PHP Arena 1.1.3 - 'pafiledb.php' Remote Change Password

!/usr/bin/perl T r a p - S e t U n d e r g r o u n d H a c k i n g T e a m EXPLOIT FOR: PHP Arena paFileDB 1.1.3 And 0lder Expl0it By: A l p h a P r o g r a m m e r Sirus-v Email: [email protected] + Discovered By: GulfTech + Advisory: https://www.securityfocus.com/bid/13967 Vulnerabl...

CVE-2004-1975

Cross-site scripting XSS vulnerability in the category module in pafiledb.php for paFileDB 3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a vulnerability that is closely related to CVE-2004-1551...

CVE-2004-1975

The CVE-2004-1975 issue affects paFileDB 3.1 and specifically the category module (pafiledb.php) . It is an XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the id parameter . The vulnerability is described as closely related to CVE-2004-1551. No further t...

CVE-2004-1974

paFileDB 3.1 allows remote attackers to gain sensitive information via a direct request to 1 login.php, 2 category.php, 3 search.php, 4 main.php, 5 viewall.php, 6 download.php, 7 email.php, 8 file.php, 9 rate.php, or 10 stats.php, which reveals the path in an error message...

CVE-2004-1974

paFileDB 3.1 is affected by an information disclosure vulnerability where remote attackers can learn sensitive path information by issuing direct requests to pages (login.php, category.php, search.php, main.php, viewall.php, download.php, email.php, file.php, rate.php, stats.php). The underlying ...

CVE-2005-0724

paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via 1 an invalid str parameter to pafiledb.php, or a direct request to 2 viewall.php, 3 stats.php, 4 search.php, 5 rate.php, 6 main.php, 7 license.php, 8 category.php, 9 download.php, 10 file.php, 11 email.php, or 12...

CVE-2005-0781

SQL injection vulnerability in 1 viewall.php and 2 category.php in paFileDB 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter to pafiledb.php...

CVE-2005-0952

Cross-site scripting vulnerability in pafiledb.php in PaFileDB 3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2005-0782

Cross-site scripting XSS vulnerability in 1 viewall.php and 2 category.php for paFileDB 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the start parameter to pafiledb.php...

CVE-2005-0326

pafiledb.php in PaFileDB 3.1 allows remote attackers to gain sensitive information via an invalid or missing action parameter, which reveals the path in an error message when it cannot include a login.php script...

CVE-2005-0327

pafiledb.php in Pafiledb 3.1 may allow remote attackers to execute arbitrary PHP code via a modified action parameter that is used in an include statement for login.php...

paFileDB31XSS.txt

Vulnerable System : paFileDB 3.1 and less exploit : http://target/pafiledb.php?action="alertdocument.cookie discovered by : neO SecurityGurus Team www.securitygurus.net...

PaFileDB.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Severity: Medium Title: PaFileDB Version 3.1 and below are exploitable via a XSS and a SQL injection vulnerability Date: 31/03/2005 Vendor: PhpArena Vendor...

Pafiledb ACTION Parameter XSS

Vulnerable System : paFileDB 3.1 and less exploit : http://target/pafiledb.php?action="scriptalertdocument.cookie/script discovered by : neO SecurityGurus Team www.securitygurus.net...

CVE-2005-0952

Cross-site scripting vulnerability in pafiledb.php in PaFileDB 3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2005-0952

CVE-2005-0952 describes a cross-site scripting vulnerability in the PaFileDB 3.1 web application, specifically in pafiledb.php where the attacker can inject arbitrary script via the id parameter. The vulnerability is documented across multiple sources (NVD/Nessus/NVD CVE record). Exploitation cou...

PaFileDB Version 3.1 and below are exploitable via a XSS and a SQL injection vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Severity: Medium Title: PaFileDB Version 3.1 and below are exploitable via a XSS and a SQL injection vulnerability Date: 31/03/2005 Vendor: PhpArena Vendor...

CVE-2005-0780

paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 auth.php, 2 login.php, 3 category.php, 4 file.php, 5 team.php, 6 license.php, 7 custom.php, 8 admins.php, or 9 backupdb.php, which reveal the path in a PHP error message...

CVE-2005-0781

SQL injection vulnerability in 1 viewall.php and 2 category.php in paFileDB 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter to pafiledb.php...

CVE-2005-0782

CVE-2005-0782 is a cross-site scripting (XSS) vulnerability in paFileDB 3.1 and earlier, affecting viewall.php and category.php. The start parameter to pafiledb.php enables remote attackers to inject arbitrary script/HTML. The NVD entry notes MEDIUM impact (I partial) with CVSS v2.0 base score 4....