CVE-2006-7049

The Method method in WikkaWiki Wikka Wiki before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files...

CVE-2006-7049

The Method method in WikkaWiki Wikka Wiki before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files...

Discloser远程文件包含漏洞

Discloser是一款基于PHP的WEB应用程序。 Discloser不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'content.php'和'indexhead.php'脚本对用户提交的'fileloc'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Discloser Discloser 0.0.4 http://optusnet.dl.sourceforge.net/sourceforge/discloser/...

CVE-2006-6347

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

PT-2006-6801 · Active Php · Active Php Bookmarks

Name of the Vulnerable Software and Affected Versions: Active PHP Bookmarks version 1.1.02 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the APB SETTINGS'apb path' parameter in 1 apb common.php or 2 apb.php. However, it is noted that the PHP scripts exi...

XSS in script Mobile

Discovered : SwEET-DeViL & HaCkEr sUn Product: http://www.ac4p.com tame : AL-garnei :::::::::::::::::::::::::::::::::::::::::: /1/ index.php http://www.site.com/path/index.php?Bloks=XSS http://www.site.com/path/index.php?Newnews=XSS http://www.site.com/path/index.php?lBlok=XSS...

AFGB GUESTBOOK 2.2 (Htmls) Remote File Include Vulnerabilities

No description provided by source. afgb GUESTBOOK V2.2 Htmls Remote File Include Vulnerability Turkish Hacker's Discovered By : mdX ------------------------------------------------------ Cyber-Warrior TIM Ay ve YIldIzlar Geceye YakISIr... the moon and the stars suit the night Class : REmote File...

CVE-2006-5027

CVE-2006-5027 affects JevonCMS (possibly pre-alpha). An attacker can remotely obtain sensitive information by directly requesting specific PHP include files (php/main/phplib files: db_msql.inc, db_mssql.inc, db_mysql.inc, db_oci8.inc, db_odbc.inc, db_oracle.inc, db_pgsql.inc, and db_sybase.inc). ...

PT-2006-5603 · Hitweb · Hitweb

Name of the Vulnerable Software and Affected Versions: Hitweb versions 3.0 Description: The issue concerns remote file inclusion vulnerabilities in Hitweb 3.0, allowing remote attackers to execute arbitrary PHP code. This is achieved by providing a URL in the REP CLASS parameter to various PHP...

CVE-2006-4743

CVE-2006-4743 affects WordPress 2.0.2 through 2.0.5, allowing remote attackers to obtain sensitive information by requesting specific PHP files (e.g., 404.php, akismet.php, archive.php, etc.), which causes error messages that reveal internal paths. The connected documents corroborate the list of ...

PT-2006-5352 · Yacs · Yacs Cms

Name of the Vulnerable Software and Affected Versions: YACS CMS version 6.6.1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the contextpath to root parameter in several PHP files, including "articles/populate.php", "categories/category.php",...

Tons of SQL-injections and XSS in Eichhorn Portal and vendor page

Hi list. There are lots of SQL injections and XSS in the 'Eichhorn Portal' by 'Guder und Koch Netzwerktechnik' and their own website. Input passed to multiple parameters in different PHP-files isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary...

Chaussette 080706 - _BASE Remote File Inclusion

Chaussette 080706 - BASE Remote File Inclusion Chaussette Remote File Inclusion CreW: ToXiC Bug Found By Drago84 Source Code: http://freshmeat.net/redir/chaussette/64502/urlzip/chaussette.zip Page Affect /Classes/Evenement.php /Classes/Event.php /Classes/Eventformonth.php...

CVE-2006-3884

Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 offset and 2 limit parameters, 3 newdays parameter in a new action, and the 4 linkid parameter in a deadlink action. NOTE: this issue can also be used...

CVE-2006-3884

Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 offset and 2 limit parameters, 3 newdays parameter in a new action, and the 4 linkid parameter in a deadlink action. NOTE: this issue can also be used...

PT-2006-4402 · Bosclassifieds · Bosclassifieds Classified Ads

Name of the Vulnerable Software and Affected Versions: BosClassifieds Classified Ads affected versions not specified Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the insPath parameter to various PHP files, including "index.php", "recent.php",...

free QBoard v1.1 Multiple Remote File include

free QBoard v1.1 Multiple Remote File include ------------------------------------------------- Discovered By CrAshoVeRrIdE Arabian Security Team ------------------------------------------------- site of script:http://sourceforge.net/projects/freeqboard/...

APBoardSQL.txt

APBoard 2.2-r3 = SQL Injections - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Discovered by: 666 SR-Crew Homepage: www.SR-Crew.de.tt - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Vendor: APBoard from APP Homepage: www.php-programs.de - - - - - - - - - - - - - - - - - -...

CVE-2006-2660

Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the...

Remote file inclusion

PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 and earlier allows remote attackers to include arbitrary PHP files via the includeprefix parameter in 1 inc/dbase.php, 2 inc/config.php, 3 inc/common.php, and 4 inc/function.php. NOTE: it has been reported that the inc directory is...