946 matches found
Input validation
PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, a...
Directory traversal
Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via 1 a .. dot dot in the settingslocale parameter in infusions/lastseenuserspanel/lastseenuserspanel.php, and 2 a .. dot dot in the localeset parameter in...
CVE-2006-2330
CVE-2006-2330 affects PHP-Fusion 6.00.306 and earlier running on Apache 1.3.27 with PHP 4.3.3. The vulnerability arises in the file-upload validation logic, where a filename containing two or more extensions ending with an assumed-valid extension (e.g., .gif) can bypass validation. An authenticat...
CVE-2006-2331
Summary: CVE-2006-2331 concerns PHP-Fusion 6.00.306 with multiple directory traversal weaknesses that let remote attackers cause local-file inclusion and arbitrary code execution via two input vectors. Specifically, an unauthenticated attacker can inject a ".." sequence in settings[locale] within...
CVE-2006-2330
PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, a...
CVE-2006-2331
Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via 1 a .. dot dot in the settingslocale parameter in infusions/lastseenuserspanel/lastseenuserspanel.php, and 2 a .. dot dot in the localeset parameter in...
CVE-2006-2331: Undefined Security Weakness
Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via 1 a .. dot dot in the settingslocale parameter in infusions/lastseenuserspanel/lastseenuserspanel.php, and 2 a .. dot dot in the localeset parameter in...
CVE-2006-2330: Undefined Security Weakness
PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, a...
PHP-Fusion < 6.00.307 Local File Inclusion
Binary data 3560.prm...
PHP-Fusion <= 6.00.306 Multiple Vulnerabilities Exploit
Exploit for unknown platform in category web applications ======================================================= PHP-Fusion = 6.00.306 Multiple Vulnerabilities Exploit ======================================================= !/usr/bin/php -q -d shortopentag=on ? echo "PHPFusion = v6.00.306 avatar...
PHP-Fusion <= 6.00.306 Multiple Vulnerabilities Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "PHPFusion = v6.00.306 avatar modmime arbitrary file upload &\r\n"; echo "local inclusion vulnerabilities\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; if $argc6 echo...
PHP-Fusion 6.00.306 - Multiple Vulnerabilities
PHP-Fusion 6.00.306 - Multiple Vulnerabilities !/usr/bin/php -q -d shortopentag=on ? echo "PHPFusion = v6.00.306 avatar modmime arbitrary file upload &\r\n"; echo "local inclusion vulnerabilities\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; if...
PHP-Fusion 6.00.306 - Multiple Vulnerabilities
!/usr/bin/php -q -d shortopentag=on ? echo "PHPFusion = v6.00.306 avatar modmime arbitrary file upload &\r\n"; echo "local inclusion vulnerabilities\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; if $argc6 echo "Usage: php ".$argv0." host path us...
PHP-Fusion < 6.00.110 Multiple SQLi Vulnerabilities
PHP-Fusion is prone to multiple SQL injection SQLi vulnerabilities due to its failure to properly sanitize certain parameters. SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
[SA18949] PHP-Fusion Cross-Site Scripting Vulnerabilities
TITLE: PHP-Fusion Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA18949 VERIFY ADVISORY: http://secunia.com/advisories/18949/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Unknown WHERE: From remote SOFTWARE: PHP-Fusion 6.x http://secunia.com/product/5291/ PHP-Fusion 5.x...
CVE-2006-0593
Cross-site scripting XSS vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the 1 shoutname field in shoutboxpanel.php and the 2 comments field in commentsinclude.php...
Cross site scripting
Cross-site scripting XSS vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the 1 shoutname field in shoutboxpanel.php and the 2 comments field in commentsinclude.php...
CVE-2006-0593
PHP-Fusion contains a cross-site scripting (XSS) vulnerability (CVE-2006-0593) in version prior to 6.00.304. The flaw allows remote attackers to inject arbitrary web script or HTML through two fields: shout_name in shoutbox_panel.php and comments in comments_include.php. Impact per the sources is...
CVE-2006-0593
Cross-site scripting XSS vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the 1 shoutname field in shoutboxpanel.php and the 2 comments field in commentsinclude.php...
CVE-2006-0593: Undefined Security Weakness
Cross-site scripting XSS vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the 1 shoutname field in shoutboxpanel.php and the 2 comments field in commentsinclude.php...