Newsphp Multiple SQL Injection Vulnerabilities

Software: NewsPHP Web Site: http://www.newsphp.com Versions: All Type: Multiple SQL Injection Class: Remote Exploit : 1- http://www.target.com/index.php?discuss=SQL 2- http://www.target.com/index.php?tim=SQL 3- http://www.target.com/index.php?id=SQL 4-...

Sql injection

Multiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the 1 discuss, 2 tim, 3 id, 4 last, and 5 limit parameter...

CVE-2006-0413

Multiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the 1 discuss, 2 tim, 3 id, 4 last, and 5 limit parameter...

CVE-2006-0413

Multiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the 1 discuss, 2 tim, 3 id, 4 last, and 5 limit parameter...

CVE-2006-0413

NewsPHP is affected by multiple SQL injection vulnerabilities in index.php, exploitable via the (1) discuss, (2) tim, (3) id, (4) last, and (5) limit parameters. Remote attackers could execute arbitrary SQL commands due to unsafely constructed inputs in these parameters. The available documents d...

CVE-2006-0413: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the 1 discuss, 2 tim, 3 id, 4 last, and 5 limit parameter...

NewsPHP - index.php Multiple SQL Injections

NewsPHP - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/16339/info NewsPHP is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...

CVE-2004-2690

Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files...

CVE-2004-2688

Cross-site scripting XSS vulnerability in index.php in NewsPHP allows remote attackers to inject arbitrary web script or HTML via the catid parameter. NOTE: this issue might overlap vector 3 in CVE-2006-3358...

CVE-2004-2689

NewsPHP allows remote attackers to gain unauthorized administrative access by setting a cookie to the "autorized=admin; root=admin" value...

[UNIX] Multiple Vulnerabilities in NewsPHP (Admin Privileges, File Upload, XSS)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2003-0753

nphpd.php in newsPHP 216 and earlier allows remote attackers to read arbitrary files via a full pathname to the target file in the nphpconfigLangFile parameter...

CVE-2003-0754

nphpd.php in newsPHP 216 and earlier allows remote attackers to bypass authentication via an HTTP request with a modified nphpusers array, which is used for authentication...

CVE-2003-0753

CVE-2003-0753 affects nphpd.php in newsPHP 216 and earlier. The issue allows remote attackers to read arbitrary files by supplying a full pathname to the target file in the nphp_config[LangFile] parameter, exposing confidential data. The provided documents corroborate the vulnerability descriptio...

CVE-2003-0753

nphpd.php in newsPHP 216 and earlier allows remote attackers to read arbitrary files via a full pathname to the target file in the nphpconfigLangFile parameter...

CVE-2003-0754

CVE-2003-0754 concerns nphpd.php in newsPHP 216 and earlier where remote attackers can bypass authentication by sending an HTTP request that uses a modified nphp_users array. The root cause is insufficient validation of the authentication data, allowing an attacker-controlled user list to grant a...

CVE-2003-0754

nphpd.php in newsPHP 216 and earlier allows remote attackers to bypass authentication via an HTTP request with a modified nphpusers array, which is used for authentication...

CVE-2003-0754: Undefined Security Weakness

nphpd.php in newsPHP 216 and earlier allows remote attackers to bypass authentication via an HTTP request with a modified nphpusers array, which is used for authentication...

CVE-2003-0753: Undefined Security Weakness

nphpd.php in newsPHP 216 and earlier allows remote attackers to read arbitrary files via a full pathname to the target file in the nphpconfigLangFile parameter...

newsPHP file inclusion & bad login validation

newsPHP arbitary file inclusion & bad login validation ===+++===+++===+++ Product: newsPHP Version: = v216 Vendor: http://www.nphp.net Author: Officerrr [email protected] Discover by: Officerrr [email protected] Vendor Response: Not contacted yet... ===+++===+++===+++ Problem 1:...