EUVD-2011-0431

Malware in sbrugna...

PhpGedView module.php pgvaction Parameter Traversal Local File Inclusion

The web server hosts PhpGedView, a web-based real estate listing management application written in PHP. The version of PhpGedView installed on the remote host fails to sanitize user input to the 'pgvaction' parameter of the 'module.php' script before using it to include PHP code. Regardless of...

Directory traversal

Directory traversal vulnerability in module.php in PhpGedView 4.2.3 and possibly other versions, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the pgvaction parameter...

CVE-2011-0405: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in module.php in PhpGedView 4.2.3 and possibly other versions, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the pgvaction parameter...

PT-2011-2326

Name of the Vulnerable Software and Affected Versions PhpGedView version 4.2.3 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the module.php file when magic quotes gpc is disabled. This can be achieved by using directory travers...