CVE-2006-2459

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srchwhere parameter...

Sql injection

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srchwhere parameter...

CVE-2006-2459

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srchwhere parameter...

CVE-2006-2459

The CVE-2006-2459 issue affects PHP-Fusion up to version 6.00.307 (and earlier) in messages.php, where the srch_where parameter is vulnerable to SQL injection by remote authenticated users. The vulnerability arises from improper handling of user-supplied input in the SQL query, enabling arbitrary...

PHP-Fusion < 6.00.308 SQL Injection

Binary data 3622.prm...

PHP-Fusion 6.00.306 - srch_where SQL Injection

PHP-Fusion 6.00.306 - srchwhere SQL Injection !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return...

PHP-Fusion <= 6.00.306 (srch_where) SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================================= PHP-Fusion 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15...

PHP-Fusion &lt;= 6.00.306 (srch_where) SQL Injection Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "PHP-Fusion = v6.00.306 "srchwhere" SQL Injection/Admin credentials disclosure\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; if $argc5 echo "Usage: php ".$argv0." host...

PHP-Fusion 6.00.306 - 'srch_where' SQL Injection

!/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex =...

CVE-2006-2331

Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via 1 a .. dot dot in the settingslocale parameter in infusions/lastseenuserspanel/lastseenuserspanel.php, and 2 a .. dot dot in the localeset parameter in...

Input validation

PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, a...

CVE-2006-2330

PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, a...

Directory traversal

Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via 1 a .. dot dot in the settingslocale parameter in infusions/lastseenuserspanel/lastseenuserspanel.php, and 2 a .. dot dot in the localeset parameter in...

CVE-2006-2330

PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, a...

CVE-2006-2331

Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via 1 a .. dot dot in the settingslocale parameter in infusions/lastseenuserspanel/lastseenuserspanel.php, and 2 a .. dot dot in the localeset parameter in...

CVE-2006-2331

Summary: CVE-2006-2331 concerns PHP-Fusion 6.00.306 with multiple directory traversal weaknesses that let remote attackers cause local-file inclusion and arbitrary code execution via two input vectors. Specifically, an unauthenticated attacker can inject a ".." sequence in settings[locale] within...

CVE-2006-2330

CVE-2006-2330 affects PHP-Fusion 6.00.306 and earlier running on Apache 1.3.27 with PHP 4.3.3. The vulnerability arises in the file-upload validation logic, where a filename containing two or more extensions ending with an assumed-valid extension (e.g., .gif) can bypass validation. An authenticat...

PHP-Fusion < 6.00.307 Local File Inclusion

Binary data 3560.prm...

PHP-Fusion <= 6.00.306 Multiple Vulnerabilities Exploit

Exploit for unknown platform in category web applications ======================================================= PHP-Fusion = 6.00.306 Multiple Vulnerabilities Exploit ======================================================= !/usr/bin/php -q -d shortopentag=on ? echo "PHPFusion = v6.00.306 avatar...

PHP-Fusion &lt;= 6.00.306 Multiple Vulnerabilities Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "PHPFusion = v6.00.306 avatar modmime arbitrary file upload &\r\n"; echo "local inclusion vulnerabilities\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; if $argc6 echo...