CVE-2007-0986

PHP remote file inclusion vulnerability in index.php in Jupiter CMS 1.1.5, when PHP 5.0.0 or later is used, allows remote attackers to execute arbitrary PHP code via an ftp URL in the n parameter...

CVE-2007-0987

Directory traversal vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to include and execute arbitrary local files via a .. dot dot, or an absolute pathname, in the n parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in Jupiter CMS 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header and certain other HTTP headers, which are displayed without proper sanitization when an administrator performs a Logged Gue...

Unrestricted file upload

Unrestricted file upload vulnerability in modules/emoticons.php in Jupiter CMS 1.1.5 allows remote attackers to upload arbitrary files by modifying the HTTP request to send an image content type, and to omit isguest and isuser parameters. NOTE: this issue might be related to CVE-2006-4875...

CVE-2007-0972

Unrestricted file upload vulnerability in modules/emoticons.php in Jupiter CMS 1.1.5 allows remote attackers to upload arbitrary files by modifying the HTTP request to send an image content type, and to omit isguest and isuser parameters. NOTE: this issue might be related to CVE-2006-4875...

Sql injection

Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the...

CVE-2007-0971

Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the...

CVE-2007-0973

Multiple cross-site scripting XSS vulnerabilities in index.php in Jupiter CMS 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header and certain other HTTP headers, which are displayed without proper sanitization when an administrator performs a Logged Gue...

CVE-2007-0973

CVE-2007-0973 affects Jupiter CMS 1.1.5 and describes multiple cross-site scripting (XSS) vulnerabilities in index.php. The issue arises because certain HTTP headers (including Referer) are displayed without proper sanitization when an administrator performs a Logged Guest action, enabling inject...

CVE-2007-0971

Jupiter CMS 1.1.5 is affected by multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and other headers that set the ip variable used in queries in index.php and related PHP scripts. This is the underlying cause: input ...

CVE-2007-0972

The CVE-2007-0972 entry describes an unrestricted file upload in Jupiter CMS 1.1.5 (modules/emoticons.php) where an attacker can upload arbitrary files by crafting the HTTP request with an image content type and omitting is_guest/is_user parameters. This vulnerability could enable remote code exe...

CVE-2007-0971

Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the...

CVE-2007-0973

Multiple cross-site scripting XSS vulnerabilities in index.php in Jupiter CMS 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header and certain other HTTP headers, which are displayed without proper sanitization when an administrator performs a Logged Gue...

CVE-2007-0972

Unrestricted file upload vulnerability in modules/emoticons.php in Jupiter CMS 1.1.5 allows remote attackers to upload arbitrary files by modifying the HTTP request to send an image content type, and to omit isguest and isuser parameters. NOTE: this issue might be related to CVE-2006-4875...

Jupiter CMS 1.1.5 (index.php) Local/Remote File Include Vulnerability

No description provided by source. Title: Jupiter CMS 1.1.5 Multiple Vulnerabilities Advisory ID: 12070214 Risk level: High Author: DarkFig [email protected] URL: http://www.acid-root.new.fr/advisories/12070214.txt Risk level: High Summary: Local/Remote File Inclusion Conditions: LFI:...

Jupiter CMS 1.1.5 (Client-IP) Remote SQL Injection Exploit

No description provided by source. URL: http://www.acid-root.new.fr/advisories/12070214.txt / errorreportingEALL ^ ENOTICE; $url = 'http://localhost/jupiter/'; $xpl = new phpsploit; $xpl-agent"Mozilla"; $hev = "-1' UNION SELECT CONCAT'" ."BEGINXPLUSER'," ."SELECT username FROM users...

Jupiter CMS 1.1.5 Remote File Upload Exploit

No description provided by source. URL: http://www.acid-root.new.fr/advisories/12070214.txt / errorreportingEALL ^ ENOTICE; $url = ' http://localhost/jupiter/'; $xpl = new phpsploit; $xpl-agent"Mozilla"; $arr = arrayfrmdturl = $url.'modules/emoticons.php', "a" = 1, "reqfile" =...

Jupiter CMS 1.1.5 (index.php) Local/Remote File Include Vulnerability

Exploit for unknown platform in category web applications ===================================================================== Jupiter CMS 1.1.5 index.php Local/Remote File Include Vulnerability ===================================================================== Title: Jupiter CMS 1.1.5 Multip...

Jupiter CMS 1.1.5 - Client-IP SQL Injection

Jupiter CMS 1.1.5 - Client-IP SQL Injection URL: http://www.acid-root.new.fr/advisories/12070214.txt / errorreportingEALL ^ ENOTICE; $url = 'http://localhost/jupiter/'; $xpl = new phpsploit; $xpl-agent"Mozilla"; $hev = "-1' UNION SELECT CONCAT'" ."BEGINXPLUSER'," ."SELECT username FROM users LIMI...

Jupiter CMS 1.1.5 (Client-IP) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================================== Jupiter CMS 1.1.5 Client-IP Remote SQL Injection Exploit ========================================================== agent"Mozilla"; $hev = "-1' UNION SELECT CONCAT'"...