CVE-2006-6033

CVE-2006-6033 affects Simple PHP Blog (SPHPBlog), likely version 0.4.8. It enables directory traversal via a .. sequence in the blog_theme parameter in multiple PHP scripts (index.php, add_cgi.php, add_link.php, login.php, template.php, contact.php), allowing remote attackers to read arbitrary fi...

CVE-2006-6032

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog SPHPBlog, probably 0.4.8, allow remote attackers to inject arbitrary web script or HTML via 1 the action parameter in addblock.php or 2 the entry parameter in index.php, different vectors than CVE-2005-1135. NOTE: this has been...

sphpblog多个输入验证漏洞

Simple PHP Blog是一款无需数据库支持的简单Blog程序。 sphpblog中存在多个漏洞，起因是应用程序没有正确的验证用户输入。远程攻击者可以利用这些漏洞获取敏感信息或执行任意代码。 A. 完整路径泄漏 http://Url/sphpblog/scripts/sbfunctions.php Ex: Warning: mainscripts/sbfileio.php: failed to open stream: No such file or directory in /var/www/sphpblog/scripts/sbfunctions.php on line 52...

Directory traversal

Directory traversal vulnerability in install05.php in Simple PHP Blog SPB 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the bloglanguage parameter, as demonstrated by injecting PHP sequences in...

CVE-2006-1243

Directory traversal vulnerability in install05.php in Simple PHP Blog SPB 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the bloglanguage parameter, as demonstrated by injecting PHP sequences in...

CVE-2006-1243

Directory traversal vulnerability in install05.php in Simple PHP Blog SPB 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the bloglanguage parameter, as demonstrated by injecting PHP sequences in...

CVE-2006-1243

CVE-2006-1243 affects Simple PHP Blog (SPB) up to version 0.4.7.1, via install05.php. The vulnerability is a local file inclusion triggered by improper handling of the blog_language parameter, allowing directory traversal and a NUL character to force inclusion of arbitrary local files (demonstrat...

Simple PHP Blog < 0.4.7.2 install05.php Local File Inclusion

Binary data 3476.prm...

Simple PHP Blog install05.php blog_language Parameter Local File Inclusion

The version of Simple PHP Blog installed on the remote host fails to sanitize input to the 'bloglanguage' parameter of the 'install05.php' script before using it in a PHP 'requireonce' function. An unauthenticated attacker may be able to exploit this issue to view arbitrary files or to execute...

Simple PHP Blog <= 0.4.7.1 Remote Command Execution Exploit

Exploit for unknown platform in category web applications =========================================================== Simple PHP Blog this works with magicquotesgpc = Off\r\n\r\n"; short explaination: we have this code in install05.php: ... script is not deleted after installation, so, if...

Simple PHP Blog 0.4.7.1 - Remote Command Execution

Simple PHP Blog 0.4.7.1 - Remote Command Execution !/usr/bin/perl use IO::Socket; print "Simple PHP Blog this works with magicquotesgpc = Off\r\n\r\n"; short explaination: we have this code in install05.php: ... script is not deleted after installation, so, if magicquotesgpc = Off, you can includ...

Simple PHP Blog 0.4.7.1 - Remote Command Execution

!/usr/bin/perl use IO::Socket; print "Simple PHP Blog this works with magicquotesgpc = Off\r\n\r\n"; short explaination: we have this code in install05.php: ... script is not deleted after installation, so, if magicquotesgpc = Off, you can include an arbitrary file from local resources, poc:...

sBlog_0.72_xss.txt

sBlog 0.7.2 == Multiple Cross-Site Scripting Vulnerability =================================== Information of Software: Software: sBlog 0.7.2 Site: http://servous.se/ Description: sBlog is a simple and new PHP Blog. Is very very simple and it's use by newbie of PHP...

CVE-2005-3473

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog 0.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 entry, 2 blogsubject, and 3 blogtext parameters involving the tempsubject variable in a previewcgi.php and b previewstaticcgi.php, or 4...

CVE-2005-3473

The CVE-2005-3473 entry describes multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog

Simple PHP Blog: Multiple XSS Vulnerabilities

=========================================================== Simple PHP Blog: Multiple XSS Vulnerabilities =========================================================== Technical University of Vienna Security Advisory TUVSA-0511-001, November 2, 2005...

TUVSA-0511-001.txt

=========================================================== Simple PHP Blog: Multiple XSS Vulnerabilities =========================================================== Technical University of Vienna Security Advisory TUVSA-0511-001, November 2, 2005...

Simple PHP Blog <= 0.4.5 SQL Injection

Binary data 3278.prm...

Simple PHP Blog 0.4 - preview_static_cgi.php Multiple Cross-Site Scripting Vulnerabilities

Simple PHP Blog 0.4 - previewstaticcgi.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/15283/info Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize...

Simple PHP Blog 0.4 - 'preview_static_cgi.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/15283/info Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed i...