CVE-2007-4861

SAXON 5.4 is affected by multiple path disclosure flaws when display_errors is enabled. Exploitation vectors include direct requests to news.php, improper handling of newsid in admin/edit-item.php, and other scripts under admin/, rss/, and the installation root, which reveal server paths in error...

CVE-2007-4861

SAXON 5.4, with displayerrors enabled, allows remote attackers to obtain sensitive information via 1 a direct request for news.php, 2 an invalid use of a newsid array parameter to admin/edit-item.php, and possibly unspecified vectors related to additional scripts in 3 admin/, 4 rss/, and 5 the ro...

CVE-2007-5174

Directory traversal vulnerability in phpinc/news.php in actSite 1.56 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the do parameter...

CVE-2007-5174

Directory traversal vulnerability in phpinc/news.php in actSite 1.56 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the do parameter...

actSite 1.56 - news.php Local File Inclusion

actSite 1.56 - news.php Local File Inclusion '/ -.- -----------------oOO------OOo----------------- | actSite v1.56 news.php Local File Inclusion | | coded by DNX | ------------------------------------------------- ! Discovered: DNX ! Vendor: http://www.actsite.de ! Detected: 02.09.2007 ! Reported...

actSite 1.56 - 'news.php' Local File Inclusion

'/ -.- -----------------oOO------OOo----------------- | actSite v1.56 news.php Local File Inclusion | | coded by DNX | ------------------------------------------------- ! Discovered: DNX ! Vendor: http://www.actsite.de ! Detected: 02.09.2007 ! Reported: 02.09.2007 ! Remote: yes ! Background:...

TLM CMS SQL注入漏洞

TLM CMS是一款基于PHP的WEB应用程序。 TLM CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL攻击，获得敏感信息或操作数据库。 问题是由于脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，攻击者可以获得敏感信息或操作数据库。 TLM CMS 3.2 目前没有详细解决方案提供： http://tlm.hebserv.fr/home.php...

CVE-2007-4329

Multiple PHP remote file inclusion vulnerabilities in Web News 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the configrootordner parameter to 1 index.php, 2 news.php, or 3 feed.php...

Sql injection

Multiple SQL injection vulnerabilities in eSyndiCat allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to news.php or 2 the name parameter to page.php...

Sql injection

Multiple SQL injection vulnerabilities in Jasmine CMS 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the loginusername parameter to login.php or 2 the item parameter to news.php...

CVE-2007-3313

Multiple SQL injection vulnerabilities in Jasmine CMS 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the loginusername parameter to login.php or 2 the item parameter to news.php...

shnew31-rfi.txt

Found By : Hasadya Raed Contact : [email protected] --------------------------- Script : SH-News 3.1 Dork : "Powered by SH-News 3.1" Greetz : Guardian Information Systems --------------------------- B.Files : report.php archive.php comments.php init.php news.php Exploits :...

CVE-2007-2994

DGNews 2.1 contains a SQL injection vulnerability in news.php. Specifically, the vulnerability is exploitable via the newsid parameter in the fullnews action, allowing remote arbitrary SQL execution. This CVE is CVE-2007-2994; related CVE-2007-0693 covers a different vector (catid parameter in ne...

Design/Logic Flaw

DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...

Sql injection

SQL injection vulnerability in news.php in DGNews 2.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a newslist action. NOTE: this issue can produce resultant cross-site scripting XSS...

CVE-2007-0692

DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...

CVE-2007-0692

DGNews 2.1 is affected by a path-disclosure vulnerability (CVE-2007-0692) in news.php (fullnews) when an invalid newsid parameter is supplied, potentially revealing server paths via error messages. The issue is triggered by the fullnews/news.php flow and related error output, with the advisory no...

DGNews 1.5.1/2.1 - 'news.php' SQL Injection

source: https://www.securityfocus.com/bid/24201/info DGNews is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Successful exploits could allow an attacker to compromise the application, access or modif...

PT-2007-4165 · Saxon · Saxon

Name of the Vulnerable Software and Affected Versions: SAXON version 4.6 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the template parameter to specific PHP files, including 1 "news.php", 2 "preview.php", or 3 "archive-display.php". Recommendations: Fo...

Flexphpnews 0.0.5 (news.php newsid) Remote SQL Injection Vulnerability

.-""""""""-. / Dj7xpl | | |, .-. .-. ,| | o/ o | |/ / | @ ^^ |IIIIII|/ @8@8|-IIIIII/-| / / @ +Iranian Are The Best In World+ Portal.......: Flexphpnews version 0.0.5 Download.....: http://www.china-on-site.com/flexphpsite/other.php Author.......: Dj7xpl |...