstrated via the OriginalImageData parameter to phpthumb.php, as described across CVE-2006-4739 records. The available documents do not provide exploit details, af...

CVE-2006-4740

CVE-2006-4740 affects Jetbox CMS. The vulnerability allows remote attackers to obtain sensitive information by directly requesting certain files, exposing the server file path in error messages. Public references (NVD) indicate a partial confidentiality impact with network access and low attack c...

jetboxCMSSQL.txt

Hello,, Multible Injections in Jetbox CMS Discovered By : HACKERS PAL & mohajali Copy rights : HACKERS PAL & mohajali Website : http://www.soqor.net Email Address : [email protected] This Contains multible injections and vulnerabilities in Jetbox CMS // sql injections if magicquotesgpc = off...

Multible injections and vulnerabilities in Jetbox CMS

Hello,, Multible Injections in Jetbox CMS Discovered By : HACKERS PAL & mohajali Copy rights : HACKERS PAL & mohajali Website : http://www.soqor.net Email Address : [email protected] This Contains multible injections and vulnerabilities in Jetbox CMS // sql injections if magicquotesgpc = off...

CVE-2006-4422

PHP remote file inclusion vulnerability in includes/phpdig/libs/searchfunction.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the relativescriptpath parameter, a different vector than CVE-2006-2270. NOTE: this issue has been disputed, and as of 20060830,...

CVE-2006-4422

CVE-2006-4422 describes a PHP remote file inclusion in Jetbox CMS 2.1. The vulnerability affects includes/phpdig/libs/search_function.php via a URL in the relative_script_path parameter, enabling arbitrary PHP code execution. This CVE is noted as having a vector different from CVE-2006-2270 and i...

JetBox cms (search_function.php) Remote File Include

Found by : CarcaBot -- E-mail : CarcaBotx at Yahoo dot com -- $relativescriptpath.'/libs/htmlheader.php -- Exploit -- Google Dork: powered by Jetbox CMS -- http://www.sitename.com/path/includes/phpdig/libs/searchfunction.php?relative scriptpath=Evil Code -- Greets goes to : CarcaBot Administrator...

jetboxInclude.txt

Found by : CarcaBot -- E-mail : CarcaBotx at Yahoo dot com -- $relativescriptpath.'/libs/htmlheader.php -- Exploit -- Google Dork: powered by Jetbox CMS -- http://www.sitename.com/path/includes/phpdig/libs/searchfunction.php?relative scriptpath=Evil Code -- Greets goes to : CarcaBot Administrator...