lovecms-exec.txt

!/usr/bin/ruby Exploit by PoMdaPiMp! --------------------- pomdapimpatgmaildotcom LoveCMS Exploit Series Episode 1: adding a side block Description: add some php into a block container on the side of the site. phpinfo is called. Usage: ./LoveCMS1blocks.rb Ex: ./LoveCMS2themes.rb...

LoveCMS 1.6.2 Final - Remote Code Execution

!/usr/bin/ruby Exploit by PoMdaPiMp! --------------------- pomdapimpatgmaildotcom LoveCMS Exploit Series Episode 1: adding a side block Description: add some php into a block container on the side of the site. phpinfo is called. Usage: ./LoveCMS1blocks.rb Ex: ./LoveCMS1blocks.rb...

LoveCMS 1.6.2 Final - Update Settings

!/usr/bin/ruby Exploit by PoMdaPiMp! --------------------- pomdapimpatgmaildotcom LoveCMS Exploit Series Episode 3: changing site settings ... Description: Simply change the site settings ! Usage: ./LoveCMS3settings.rb Ex: ./LoveCMS2themes.rb http://site.com/lovecms/ Tested on: lovecms1.6.2final...

Remote file inclusion

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter...

CVE-2007-1148

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter...

Unrestricted file upload

Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/...

CVE-2007-1151

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

Directory traversal

Multiple directory traversal vulnerabilities in LoveCMS 1.4 allow remote attackers to read arbitrary files via a .. dot dot in 1 the step parameter to install/index.php or 2 the load parameter to the top-level URI...

CVE-2007-1151

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

CVE-2007-1149

Multiple directory traversal vulnerabilities in LoveCMS 1.4 allow remote attackers to read arbitrary files via a .. dot dot in 1 the step parameter to install/index.php or 2 the load parameter to the top-level URI...

CVE-2007-1150

Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/...

CVE-2007-1148

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter...

CVE-2007-1150

Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/...

CVE-2007-1149

Multiple directory traversal vulnerabilities in LoveCMS 1.4 allow remote attackers to read arbitrary files via a .. dot dot in 1 the step parameter to install/index.php or 2 the load parameter to the top-level URI...

Cross site scripting

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

CVE-2007-1151

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

CVE-2007-1148

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter...

CVE-2007-1151

CVE-2007-1151 describes a cross-site scripting (XSS) vulnerability in LoveCMS 1.4. The issue allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, with the vulnerability potentially related to a SQL error. The NVD entry lists the impact as Confi...

CVE-2007-1150

CVE-2007-1150 describes an unrestricted file upload vulnerability in LoveCMS 1.4. The issue allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/. The affected component is the LoveCMS content handling/upload path; the root cause is unrestricted fi...

CVE-2007-1149

CVE-2007-1149 affects LoveCMS 1.4 and is a directory traversal vulnerability. The issue allows remote attackers to read arbitrary files by supplying a .. (dot dot) traversal sequence in either (1) the step parameter to install/index.php or (2) the load parameter of the top-level URI. The connecte...