CVE-2008-7268

SiteEngine 5.x is affected by CVE-2008-7268 via a phpinfo information-disclosure in misc.php when action=php_info is supplied, allowing remote attackers to obtain system information. The connected documents reiterate the description; no remediation patch/version is provided in the supplied source...

CVE-2008-7268: Exposure of Sensitive Information to an Unauthorized Actor

The phpinfo function in SiteEngine 5.x allows remote attackers to obtain system information by setting the action parameter to phpinfo in misc.php...

Sql injection

SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989, CVE-2006-2503, and CVE-2009-1033...

CVE-2010-4151

The CVE-2010-4151 entry corresponds to an SQL injection in DeluxeBB 1.3 (and possibly earlier) affecting misc.php, triggered when magic_quotes_gpc is disabled. The vulnerability allows remote attackers to manipulate the xthedateformat parameter in a register action and execute arbitrary SQL comma...

CVE-2010-4151: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989, CVE-2006-2503, and CVE-2009-1033...

vBulletin Cyb - Advanced Forum Statistics Denial Of Service

Exploit Title: vBulletin "Cyb - Advanced Forum Statistics" DOS Date: 10-4-2010 Author: Andhra Hackers Software Link: Version: Web Application Tested on: Apcahe/Unix CVE : if exists Code : PHP crashes existed from a long time back and there were several issues which were a reason for that. 1PHP pa...

vBulletin (Cyb - Advanced Forum Statistics) - misc.php Denial of Service

vBulletin Cyb - Advanced Forum Statistics - misc.php Denial of Service Exploit Title: vBulletin "Cyb - Advanced Forum Statistics" DOS Date: 10-4-2010 Author: Andhra Hackers Software Link: Version: Web Application Tested on: Apcahe/Unix CVE : if exists Code : PHP crashes existed from a long time...

CVE-2009-4468

Cross-site scripting XSS vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

Code injection

DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service CPU or...

CVE-2009-4468

DeluxeBB 1.3 is affected by a Cross-site Scripting (XSS) vulnerability in misc.php via the page parameter. This is a client-side script injection risk in the web interface. The CVE entry CVE-2009-4468 states the vulnerability allows remote attackers to inject arbitrary web script or HTML. Connect...

CVE-2009-4466

DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service CPU or...

CVE-2009-4468

Cross-site scripting XSS vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2009-4466

DeluxeBB 1.3 is affected by CVE-2009-4466, where a crafted value for the page parameter in misc.php can cause an information disclosure by revealing the installation path in an error message. The issue may stem from how tools.php handles computations, potentially contributing to a denial of servi...

CVE-2009-4466: Exposure of Sensitive Information to an Unauthorized Actor

DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service CPU or...

CVE-2009-4468: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2009-4467: Improper Input Validation

misc.php in DeluxeBB 1.3 allows remote attackers to register accounts without a valid email address via a valemail action with the valmem set to a pre-assigned user ID, which is visible from a memberlist action...

vBulletin misc.php Template Name Arbitrary Code Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'vBulletin...

DeluxeBB misc.php模块SQL注入漏洞

BUGTRAQ ID: 34174 DeluxeBB是一款基于PHP的论坛程序。 DeluxeBB的misc.php模块中没有正确地验证用户所提交的$qorder参数： $getsel = $db-query"SELECT FROM ".$prefix."users ".$qfilter." ".$qorder." == ".$sort." LIMIT ".$pageinfo0.",".$pageinfo1; 远程攻击者可以通过提交恶意的查询请求执行SQL注入攻击，导致读取论坛所有注册用户的用户名和口令MD5。 DeluxeBB = 1.3 厂商补丁：...

CVE-2009-1033

SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the qorder parameter, a different vector than CVE-2005-2989 and CVE-2006-2503...

CVE-2009-1033

CVE-2009-1033 affects DeluxeBB 1.3 and earlier. A SQL injection flaw in misc.php allows remote attackers to execute arbitrary SQL via the qorder parameter, as described in the connected documents. Exploit details and fixes are not provided here.