sendmail.php.txt

Sequoiasoft's sendmail php script dangerous - By jwilkins PHP-Nuke Written by Sequioa Software, this script allows execution of arbitrary code by a malicious user. Written by Sequioa Software, this script allows execution of arbitrary code by a malicious user. Essentially, popen executes a shell...

CVE-2001-1246

PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters...

CVE-2001-1468

PHP remote file inclusion vulnerability in checklogin.php in phpSecurePages 0.24 and earlier allows remote attackers to execute arbitrary PHP code by modifying the cfgProgDir parameter to reference a URL on a remote web server that contains the code...

NewsDaemon remote administrator access

SUMMARY ------- In all versions of NewsDaemon prior to 0.21b released 25 Jan 2001, it is possible to spoof a global variable in an HTTP request and obtain administrator access remotely. NewsDaemon is the PHP-based Web Log software that runs http://daily.daemonnews.org/ a popular news and discussi...

CVE-2000-0860

The file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary files by setting hidden form fields whose names match the names of internal PHP script variables...

Security Advisory(CSA-200011)

CHINANSL Security AdvisoryCSA-200011 Topic: PHP AND APACHE Vulnerability Release Dateёє Dec 6, 2000 Affected system: ============ APACHE WEB SERVER 1.3 ЎЎЎЎ- Microsoft Windows NT 4.0 ЎЎЎЎ- Microsoft Windows 2000 Impact: ====== CHINANSL security team has found a security problem in Apache web serv...

Security problems with TWIG webmail system

Twig is a popular webmail system written in PHP, once called Muppet. Author: Christopher Heschong Homepage: http://twig.screwdriver.net Version: 2.5.1 latest Problem: The possibility of processing our own php file , can leed to arbitrary command execution on the server as the httpd user. Status:...

CVE-2000-0860

The file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary files by setting hidden form fields whose names match the names of internal PHP script variables...

PHP 3.0/4.0 - Error Logging Format String

// source: https://www.securityfocus.com/bid/1786/info PHP is a scripting language designed for CGI applications that is used on many websites. There exists a remotely exploitable format string vulnerability in all versions of PHP below PHP 4.0.3. The vulnerability exists in the code that handles...

Дырка во многих реализациях PHP

Из-за того, что сервер не сбрасывает некоторые переменные, которые могут задаваться пользователем, пользователь может указать временный файл, используемый при загрузке, что позволяет скомпрометировать системные файлы...