1351 matches found
CVE-2006-6112: Undefined Security Weakness
LifeType 1.0.x and 1.1.x have insufficient access control for all of the PHP scripts under 1 class/ and 2 plugins/, which allows remote attackers to obtain the installation path via a direct request to any of the scripts, as demonstrated by a bayesianfilter.class.php and b bootstrap.php, which...
dc-sql.txt
/ -061124a- \ | deV!Lz Clanportal - SQL Injection | \ / S Y N O P S I S / =================' - access: remote severity: high - An SQL injection has been found in deV!Lz Clanportal, which allows any logged in user to grant herself admin privileges in the system. B A C K G R O U N D /...
CVE-2006-5918
Unrestricted file upload vulnerability in RapidKill aka PHP Rapid Kill 5.7 Pro, and certain other versions, allows remote attackers to upload and execute arbitrary PHP scripts via the "Link to Download" field. NOTE: it is possible that the field value is restricted to files on specific public web...
Free File Hosting 1.1 - 'forgot_pass.php' File Inclusion
!/usr/bin/php -q -d shortopentag=on | | \\ | | | | | | \ //----------------------- | DEVIL TEAM - POLISH TEAM \/ http://www.rahim.webd.pl/ . .\ . \ / | | ||/ | || / \ | \ / /\ | | / | \ \ | |/ \ / \ | \ | || | | | | \ | / //\ | /|//|||| ||| /| / | | | | | \ | Free File Hosting = 1.1...
CVE-2003-1307
The modphp module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: th...
CVE-2006-5245
Summary (CVE-2006-5245): Eazy Cart is affected by a authentication bypass vulnerability in the admin area. A remote attacker can gain administrative access by issuing a direct request to a file such as admin/home/index.php (and potentially other PHP scripts under the admin/ directory), bypassing ...
7 php scripts File Inclusion / Source disclosure Vuln
Title..: 7 php scripts File Inclusion Vuln / Source disclosure Credits: DarkFig Og.link: http://acid-root.new.fr/poc/13061007.txt Using http://www.google.com/codesearch Few examples about what we can do with a code search engine For educational purpose only. You can use regex in your research, th...
eboli (index.php) Remote File Include Vulnerability
Exploit for unknown platform in category web applications =================================================== eboli index.php Remote File Include Vulnerability =================================================== Title..: 7 php scripts File Inclusion Vuln / Source disclosure Credits: DarkFig Using...
TribunaLibre 3.12 Beta - ftag.php Remote File Inclusion
TribunaLibre 3.12 Beta - ftag.php Remote File Inclusion Title..: 7 php scripts File Inclusion Vuln / Source disclosure Credits: DarkFig Og.link: http://acid-root.new.fr/poc/13061007.txt Using http://www.google.com/codesearch Few examples about what we can do with a code search engine For...
TribunaLibre 3.12 Beta - 'ftag.php' Remote File Inclusion
Title..: 7 php scripts File Inclusion Vuln / Source disclosure Credits: DarkFig Og.link: http://acid-root.new.fr/poc/13061007.txt Using http://www.google.com/codesearch Few examples about what we can do with a code search engine For educational purpose only. You can use regex in your research, th...
registroTL - 'main.php' Remote File Inclusion
Title..: 7 php scripts File Inclusion Vuln / Source disclosure Credits: DarkFig Og.link: http://acid-root.new.fr/poc/13061007.txt Using http://www.google.com/codesearch Few examples about what we can do with a code search engine For educational purpose only. You can use regex in your research, th...
phpBB <= 2.0.21 (Poison NULL Byte) Remote Exploit
Exploit for unknown platform in category web applications ================================================= phpBB newagent='Mozilla/4.0 compatible; Windows 5.1'; $ua-cookiejar HTTP::Cookies-new; $url='http://'.$ARGV0.'/login.php'; $data="username=".$ARGV1."&password=".$ARGV2."&login=1"; my $req =...
WoW Roster 1.5 - hsList.php?subdir Remote File Inclusion
WoW Roster 1.5 - hsList.php?subdir Remote File Inclusion source: https://www.securityfocus.com/bid/19269/info WoW Roster is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit may allow unauthorized users to execute...
DGNews v 1.5 File Upload Vuln.
DGNews v 1.5 File Upload Vuln. Vuln. discovered by : r0t Date: 29 may 2006 vendor:www.diangemilang.com/dgscripts.php affected versions:v 1.5 and prior orginal advisory: http://pridels.blogspot.com/2006/05/dgnews-v-15-file-upload-vuln.html Vuln. Description: It is possible to upload arbitrary file...
Russcom PHPImages lack of validation
Russcom PHPImages lack of validation Discovered by: Nomenumbra Date: 21/5/2006 impact:moderate Russcom's PHPImages doesn't validate if the uploaded file is an image, it just checks for the extension, thus allowing an attacker to upload php scripts with a .gif extension for example, potentially...
GLSA-200605-04 : phpWebSite: Local file inclusion
The remote host is affected by the vulnerability described in GLSA-200605-04 phpWebSite: Local file inclusion rgod has reported that the 'hubdir' parameter in 'index.php' isn't properly verified. When 'magicquotesgpc' is disabled, this can be exploited to include arbitrary files from local...
phpWebSite: Local file inclusion
Background phpWebSite provides a complete web site content management system. Description rgod has reported that the "hubdir" parameter in "index.php" isn't properly verified. When "magicquotesgpc" is disabled, this can be exploited to include arbitrary files from local ressources. Impact If...
Authentication flaw
publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and...
CVE-2006-1291: Undefined Security Weakness
publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in phpArcadeScript 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the gamename parameter in tellafriend.php, 2 the loginstatus parameter in loginbox.php, 3 the submissionstatus parameter in index.php, the 4...