CVE-2007-3627

CVE-2007-3627 concerns PHP Lite Calendar Express 2.2 with multiple SQL injection flaws exploitable via the cid parameter in login.php, auth.php, and subscribe.php. The vulnerability allows remote attackers to inject arbitrary SQL commands. The note states that month.php, year.php, week.php, and d...

CVE-2007-3627: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...

CVE-2007-3332: Undefined Security Weakness

Directory traversal vulnerability in Satellite.php in Satel Lite for PhpNuke allows remote attackers to read arbitrary files via a .. dot dot sequence in the name parameter in a modload action...

CVE-2007-2042

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite 1.0.6 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 support.html.php or 2 info.html.php. NOTE: the provenance of...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite 1.0.6 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 support.html.php or 2 info.html.php. NOTE: the provenance of...

CVE-2007-2042

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite 1.0.6 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 support.html.php or 2 info.html.php. NOTE: the provenance of...

CVE-2007-2042: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite 1.0.6 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 support.html.php or 2 info.html.php. NOTE: the provenance of...

CyBoards PHP Lite Default_Header.PHP远程文件包含漏洞

CyBoards PHP Lite是一款基于PHP的WEB应用程序。 CyBoards PHP Lite不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'DefaultHeader.PHP'脚本对用户提交的WEB参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Cyboards PHP Lite 1.21 目前没有解决方案提供： http://www.gold-sonata.com/index.phtml?content=script/forums&menu=script Coded by bd0rk || SOH-Cr...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in lite-cms 0.2.1 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter...

CVE-2007-1984

PHP remote file inclusion vulnerability in index.php in lite-cms 0.2.1 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in include/defaultheader.php in Cyboards PHP Lite 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the scriptpath parameter, a different vector than CVE-2006-2871...

CVE-2007-1983

PHP remote file inclusion vulnerability in include/defaultheader.php in Cyboards PHP Lite 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the scriptpath parameter, a different vector than CVE-2006-2871...

CVE-2007-1984

PHP remote file inclusion vulnerability in index.php in lite-cms 0.2.1 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter...

CVE-2007-1984

CVE-2007-1984 affects lite-cms 0.2.1 and is a PHP remote file inclusion flaw in index.php. The vulnerability allows an attacker to cause remote PHP code execution by supplying a URL in the inc parameter. The NVD entry confirms arbitrary code execution is possible, with a base score of 7.5 (HIGH) ...

CVE-2007-1984

PHP remote file inclusion vulnerability in index.php in lite-cms 0.2.1 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter...

CVE-2007-1983

CVE-2007-1983 is a PHP remote file inclusion vulnerability in CyBoards PHP Lite 1.21. The issue affects the include/default_header.php script, where a remote attacker can supply a URL via the script_path parameter to execute arbitrary PHP code. This is described as a different vector from CVE-200...

CVE-2007-1983: Undefined Security Weakness

PHP remote file inclusion vulnerability in include/defaultheader.php in Cyboards PHP Lite 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the scriptpath parameter, a different vector than CVE-2006-2871...

CVE-2007-1984: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in lite-cms 0.2.1 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter...

litecms-rfi.txt

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...

[MajorSecurity Advisory #38]eXV2 CMS - Session fixation and Cross-Site-Scripting Issues

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...