FreeBSD : wordpress -- full path disclosure (e0b342a1-d2ae-11da-a672-000e0c2e438a)

Dedi Dwianto reports : A remote user can access the file directly to cause the system to display an error message that indicates the installation path. The resulting error message will disclose potentially sensitive installation path information to the remote attacker. %NASLMINLEVEL 70300 C Tenab...

FreeBSD : phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution (c6b9aee8-3071-11da-af18-000ae4641456)

If magic quotes are off there's a SQL injection when sending a forgotten password. It's possible to overwrite the admin password and to take over the whole system. In some files in the admin section there are some cross site scripting vulnerabilities. In the public frontend it's possible to inclu...

CVE-2006-2347

E-Business Designer eBD 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via "'" characters, and possibly other invalid values, in 1 the id parameter to formgrupo.html, or requests to the 2 archivos/ and 3 files/ directories. NOTE: this issue might be resultant...

CVE-2006-2278

SaphpLesson 3.0 does not initialize array variables, which allows remote attackers to obtain the full path via an non-array 1 hrow parameter to a show.php or b index.php; the 2 Lsnrow parameter to c showcat.php; or the 3 rows parameter to index.php...

[Full-disclosure] phpBB 2.0.20 Full Path Disclosure and SQL Errors

Source: http://securityreason.com/achievementsecurityalert/38 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpBB 2.0.20 Full Path Disclosure and SQL Errors Author: Maksymilian Arciemowicz cXIb8O3 Date: - -Written: 1.5.2006 - -Public: 5.5.2006 from SecurityReason.Com CVE: - - CVE-2006-2219 Full...

CuteNews 1.4.1 Multiple vulnerabilities

/ --------------------------------------------------------------- Neo Security Team NST® Advisory 20 --------------------------------------------------------------- Program : CuteNews 1.4.1 Homepage: http://www.cutephp.com Vulnerable Versions: CuteNews 1.4.1 & lower ones Risk: Medium! Impact: Cro...

neo-Advisory-20.txt

/ --------------------------------------------------------------- Neo Security Team NST® Advisory 20 --------------------------------------------------------------- Program : CuteNews 1.4.1 Homepage: http://www.cutephp.com Vulnerable Versions: CuteNews 1.4.1 & lower ones Risk: Medium! Impact: Cro...

CVE-2006-2216

Open Bulletin Board (OpenBB) 1.0.8 is affected by a path-disclosure vulnerability. An invalid pforums parameter to misc.php and member.php can reveal the web server’s full filesystem path to remote attackers. This is a client-accessible information disclosure issue stemming from the handling of t...

CVE-2006-2216

Open Bulletin Board OpenBB 1.0.8 allows remote attackers to obtain the full path of the web server via an invalid pforums parameter to 1 misc.php and 2 member.php...

sBlog.txt

Product : sBlog 0.7.2 Vulnerability :sBlog SQL Injection and Path Disclosure Vulnerability Date of Disclosure : 02/05/06 Bugtraq ID : 17782 Summary: Software: sBlog 0.7.2 Site: http://servous.se/ Description: sBlog is a simple and new PHP Blog. Issue: Conducting a security benchmark on this open...

zenphotoXSS.txt

Hi all, I've found several vulnerabilities in zenphoto, which is a great and simple photo gallery. I notified the team a month ago, and the new release zenphoto 1.0.2 beta fixes all the vulnerabilities. Thanks to the team for their great application and the fixes...

Sql injection

Multiple SQL injection vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 categoryid parameter in a storespecialoffers.php and b store.php, and 2 prodid parameter in c cart.php and d productinfo.php. NOTE: this issue also...

CVE-2006-2189

SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: this issue can be used to trigger path disclosure. In addition, it might be primary to vector 1 in CVE-2006-1135...

Sql injection

SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: this issue can be used to trigger path disclosure. In addition, it might be primary to vector 1 in CVE-2006-1135...

CVE-2006-2189

The CVE-2006-2189 issue affects sBlog 0.7.2, where search.php’s keyword parameter is not properly sanitized, allowing remote attackers to inject and execute arbitrary SQL commands. The vulnerability can also enable path disclosure as noted, indicating potential broader disclosure implications. Th...

CVE-2006-2189

SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: this issue can be used to trigger path disclosure. In addition, it might be primary to vector 1 in CVE-2006-1135...

CVE-2006-2164

Multiple SQL injection vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 categoryid parameter in a storespecialoffers.php and b store.php, and 2 prodid parameter in c cart.php and d productinfo.php. NOTE: this issue also...

sBlog SQL Injection and Path Disclosure Vulnerability

Summary: Software: sBlog 0.7.2 Site: http://servous.se/ Description: sBlog is a simple and new PHP Blog. Issue: Conducting a security benchmark on this open source software we have found that most of the versions of this software is prone to SQL Injection attack through which an attacker can...

zenphoto Multiple Path Disclosure and Cross Site Scripting Vulnerabilities

Hi all, I've found several vulnerabilities in zenphoto, which is a great and simple photo gallery. I notified the team a month ago, and the new release zenphoto 1.0.2 beta fixes all the vulnerabilities. Thanks to the team for their great application and the fixes...

OpenBB 1.0.8 Full Path Disclosure

OpenBB 1.0.8 Full Path Disclosure Bug Found By :- Devil-00 Gr33tz :- Www.securitygurus.neT Rock Master Hackers Pal n0m3rcy -= 1-2 =- Full Path Disclosure Exploits :- /OpenBB/misc.php?action=latest&pforums=D3vil-0x1 /OpenBB/member.php?action=online&&pforums=D3vil-0x1 Fix It :- misc.php Add This Li...