NewsPHP - index.php Multiple SQL Injections

NewsPHP - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/16339/info NewsPHP is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...

CVE-2004-2690

Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files...

CVE-2004-2688

Cross-site scripting XSS vulnerability in index.php in NewsPHP allows remote attackers to inject arbitrary web script or HTML via the catid parameter. NOTE: this issue might overlap vector 3 in CVE-2006-3358...

CVE-2004-2689

NewsPHP allows remote attackers to gain unauthorized administrative access by setting a cookie to the "autorized=admin; root=admin" value...

[UNIX] Multiple Vulnerabilities in NewsPHP (Admin Privileges, File Upload, XSS)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2003-0753

nphpd.php in newsPHP 216 and earlier allows remote attackers to read arbitrary files via a full pathname to the target file in the nphpconfigLangFile parameter...

CVE-2003-0754

nphpd.php in newsPHP 216 and earlier allows remote attackers to bypass authentication via an HTTP request with a modified nphpusers array, which is used for authentication...

CVE-2003-0753

CVE-2003-0753 affects nphpd.php in newsPHP 216 and earlier. The issue allows remote attackers to read arbitrary files by supplying a full pathname to the target file in the nphp_config[LangFile] parameter, exposing confidential data. The provided documents corroborate the vulnerability descriptio...

CVE-2003-0753

nphpd.php in newsPHP 216 and earlier allows remote attackers to read arbitrary files via a full pathname to the target file in the nphpconfigLangFile parameter...

CVE-2003-0754

CVE-2003-0754 concerns nphpd.php in newsPHP 216 and earlier where remote attackers can bypass authentication by sending an HTTP request that uses a modified nphp_users array. The root cause is insufficient validation of the authentication data, allowing an attacker-controlled user list to grant a...

CVE-2003-0754

nphpd.php in newsPHP 216 and earlier allows remote attackers to bypass authentication via an HTTP request with a modified nphpusers array, which is used for authentication...

newsPHP file inclusion & bad login validation

newsPHP arbitary file inclusion & bad login validation ===+++===+++===+++ Product: newsPHP Version: = v216 Vendor: http://www.nphp.net Author: Officerrr [email protected] Discover by: Officerrr [email protected] Vendor Response: Not contacted yet... ===+++===+++===+++ Problem 1:...

newsPHP 216 - Remote File Inclusion

newsPHP 216 - Remote File Inclusion source: https://www.securityfocus.com/bid/8488/info A file include vulnerability has been reported in the nphpd.php module of newsPHP that may permit an attacker to include and execute malicious script code on a vulnerable host. The issue is reported to exist i...