trixbox Cisco Phone Services PhoneDirectory.php ID Parameter SQL Injection

The version of the Cisco Phone Services phone directory script 'cisco/services/PhoneDirectory.php' installed as part of the web interface for trixbox or Asterisk@Home, as it was formerly known and hosted on the remote web server fails to sanitize input to the 'ID' parameter before using it in a...

CVE-2010-0678

PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includesdirectory parameter...

CVE-2010-0678: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includesdirectory parameter...

Scriptegrator Plugin for Joomla! 'files[]' Parameter Remote File Include

The version of the Core Design Scriptegrator plugin for Joomla! running on the remote host is affected by a remote file include vulnerability due to improper sanitization of user-supplied input to the 'files' parameter before using it in the cdscriptegrator/libraries/highslide/js/jsloader.php...

Open Flash Chart/Pwiki Remote Code Execution Vulnerability

Exploit for unknown platform in category web applications ========================================================== Open Flash Chart/Pwiki Remote Code Execution Vulnerability ========================================================== Author: GoLdeN-z3r0 Title: Open Flash Chart/Pwiki Remote Code...

openSUSE Security Update : horde (horde-1947)

This update of horde fixes : - CVE-2009-3236: CVSS v2 Base Score: 5.0: Overwrite arbitrary files and execute PHP code - CVE-2009-3237: CVSS v2 Base Score: 5.0: Cross-Site Scripting XSS - CVE-2009-3701: CVSS v2 Base Score: 4.3: Cross-Site Scripting XSS - CVE-2009-4363: CVSS v2 Base Score: 4.3:...

SA-CONTRIB-2010-015 - Signwriter - Arbitrary code execution

The Signwriter module allows the use of TrueType fonts to replace text in headings, blocks, menus and filtered text. This vulnerability allows a remote attacker with the ability to create content using an input filter created with a Signwriter profile to execute arbitrary PHP code on an affected...

TinyBrowser Component for Joomla! 'tinybrowser_lang' Cookie Local File Include

The version of the TinyBrowser component for Joomla! running on the remote host is affected by a local file include vulnerability due to improper sanitization of user-supplied input to the 'tinybrowserlang' cookie before using it in the tinymce/plugins/tinybrowser/folders.php script to include PH...

Bits Video Script 2.042.05 - addvideo.php Arbitrary File Upload Arbitrary PHP Code Execution

Bits Video Script 2.042.05 - addvideo.php Arbitrary File Upload Arbitrary PHP Code Execution source: https://www.securityfocus.com/bid/40712/info Bits Video Script is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can...

CVE-2009-4622: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in admin/adminnewsbot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter, a different vector than CVE-2007-0572...

CVE-2009-4614: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Moa Gallery 1.2.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the MOAPATH parameter to 1 errorfuncs.php, 2 integrityfuncs.php, 3 templatecomponentadmin.php, 4 templatecomponentgallery.php, 5 templateparser.php...

Bits Video Script 2.04/2.05 - '/addvideo.php' Arbitrary File Upload / Arbitrary PHP Code Execution

source: https://www.securityfocus.com/bid/40712/info Bits Video Script is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to upload arbitrary code and run it in the context of the...

Bits Video Script 2.04/2.05 - '/register.php' Arbitrary File Upload / Arbitrary PHP Code Execution

source: https://www.securityfocus.com/bid/40712/info Bits Video Script is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to upload arbitrary code and run it in the context of the...

Bits Video Script 2.042.05 - register.php Arbitrary File Upload Arbitrary PHP Code Execution

Bits Video Script 2.042.05 - register.php Arbitrary File Upload Arbitrary PHP Code Execution source: https://www.securityfocus.com/bid/40712/info Bits Video Script is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can...

CVE-2009-4623: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACSpath parameter to 1 index.php and 2 admin.php in advancedcommentsystem/. NOTE: this might only be a vulnerability when the administrator has n...

Supesite7 the background to get shell-vulnerability warning-the black bar safety net

PHP code !-- eval $content = "@eval$POSTc";-- !-- eval $test1 = ""."?"." php ".$ content."?& gt;";-- !-- eval fputsfopenSROOT.'./ templates/default/modelcache.php','w+',$test1;-- Edit the template when writing these few lines,disassemble the written word,on the line...

phpwind 7.5 apps/groups/index.php远程包含漏洞

apps/groups/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码 ?php if $route == "groups" requireonce $basePath . '/action/mgroups.php'; elseif $route == "group" requireonce $basePath . '/action/mgroup.php'; elseif $route == "galbum" requireonce $basePath . '/action/mgalbum.php';...

phpLDAPadmin < 1.2 Local File Inclusion

Binary data 5291.prm...

Calendarix 0.7 - calpath Remote File Inclusion

Calendarix 0.7 - calpath Remote File Inclusion source: https://www.securityfocus.com/bid/37673/info Calendarix is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containi...

SpawCMS Editor Shell Upload Vulnerability

No description provided by source. Author: j4ck j4ck from elitehackers.pl [email protected] just go to directory http:/server/path/spaw/demo.php then use image Upload, select all filetypes, and You can upload your evil PHP code, for example phpshell. Shell will be uploaded to selected directory...