CVE-2007-5572

Multiple cross-site request forgery CSRF vulnerabilities in Simple PHP Blog SPHPBlog 0.4.9 allow remote attackers to perform delete actions as administrators via 1 the blockid parameter to addblock.php or 2 the linkid parameter to addlink.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Simple PHP Blog SPHPBlog 0.4.9 allow remote attackers to perform delete actions as administrators via 1 the blockid parameter to addblock.php or 2 the linkid parameter to addlink.php...

CVE-2007-5572

Multiple cross-site request forgery CSRF vulnerabilities in Simple PHP Blog SPHPBlog 0.4.9 allow remote attackers to perform delete actions as administrators via 1 the blockid parameter to addblock.php or 2 the linkid parameter to addlink.php...

CVE-2007-5572

The provided records identify CVE-2007-5572 as CSRF vulnerabilities in Simple PHP Blog (SPHPBlog) 0.4.9. The affected component is the blog’s admin-facing functionality, where remote attackers could trigger delete actions by supplying (1) block_id to add_block.php or (2) link_id to add_link.php. ...

sphpblog-multi.txt

Secure Network - Security Research Advisory Vuln name: Simple PHP Blog Multiple Vulnerabilities Systems affected: simplePHPBlog 0.5.0.1, simplePHPBlog 0.4.8 and all previous versions Systems not affected: - Severity: Medium Local/Remote: Remote Vendor URL: http://www.simplephpblog.com/ Authors:...

Simple PHP Blog Multiple Vulnerabilities

Secure Network - Security Research Advisory Vuln name: Simple PHP Blog Multiple Vulnerabilities Systems affected: simplePHPBlog 0.5.0.1, simplePHPBlog 0.4.8 and all previous versions Systems not affected: - Severity: Medium Local/Remote: Remote Vendor URL: http://www.simplephpblog.com/ Authors:...

CVE-2007-5071

Incomplete blacklist vulnerability in uploadimgcgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE: the vulnerability wa...

Design/Logic Flaw

Incomplete blacklist vulnerability in uploadimgcgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE: the vulnerability wa...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog SPHPBlog before 0.5.1, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via certain usercolors array parameters to certain userstyle.php files under themes/, as demonstrated by the...

CVE-2007-5071

CVE-2007-5071 is an incomplete blacklist vulnerability in Simple PHP Blog. The flaw lies in upload_img_cgi.php on versions before 0.5.1, allowing remote attackers to upload dangerous files (e.g., PHP files or .htaccess) and execute arbitrary code, demonstrated by such filenames. This describes a ...

CVE-2007-5072

CVE-2007-5072 affects the Simple PHP Blog (SPHPBlog) prior to version 0.5.1. The root cause is cross-site scripting (XSS) vulnerabilities that occur when register_globals is enabled, allowing remote attackers to inject arbitrary web script or HTML via certain user_colors array parameters to files...

CVE-2007-5071

Incomplete blacklist vulnerability in uploadimgcgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE: the vulnerability wa...

CVE-2007-5072

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog SPHPBlog before 0.5.1, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via certain usercolors array parameters to certain userstyle.php files under themes/, as demonstrated by the...

SimplePHPBlog Hacking

How to hack a server with Simple PHP Blog uploading an htacess file from imguploadcgi.php page. Tested on v0.4.9 by Demential http://www.hackish.eu mailto: [email protected] video here: http://hackish.eu/video/phpblog.avi vlc download: http://www.videolan.org/vlc/...

CVE-2007-3198

Cross-site scripting XSS vulnerability in comments.php in Maran PHP Blog Maran Blog, possibly only versions before 20070610, allows remote attackers to inject arbitrary web script or HTML via the id parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in comments.php in Maran PHP Blog Maran Blog, possibly only versions before 20070610, allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2007-3198

CVE-2007-3198 is an XSS vulnerability in Maran PHP Blog (comments.php) where the id parameter can be exploited to inject arbitrary script/HTML. Affected versions are possibly before 2007-06-10. The issue allows remote attackers to execute script in the context of the victim’s browser; impact per ...

CVE-2007-3198

Cross-site scripting XSS vulnerability in comments.php in Maran PHP Blog Maran Blog, possibly only versions before 20070610, allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2006-6032

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog SPHPBlog, probably 0.4.8, allow remote attackers to inject arbitrary web script or HTML via 1 the action parameter in addblock.php or 2 the entry parameter in index.php, different vectors than CVE-2005-1135. NOTE: this has been...

CVE-2006-6033

Multiple directory traversal vulnerabilities in Simple PHP Blog SPHPBlog, probably 0.4.8, allow remote attackers to read arbitrary files and possibly include arbitrary PHP code via a .. dot dot sequence in the blogtheme parameter in 1 index.php, 2 addcgi.php, 3 addlink.php, 4 login.php, 5...