CVE-2006-1087: Undefined Security Weakness

Direct static code injection vulnerability in the modifyconfig action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the optionnewcompatibilitymode parameter, which is not filtered before being stored in config.php. NOTE...

CVE-2006-1085

PHP-Stats 0.1.9.1 and earlier is affected by CVE-2006-1085. An authentication bypass allows remote attackers to gain administrator privileges and execute arbitrary PHP code by altering option[admin_pass] and setting pass_cookie to the MD5 hash of the target password. This vector can be used in co...

CVE-2006-1088

PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database tableprefix...

CVE-2006-1087

Direct static code injection vulnerability in the modifyconfig action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the optionnewcompatibilitymode parameter, which is not filtered before being stored in config.php. NOTE...

CVE-2006-1084

CVE-2006-1084 affects PHP-Stats versions 0.1.9.1 and earlier. The vulnerability stems from multiple SQL injection flaws in the application, notably via the parameter option[prefix] in admin.php and the PC_REMOTE_ADDR HTTP header to click.php. Successful exploitation could allow remote attackers t...

php_stats_0191_adv.txt

------------- PHP-Stats = 0.1.9.1 remote commands execution ------------------- software: site: http://www.phpstats.net/ description: Open source statistical package for PHP enabled web sites -------------------------------------------------------------------------------- i vulnerable code in...

PHP-Stats <= 0.1.9.1 remote commands execution

------------- PHP-Stats = 0.1.9.1 remote commands execution ------------------- software: site: http://www.phpstats.net/ description: Open source statistical package for PHP enabled web sites -------------------------------------------------------------------------------- i vulnerable code in...

PHP-Stats <= 0.1.9.1 Remote Commands Execution Exploit

No description provided by source. ?php ---phpstats0191xpl.php 04/03/2006 4.53.41 PHP-Stats = 0.1.9.1 optionadminpass overwrite / / remote commands execution exploit coded by rgod site: http://retrogod.altervista.org - works regardless of magicquotesgpc settings... usage: launch from Apache, fill...

PHP-Stats 0.1.9.1 - Remote Commans Execution

PHP-Stats 0.1.9.1 - Remote Commans Execution works regardless of magicquotesgpc settings... usage: launch from Apache, fill in requested fields, then go! Sun-Tzu:"Of old, the rise of the Yin dynasty was due to I Chih who had served under the Hsia. Likewise, the rise of the Chou dynasty was due to...

PHP-Stats <= 0.1.9.1 Remote Commands Execution Exploit

Exploit for unknown platform in category web applications ====================================================== PHP-Stats works regardless of magicquotesgpc settings... usage: launch from Apache, fill in requested fields, then go! Sun-Tzu:"Of old, the rise of the Yin dynasty was due to I Chih wh...

PHP-Stats 0.1.9.1 - Remote Commans Execution

works regardless of magicquotesgpc settings... usage: launch from Apache, fill in requested fields, then go! Sun-Tzu:"Of old, the rise of the Yin dynasty was due to I Chih who had served under the Hsia. Likewise, the rise of the Chou dynasty was due to Lu Ya who had served under the Yin."...