Code injection

Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into includes/Config.php via the default parameter...

CVE-2008-1860

LokiCMS versions 0.3.3 and earlier are affected by a static code injection vulnerability in admin.php, allowing remote attackers to inject arbitrary PHP into includes/Config.php via the default parameter. The issue arises from the underlying code path described in CVE-2008-1860 and is rated with ...

LightNEasy SQLite / no database <= 1.2.2 Multiple Remote Vulnerabilities

No description provided by source. Author: GiReX mySite: girex.altervista.org Date: 14/04/08 CMS: LightNEasy SQLite / no database = 1.2.2 Site: lightneasy.org Advisory: Multiple Remote Vulnerabilities Need: magicquotesgpc = Off magicquotesgpc = On / Off for SQL Injections Bug 1: Remote File...

CVE-2008-1860: Improper Control of Generation of Code

Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into includes/Config.php via the default parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

CVE-2008-1776

CVE-2008-1776 is a PHP remote file inclusion vulnerability in PhpBlock A8.4 where an attacker can cause arbitrary PHP code execution via a URL supplied to PATH_TO_CODE in modules/basicfog/basicfogfactory.class.php. Multiple sources (NVD entries and related records) confirm the vulnerable file and...

mumbojumbo-sql.txt

php '.$argv0.' http://www.site.com/cms/ 300 1 '; if $argc 1 printr' '; echo 'Searching for Admin: '; for$i=1; $i = 50; $i++ $temp1 = filegetcontents$argv1.'index.php?id='.$argv2.'+and+lengthselect+kennung+from+op4admin+where+id='.$argv3.'='.$i.'--'; if strpos$temp1,'Die angeforderte Seite existie...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Blogator-script before 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the inclpage parameter in 1 structadmin.php, 2 structadminblog.php, and 3 structmain.php in blogadata/include...

CVE-2008-1760: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Blogator-script before 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the inclpage parameter in 1 structadmin.php, 2 structadminblog.php, and 3 structmain.php in blogadata/include...

lokicms-exec.txt

Author: GiReX mySite: girex.altervista.org Date: 8/04/08 CMS: LokiCMS ; last if $cmd eq 'exit'; last if iserrorgetprint$host."includes/Config.php?cmd=$cmd"; print $resp; sub banner print "+ LokiCMS = 0.3.3 Rem...

CVE-2008-1712: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functionsweblog.php in mxBB mxblogs 2.0.0 beta allows remote attackers to execute arbitrary PHP code via a URL in the mxrootpath parameter...

LokiCMS <= 0.3.3 Remote Command Execution Exploit

Exploit for unknown platform in category web applications ================================================= LokiCMS = 0.3.3 Remote Command Execution Exploit ================================================= Author: GiReX Date: 8/04/08 CMS: LokiCMS = 0.3.3 Site: lokicms.com Bug: PHP Code Injection...

phpTournois G4 - Arbitrary File Upload Code Execution

phpTournois G4 - Arbitrary File Upload Code Execution Date: 04-06-08 - Remote Code Execution - Remote File Upload When testing if we are admin, phpTournois checks if $grade'a'=='a'. But when we are not loggued in, this var is not defined. So, using registerglobals, we can define it and let the CM...

LokiCMS 0.3.3 - Remote Command Execution

LokiCMS 0.3.3 - Remote Command Execution Author: GiReX mySite: girex.altervista.org Date: 8/04/08 CMS: LokiCMS ; last if $cmd eq 'exit'; last if iserrorgetprint$host."includes/Config.php?cmd=$cmd"; print $resp; sub banner print "+ LokiCMS = 0.3.3 Remo...

LokiCMS &lt;= 0.3.3 Remote Command Execution Exploit

No description provided by source. Author: GiReX mySite: girex.altervista.org Date: 8/04/08 CMS: LokiCMS = 0.3.3 Site: lokicms.com Bug: PHP Code Injection Exploit: Remote Command Execution Vuln Code: admin.php if $GET'default' != '' // User want's to set the default page writeconfig$cpassword,...

LokiCMS 0.3.3 - Remote Command Execution

Author: GiReX mySite: girex.altervista.org Date: 8/04/08 CMS: LokiCMS ; last if $cmd eq 'exit'; last if iserrorgetprint$host."includes/Config.php?cmd=$cmd"; print $resp; sub banner print "+ LokiCMS = 0.3.3 Remote Command Execution Exploit\n"; prin...

CVE-2008-1682: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in quiz/common/dbconfig.inc.php in the Online FlashQuiz comonlineflashquiz 1.0.2 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the basedir parameter...

CVE-2008-1622: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in GeeCarts allow remote attackers to execute arbitrary PHP code via a URL in the id parameter to 1 show.php, 2 search.php, and 3 view.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-1609: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in just another flat file JAF CMS 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 website parameter to a forum.php, b headlines.php, and c main.php in forum/, and 2 maindir parameter to forum/forum.php. NOTE: other...

PHPGKit 0.9 - 'connexion.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/28526/info PhpGKit is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute malicious PHP code in the context of the webserver process. This may allow the...