PHP-Fusion Mod avatar_studio LFI

Exploit for unknown platform in category web applications ================================ PHP-Fusion Mod avatarstudio LFI ================================ Tested on: Spanish version By modifying "avatarstudio" parameter at POST data at avatarstudio.php you can retrieve all images at that dir. Al...

PHP-Fusion Mod avatar_studio - Local File Inclusion

Tested on: Spanish version By modifying "avatarstudio" parameter at POST data at avatarstudio.php you can retrieve all images at that dir. Also using "avatarselect" you can add yourself a file as avatar which may not be .jpg Proof of concept: POST /infusions/avatarstudio/avatarstudio.php HTTP/1.1...

Interspire Shopping Cart Full Path Disclosure

Exploit for unknown platform in category web applications ============================================= Interspire Shopping Cart Full Path Disclosure ============================================= Exploit Title: Interspire Shopping Cart Full Path Disclosure Date: 13-12-2009 Author: Mr.aFiR Softwar...

Interspire Shopping Cart - Full Path Disclosure

Interspire Shopping Cart - Full Path Disclosure Exploit Title: Interspire Shopping Cart Full Path Disclosure Date: 13-12-2009 Author: Mr.aFiR Software Link: http://www.interspire.com/ Version: N/A Tested on: GNU/LINUX CVE : N/A Code : N/A / \ / \ / \ | | |/ | | | Y Y | V\ / Y| || |/ / A ||| \ | |...

Interspire Shopping Cart Full Path Disclosure

No description provided by source. Exploit Title: Interspire Shopping Cart Full Path Disclosure Date: 13-12-2009 Author: Mr.aFiR Software Link: http://www.interspire.com/ Version: N/A Tested on: GNU/LINUX CVE : N/A Code : N/A / \ / \ / \ | | |/ | | | Y Y | V\ / Y| || |/ / A ||| \ | | | | || || ...

NetClassifieds (SQL/XSS/Full Path) Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ================================================================== NetClassifieds SQL/XSS/Full Path Multiple Remote Vulnerabilities ================================================================== Application: NetClassifieds: -Free Editi...

PHP Hash_Update_File释放资源访问代码执行漏洞

PHP是一款广泛使用的WEB开发脚本语言。 PHP hashupdatefile存在设计错误，远程攻击者可能利用此漏洞获得对释放内存的访问并使用恶意数据覆盖而执行任意代码。 问题存在于GD函数中，在通过资源识别器获得资源数据后，可能用usercode来中断PHP函数，usercode就会会破坏资源，并获取与其内存相同位置来分配PHP字符串相同大小的空间作为释放资源。这个字符串可以用于建立特定构建的资源，以允许利用内部PHP函数，当恶意中断终止函数时，会继续使用替代资源数据。导致任意代码执行。 要获得需要的函数中断，通常需要放置对象到函数的某个参数中，这会在转化一个超长值时触发PHP错误。...

sof-multi.txt

local file include: /gallery.php?f=../../../../../../../../../../../../etc/passwd xss via php error : /gallery.php?f='"alertdocument.cookie regards laurent gaffié...

somechess.txt

Somechess v1.5 rc1 Homepage: http://www.astrodogpress.org/chess/ Affected files: Profile input boxes ----------------------- Upon dumping the sql data into the table if you get errors and it wont create the tables & data like it did to me, then just remove all the " from the sql file. You'll also...

Design/Logic Flaw

fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message...

CVE-2006-1119

fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message...

CVE-2006-1119

fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message...

CVE-2006-1119

fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message...

CVE-2006-1119: Undefined Security Weakness

fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message...

Fullpath disclosure in roundcube webmail

I try this request in my mailbox http://xxxx.com/roundcube/?auth=3Dcf559dcf52d8801ccd51cd1f3ba3eca08d1b0bce= &task=3Dma60il then roundcube shows this warning PHP Error in /usr/local/apache2/htdocs/roundcube/index.php 301: Invalid request failed/file not found The requested page was not found!...

CVE-2005-4172

eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information via a direct request to storyblock.php without arguments, which leaks the full pathname in the resulting PHP error message...

CVE-2005-4172: Undefined Security Weakness

eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information via a direct request to storyblock.php without arguments, which leaks the full pathname in the resulting PHP error message...

FreeBSD : phpmyadmin -- information disclosure vulnerability (a7062952-9023-11d9-a22c-0001020eed82)

A phpMyAdmin security announcement reports : By calling some scripts that are part of phpMyAdmin in an unexpected way especially scripts in the libraries subdirectory, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmi...

CVE-2005-1963

Cerberus Helpdesk 0.97.3 allows remote attackers to obtain sensitive information via certain requests to 1 reports.php, 2 knowledgebase.php, or 3 configuration.php, which leaks the information in a PHP error message...

CVE-2005-1963

Cerberus Helpdesk 0.97.3 allows remote attackers to obtain sensitive information via certain requests to 1 reports.php, 2 knowledgebase.php, or 3 configuration.php, which leaks the information in a PHP error message...