CVE-2009-0735

Directory traversal vulnerability in lib/classes/messageclass.php in Papoo CMS 3.6, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to read and possibly execute arbitrary files via a .. dot dot in the pfadhier parameter. NOTE: some of these details are...

CVE-2009-0735: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in lib/classes/messageclass.php in Papoo CMS 3.6, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to read and possibly execute arbitrary files via a .. dot dot in the pfadhier parameter. NOTE: some of these details are...

Papoo CMS 3.x (pfadhier) Local File Inclusion Vulnerability

No description provided by source. + Papoo CMS 3.6 Local File Inclusion + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + www.hellzone.info + Script Homepage : http://www.papoo-cms.com/ + Local File Inclusion - PoC : http://127.0.0.1/path/lib/classes/messageclass.php?pfadhier=Local...

Papoo CMS 3.x - pfadhier Local File Inclusion

Papoo CMS 3.x - pfadhier Local File Inclusion + Papoo CMS 3.6 Local File Inclusion + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + www.hellzone.info + Script Homepage : http://www.papoo-cms.com/ + Local File Inclusion - PoC :...

Papoo CMS 3.6 Local File Inclusion

Papoo CMS 3.6 Local File Inclusion + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + www.hellzone.info + Script Homepage : http://www.papoo-cms.com/ + Local File Inclusion - PoC : http://127.0.0.1/path/lib/classes/messageclass.php?pfadhier=Local File%00 - Example :...

Papoo CMS 3.x - 'pfadhier' Local File Inclusion

Papoo CMS 3.6 Local File Inclusion + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + www.hellzone.info + Script Homepage : http://www.papoo-cms.com/ + Local File Inclusion - PoC : http://127.0.0.1/path/lib/classes/messageclass.php?pfadhier=Local File%00 - Example :...

Papoo CMS 3.x (pfadhier) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications =========================================================== Papoo CMS 3.x pfadhier Local File Inclusion Vulnerability =========================================================== + Papoo CMS 3.6 Local File Inclusion + Discovered By SirGod +...

CVE-2008-3724

SQL injection vulnerability in index.php in Papoo before 3.7.2 allows remote attackers to execute arbitrary SQL commands via the suchanzahl parameter...

Sql injection

SQL injection vulnerability in index.php in Papoo before 3.7.2 allows remote attackers to execute arbitrary SQL commands via the suchanzahl parameter...

CVE-2008-3724

SQL injection vulnerability in index.php in Papoo before 3.7.2 allows remote attackers to execute arbitrary SQL commands via the suchanzahl parameter...

CVE-2008-3724

This CVE affects Papoo’s web application prior to version 3.7.2, where an SQL injection flaw exists in index.php exploitable via the suchanzahl parameter. The root cause is a vulnerable handling of input in index.php allowing remote arbitrary SQL execution. The vulnerability is documented in sour...

CVE-2008-3724: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Papoo before 3.7.2 allows remote attackers to execute arbitrary SQL commands via the suchanzahl parameter...

CVE-2007-3494

Papoo CMS 3.6, and possibly earlier, does not verify user privileges when accessing the backend administration plugins, which allows remote authenticated users to 1 read the entire database by accessing the database backup plugin via a devtools/templates/newdumpbackend.html argument in the templa...

Code injection

Papoo CMS 3.6, and possibly earlier, does not verify user privileges when accessing the backend administration plugins, which allows remote authenticated users to 1 read the entire database by accessing the database backup plugin via a devtools/templates/newdumpbackend.html argument in the templa...

CVE-2007-3494

Papoo CMS 3.6, and possibly earlier, does not verify user privileges when accessing the backend administration plugins, which allows remote authenticated users to 1 read the entire database by accessing the database backup plugin via a devtools/templates/newdumpbackend.html argument in the templa...

CVE-2007-3494

CVE-2007-3494 affects Papoo CMS 3.6 and possibly earlier. The vulnerability stems from a missing privilege check in backend administration plugin access (via interna/plugin.php and a devtools/templates/newdump_backend.html argument), enabling remote authenticated users to perform actions beyond t...

CVE-2007-3494: Undefined Security Weakness

Papoo CMS 3.6, and possibly earlier, does not verify user privileges when accessing the backend administration plugins, which allows remote authenticated users to 1 read the entire database by accessing the database backup plugin via a devtools/templates/newdumpbackend.html argument in the templa...

Sql injection

SQL injection vulnerability in Papoo 3.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the selmenuid parameter to certain components...

CVE-2007-3453

SQL injection vulnerability in Papoo 3.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the selmenuid parameter to certain components...

Papoo 1.0.3 - 'Plugin.php' Authentication Bypass

source: https://www.securityfocus.com/bid/24634/info Papoo is prone to an authentication-bypass vulnerability because the application fails to check user privileges when accessing the administration pages. An attacker can exploit this issue to gain access to administration plugins. This may lead ...