Sql injection

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis DFMSA, as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involvin...

CVE-2006-0727

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis DFMSA, as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involvin...

CVE-2006-0727

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis DFMSA, as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involvin...

CVE-2006-0727

CVE-2006-0727 describes a SQL injection in mstrack.php of MusOX DF MSAnalysis (DFMSA), used with CPG-Nuke Dragonfly CMS. An attacker can trigger path disclosure via a SQL syntax error and may be able to execute arbitrary SQL commands. The affected software is MusOX DF MSAnalysis as used in Dragon...

dotproject <= 2.0.1 remote code execution

dotproject = 2.0.1 remote code execution ====================================== Software: dotProject = 2.0.1 Severity: Arbitrary code execution, Path/Information Disclosure Risk: High Author: Robin Verton [email protected] Date: Feb. 14 2006 Vendor: dotproject.net contacted Description: dotProje...

dotProject-2.0.1.txt

dotproject Date: Feb. 14 2006 Vendor: dotproject.net contacted Description: dotProject is a volunteer supported Project Management application. Details: The 'protection.php' script does not properly validate user-supplied input in the 'siteurl' parameter. Some user-supplied input is not checked...

CVE-2006-0660

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to 1 read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or 2 include arbitrary files via the template parameter to...

Directory traversal

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to 1 read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or 2 include arbitrary files via the template parameter to...

Path traversal

MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax...

CVE-2006-0590

MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax...

CVE-2006-0590

MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax...

CVE-2006-0589

MyTopix 1.2.3 allows remote attackers to obtain the installation path via a direct request to logon.mod.php, which leaks the path in an error message...

CVE-2006-0590

The CVE-2006-0590 entry affects MyTopix 1.2.3, where a malformed hl parameter sent to index.php allows remote attackers to disclose the installation path. The underlying issue is described as path disclosure, with a note that it might be related to invalid SQL syntax. Public references in the rec...

kapda-26.txt

KAPDA New advisory Vendor: http://www.jaia-interactive.com Vulnerable: Version: 1.2.3 Bug: Sql Injection & Path Disclosure Exploitation: Remote with browser Description: -------------------- MyTopix is a PHP-based message board system that uses a MySQL database. Vulnerability: -------------------...

[KAPDA::#26] - MyTopix Sql Injection & Path Disclosure

KAPDA New advisory Vendor: http://www.jaia-interactive.com Vulnerable: Version: 1.2.3 Bug: Sql Injection & Path Disclosure Exploitation: Remote with browser Description: -------------------- MyTopix is a PHP-based message board system that uses a MySQL database. Vulnerability: -------------------...

CVE-2006-0519

SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message...

Limbo CMS Multiple Vulnerabilities

The remote host is running Limbo CMS, a content-management system written in PHP. The remote version of this software is vulnerable to several flaws including : - If registerglobals is off and Limbo is configured to use a MySQL backend, then a SQL injection is possible due to improper sanitizatio...

CVE-2006-0445

CVE-2006-0445 affects Phpclanwebsite 1.23.1. Affected component: uploader page handling on index.php. Description shows remote authenticated users can obtain the installation path by supplying an invalid filename (example: “\”), which displays the full path of uploader.php, suggesting a possible ...

CVE-2006-0327

TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to 1 thumbs.php, 2 showpic.php, or 3 tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails...

EZDatabase.txt

Synopsis: EZDatabase directory transversal, XSS and path disclosure vulnerability Product: EZDatabase http://www.ezdatabase.org Version: Confirmed on EZDatabase 2.1.2 Author: Josh Zlatin-Amishav Date: January 15, 2006 Background: Written in PHP and MySQL, ezDatabase is the foundation for your...