46 matches found
Code injection
admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modification before login, which allows remote attackers to cause a denial of service loss of configuration data, and possibly perform direct static code injection, via a saveGlobalconfig...
CVE-2007-2372
admin/sendmod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and listid fields; and send...
CVE-2007-2372
CVE-2007-2372 affects phpMyNewsletter 0.8 beta5 and earlier. The admin/send_mod.php path prints a Location header but does not exit when administrative credentials are missing, enabling remote attackers to craft an e-mail via a POST containing subject, message, format, and list_id, then send the ...
CVE-2007-2371
CVE-2007-2371 affects phpMyNewsletter (Gregory Kokanosky) ≤ 0.8 beta5. The admin/index.php endpoint allows configuration modifications before authentication, enabling remote attackers to cause a denial of service (loss of configuration data) and potentially perform direct static code injection vi...
CVE-2007-2372: Undefined Security Weakness
admin/sendmod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and listid fields; and send...
CVE-2007-2371: Undefined Security Weakness
admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modification before login, which allows remote attackers to cause a denial of service loss of configuration data, and possibly perform direct static code injection, via a saveGlobalconfig...
phpmynews08-multi.txt
!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc Delete Config Value Rude Attack - can't do anything after 2 - Send an Email to all of the subscribers Do not alter anything Related: 1 - None 2 - OneWordTitle TextOfYourChoice Es: php ".$argv0."...
phpMyNewsletter <= 0.8 (beta5) Multiple Vuln Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc Delete Config Value Rude Attack - can't do anything after 2 - Send an Email to all of the subscribers Do not alter anything Related: 1 - None 2 - OneWordTitle...
phpMyNewsletter 0.6.10 (customize.php l) RFI Vulnerability:
Product : phpMyNewsletter Tested version : 0.6.10 Website : http://gregory.kokanosky.free.fr/phpmynewsletter/ Problem : include file PHP code : °°°°°°°°°° ---- /include/customize.php ---- ? $langfile = $l; include $l; ? ---- /include/customize.php ---- Exploit : °°°°°°°°°...
phpMyNewsletter <= 0.8 (beta5) Multiple Vuln Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo " phpMyNewsletter = 0.8 beta5 Multiple Vuln Exploit by BlackHawk [email protected] http://itablackhawk.altervista.org Thanks to rgod for the php code and Marty for the Love "; if $argc3 echo "Usage: php ".$argv0." Si...
phpMyNewsletter 0.8 (beta5) - Multiple Vulnerabilities
phpMyNewsletter 0.8 beta5 - Multiple Vulnerabilities !/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc Delete Config Value Rude Attack - can't do anything after 2 - Send an Email to all of the subscribers Do not alter anything Related: 1 - None...
phpMyNewsletter 0.8 (beta5) - Multiple Vulnerabilities
!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc Delete Config Value Rude Attack - can't do anything after 2 - Send an Email to all of the subscribers Do not alter anything Related: 1 - None 2 - OneWordTitle TextOfYourChoice Es: php ".$argv0."...
phpMyNewsletter <= 0.8 (beta5) Multiple Vuln Exploit
Exploit for unknown platform in category web applications ==================================================== phpMyNewsletter Delete Config Value Rude Attack - can't do anything after 2 - Send an Email to all of the subscribers Do not alter anything Related: 1 - None 2 - OneWordTitle...
phpmynewsletter-rfi.txt
Product : phpMyNewsletter Tested version : 0.6.10 Website : http://gregory.kokanosky.free.fr/phpmynewsletter/ Problem : include file PHP code : °°°°°°°°°° ---- /include/customize.php ---- ---- /include/customize.php ---- Exploit : °°°°°°°°°...
phpMyNewsletter 0.6.10 (customize.php l) RFI Vulnerability
No description provided by source. Product : phpMyNewsletter Tested version : 0.6.10 Website : http://gregory.kokanosky.free.fr/phpmynewsletter/ Problem : include file PHP code : °°°°°°°°°° ---- /include/customize.php ---- ? $langfile = $l; include $l; ? ---- /include/customize.php ----...
phpMyNewsletter 0.6.10 - customize.php Remote File Inclusion
phpMyNewsletter 0.6.10 - customize.php Remote File Inclusion Product : phpMyNewsletter Tested version : 0.6.10 Website : http://gregory.kokanosky.free.fr/phpmynewsletter/ Problem : include file PHP code : °°°°°°°°°° ---- /include/customize.php ---- ---- /include/customize.php ---- Explo...
phpMyNewsletter 0.6.10 (customize.php l) RFI Vulnerability
Exploit for unknown platform in category web applications ========================================================== phpMyNewsletter 0.6.10 customize.php l RFI Vulnerability ========================================================== Product : phpMyNewsletter Tested version : 0.6.10 Website :...
phpMyNewsletter 0.6.10 - 'customize.php' Remote File Inclusion
Product : phpMyNewsletter Tested version : 0.6.10 Website : http://gregory.kokanosky.free.fr/phpmynewsletter/ Problem : include file PHP code : °°°°°°°°°° ---- /include/customize.php ---- ---- /include/customize.php ---- Exploit : °°°°°°°°°...
CVE-2002-1887
PHP remote file inclusion in phpMyNewsletter 0.6.10 via customize.php (l parameter) allows remote code execution. Affected software: phpMyNewsletter 0.6.10; vulnerability arises from PHP include handling in customize.php. CVSSv2 base score 7.5 (HIGH) with network attack vector, low attack complex...