CVE-2008-6614

CVE-2008-6614 affects Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5). The vulnerability arises in microcms-admin-login.php where remote attackers can inject SQL through (1) administrators_username or (2) administrators_pass, enabling arbitrary SQL execution. The reports consistently describe m...

CVE-2008-6614: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in microcms-admin-login.php in Implied By Design IBD Micro CMS 3.5 aka 0.3.5 allow remote attackers to execute arbitrary SQL commands via 1 the administratorsusername parameter aka the Username field or 2 the administratorspass parameter aka the Password fie...

CVE-2008-6553

microcms-admin-home.php in Implied by Design Micro CMS Micro-CMS 3.5 aka 0.3.5 does not require authentication as an administrator, which allows remote attackers to 1 create administrative accounts via an addadmin action, 2 remove administrative accounts via a deleteadmin action, and 3 modify...

CVE-2008-6553: Improper Authentication

microcms-admin-home.php in Implied by Design Micro CMS Micro-CMS 3.5 aka 0.3.5 does not require authentication as an administrator, which allows remote attackers to 1 create administrative accounts via an addadmin action, 2 remove administrative accounts via a deleteadmin action, and 3 modify...

CVE-2006-3144

The CVE-2006-3144 entry concerns a PHP remote file inclusion in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) and earlier. The vulnerability allows an attacker to execute arbitrary PHP code by supplying a URL in the microcms_path parameter; later reports note it can also be used to include an...

CVE-2006-3144: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in microcmsfiles/microcms-include.php in Implied By Design IBD Micro CMS 3.5 aka 0.3.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the microcmspath parameter. NOTE: it was later reported that this can also be leveraged to...