PostNuke 0.703 - caselist Arbitrary Module Include

source: https://www.securityfocus.com/bid/4381/info PostNuke is a content management system originally forked from the PHP-Nuke project. It is implemented in PHP, and available for Windows, Linux and other Unix based systems. A vulnerability has been reported in some versions of PostNuke...

Security holes in two PHP services.

The first one is poll "avotravis " versions 2.1 and less. 1 Distortion of the limitations of multiple votes : Set the cookie with the name "alreadyvoted" and value "1" to the url /avotravis.php3?vote=1 for "yes" and /avotravis.php3?vote=1 for "no". 2 Access to the part administration : Set the...

PHP 4.x session spoofing

Hi, +-------------------+ | What are sessions | +-------------------+ A session ID is required to identify people. It is passed over to the browser and then is either part of the url or is stored as a cookie. With every request the browser also sends this ID over to the server which makes is...