28 matches found
CVE-2005-1804
Multiple SQL injection vulnerabilities in Net Portal Dynamic System NPDS 5.0 allow remote attackers to execute arbitrary SQL commands via the 1 terme parameter in the glossaire module glossaire.php or 2 query parameter to links.php...
EUVD-2007-1628
Malware in sbrugna...
EUVD-2006-2947
Malware in sbrugna...
EUVD-2007-1629
Malware in sbrugna...
EUVD-2006-2949
Malware in sbrugna...
EUVD-2006-2948
Malware in sbrugna...
Net Portal Dynamic System <= 5.0 (register users) Denial of Service
No description provided by source. !/usr/bin/perl Type|+ Register multiple users for Denial of Service Vendor url|+ www.npds.org Little description|+ NPDS Net Portal Dynamic System is a Frenchand now English ! GNU dynamic portal Solution|+ None official but you can add a visual confirmation if yo...
Code injection
Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System NPDS 5.10 and earlier allows remote authenticated users to inject arbitrary PHP code via the xtop parameter in a "ConfigSave" op to admin.php, which can later be accessed via a "Configure" op to admin.php...
Sql injection
Variable extraction vulnerability in grabglobals.php in Net Portal Dynamic System NPDS 5.10 and earlier allows remote attackers to conduct SQL injection attacks via the FILESDBtmpname parameter to print.php, which overwrites the $DB variable with dynamic variable evaluation...
CVE-2007-1634
The CVE-2007-1634 entry relates to Net Portal Dynamic System (NPDS) versions up to 5.10, where grab_globals.php is vulnerable. Affected component/function: _FILES[DB][tmp_name] parameter to print.php, which overwrites the $DB variable via dynamic variable evaluation. Root cause: variable extracti...
CVE-2007-1635
Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System NPDS 5.10 and earlier allows remote authenticated users to inject arbitrary PHP code via the xtop parameter in a "ConfigSave" op to admin.php, which can later be accessed via a "Configure" op to admin.php...
npds-exec.txt
!/usr/bin/php Options OPTIONS | -proxy If you wanna use a proxy | -proxyauth Basic authentification ";exit1; $url = getparam'url',1; $pro = getparam'proxy'; $pra = getparam'proyauth'; $xpl = new phpsploit; $xpl-agent'Mozilla Firefox'; if$pro $xpl-proxy$pro; if$pra $xpl-proxyauth$pra; +print.php S...
Net Portal Dynamic System (NPDS) <= 5.10 Remote Code Execution
No description provided by source. !/usr/bin/php ?php errorreportingEALL ^ ENOTICE; Advisory soon if$argc 3 print" TITLE | Net Portal Dynamic System NPDS = 5.10 Remote Code Execution 0day AUTHOR | DarkFig / http://www.acid-root.new.fr / [email protected] NOTE | Works regardless of php settings...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Net Portal Dynamic System NPDS 5.10 and earlier allow remote attackers to inject arbitrary web script and HTML via the 1 Titlesitename or 2 sitename parameter to a header.php, 3 nukeurl parameter to b meta/meta.php, 4 forum parameter to c...
Design/Logic Flaw
Net Portal Dynamic System NPDS 5.10 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 header.php, 2 contact.php, or 3 forumextender.php, which reveals the path in an error message...
Directory traversal
Directory traversal vulnerability in Net Portal Dynamic System NPDS 5.10 and earlier allows remote attackers to read arbitrary files via a .. dot dot sequence and trailing null %00 byte in the 1 DefaultTheme parameter to header.php or 2 ModPath parameter to modules/cluster-paradise/cluster-E.php...
CVE-2006-2951
Multiple cross-site scripting XSS vulnerabilities in Net Portal Dynamic System NPDS 5.10 and earlier allow remote attackers to inject arbitrary web script and HTML via the 1 Titlesitename or 2 sitename parameter to a header.php, 3 nukeurl parameter to b meta/meta.php, 4 forum parameter to c...
CVE-2006-2952
Directory traversal vulnerability in Net Portal Dynamic System NPDS 5.10 and earlier allows remote attackers to read arbitrary files via a .. dot dot sequence and trailing null %00 byte in the 1 DefaultTheme parameter to header.php or 2 ModPath parameter to modules/cluster-paradise/cluster-E.php...
CVE-2006-2951
Multiple cross-site scripting XSS vulnerabilities in Net Portal Dynamic System NPDS 5.10 and earlier allow remote attackers to inject arbitrary web script and HTML via the 1 Titlesitename or 2 sitename parameter to a header.php, 3 nukeurl parameter to b meta/meta.php, 4 forum parameter to c...
CVE-2006-2952
The CVE-2006-2952 entry describes a directory traversal vulnerability in Net Portal Dynamic System (NPDS) versions 5.10 and earlier. The flaw allows remote attackers to read arbitrary files by crafting a .. (dot dot) path and a trailing null (%00) byte in specific parameters: (1) Default_Theme in...