CVE-2006-2422

CVE-2006-2422 affects phpCOIN 1.2.3 and earlier. The flaw allows remote authenticated users to read other users’ messages by adding the sender’s e‑mail address as an “additional contact,” indicating a partial confidentiality impact. The NVD entry notes network attack vector with low complexity an...

CVE-2006-2422

phpCOIN 1.2.3 and earlier stores messages based upon e-mail addresses, which allows remote authenticated users to read messages for other users by adding the sender's e-mail address as an "additional contact"...

[SA20088] phpCOIN E-Mail Address Disclosure of Arbitrary Messages

TITLE: phpCOIN E-Mail Address Disclosure of Arbitrary Messages SECUNIA ADVISORY ID: SA20088 VERIFY ADVISORY: http://secunia.com/advisories/20088/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: phpCOIN 1.x http://secunia.com/product/4722/...

CVE-2006-1428

Multiple cross-site scripting XSS vulnerabilities in phpCOIN 1.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the fs parameter to 1 mod.php or 2 modprint.php...

CVE-2006-1428

CVE-2006-1428 affects phpCOIN 1.2.2 and earlier. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML through the fs parameter to either mod.php or mod_print.php. The available documents do not provide explo...

CVE-2006-1428

Multiple cross-site scripting XSS vulnerabilities in phpCOIN 1.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the fs parameter to 1 mod.php or 2 modprint.php...

PHPCOIN 1.2 - 'mod.php?fs' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17279/info phpCOIN is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in th...

PHPCOIN 1.2 - mod_print.php?fs Cross-Site Scripting

PHPCOIN 1.2 - modprint.php?fs Cross-Site Scripting source: https://www.securityfocus.com/bid/17279/info phpCOIN is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these...

phpCOIN v1.2.2 XSS vuln.

phpCOIN v1.2.2 XSS vuln. Vuln. discovered by : r0t Date: 28 march 2006 vendor:http://www.phpcoin.com/ affected versions:V.1.2.2 and prior orginal advisory:http://pridels.blogspot.com/2006/03/phpcoin-v122-xss-vuln.html Vuln. Description: phpCOIN contains a flaw that allows a remote cross site...

PHPCOIN 1.2 - 'mod_print.php?fs' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17279/info phpCOIN is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in th...

PHPCOIN 1.2 - mod.php?fs Cross-Site Scripting

PHPCOIN 1.2 - mod.php?fs Cross-Site Scripting source: https://www.securityfocus.com/bid/17279/info phpCOIN is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issue...

CVE-2005-4447

Affected product: phpCOIN 1.2.2. Vulnerability: SQL injection in articles_funcs.php via the rec_next parameter, enabling modification of SQL syntax and, in some environments, potential error-message disclosure after an ORDER BY clause. The original disclosure notes that command injection is not f...

CVE-2005-4447

SQL injection vulnerability in articles\articlesfuncs.php in phpCOIN 1.2.2 allows remote attackers to modify SQL syntax and possibly execute SQL in limited circumstances via the recnext parameter. NOTE: the original disclosure suggests that command injection is not feasible because the injection...

phpCOIN-1.2.2-Full-2005 SQL Injection

This bug can't exploited cuz the sql injection is after ORDER BY and then we can't do UNION SELECT with MySQL Server if the Server is MS-SQL try to do this 0,0; New SQL Query //------------// File Name :- coinmodulesarticelsarticlesfuncs.php Line :- 187 Var :- $recnext Fix :- Line 184 Add This...

CVE-2005-4214

phpCOIN 1.2.2 allows remote attackers to obtain the installation path via a direct request to config.php, which leaks the path in an error message because the CCFG'PKGPATHDBSE' variable is not defined...

CVE-2005-4212

Directory traversal vulnerability in coinincludes/db.php in phpCOIN 1.2.2 allows remote attackers to read arbitrary local files via ".." dot dot sequences in the $CCFGPKGPATHDBSE variable...

CVE-2005-4211

PHP remote file inclusion vulnerability in coinincludes/db.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the $CCFGPKGPATHDBSE variable...

CVE-2005-4211

PHP remote file inclusion vulnerability in coinincludes/db.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the $CCFGPKGPATHDBSE variable...

CVE-2005-4211

PHP remote file inclusion in phpCOIN 1.2.2 affects coin_includes/db.php, allowing an attacker to supply a URL via the _CCFG[_PKG_PATH_DBSE] parameter to execute arbitrary PHP code. This is a code-execution exposure in the web application, with no exploitation details provided beyond the parameter...

CVE-2005-4214

phpCOIN 1.2.2 allows remote attackers to obtain the installation path via a direct request to config.php, which leaks the path in an error message because the CCFG'PKGPATHDBSE' variable is not defined...