66 matches found
CVE-2004-2474
CVE-2004-2474 affects PHPNews 1.2.3. The vulnerability is a SQL injection via the mid parameter in sendtofriend.php, allowing a remote attacker to execute arbitrary SQL commands. The provided documents do not specify a fixed version or concrete remediation; one NASL entry suggests upgrading PHP, ...
CVE-2005-2383
The CVE-2005-2383 entry concerns PHPNews 1.2.5, where auth.php accepts a user parameter via HTTP POST and fails to sanitize it, enabling SQL injection. Concrete details in connected docs show attackers could execute arbitrary SQL commands through the user parameter, with Nessus notes implying ris...
CVE-2005-2383
SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request...
CVE-2005-2383
SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request...
[SA16148] PHPNews "user" and "password" SQL Injection Vulnerability
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
PHPNews auth.php Multiple Parameter SQL Injection
The remote host is running PHPNews, an open source news application written in PHP. The installed version of PHPNews is prone to a SQL injection attack because of its failure to sanitize user-supplied input via the 'user' and 'password' parameters of the 'auth.php' script. Provided PHP's...
PHPNews < 1.3.0 auth.php Multiple Field SQL Injection
Binary data 3104.prm...
PHPNews SQL injection vulnerability
Product: PHPNews Version: 1.2.5 Release, bugfix 1.2.6 and previous URL: http://newsphp.sourceforge.net/ VULNERABILITY CLASS: SQL injection PRODUCT DESCRIPTION PHPNews is a popular script for news posting written in PHP MySQL based. VULNERABILITY Vulnerable script: auth.php code else...
PHPNews 1.2.x - auth.php SQL Injection
PHPNews 1.2.x - auth.php SQL Injection source: https://www.securityfocus.com/bid/14333/info PHPNews is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. This vulnerability could permi...
PHPNews 1.2.x - 'auth.php' SQL Injection
source: https://www.securityfocus.com/bid/14333/info PHPNews is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. This vulnerability could permit remote attackers to pass malicious...
CVE-2005-2156
SQL injection vulnerability in news.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the prevnext parameter...
CVE-2005-2156
CVE-2005-2156 describes a SQL injection in PHPNews 1.2.5 via the prevnext parameter in news.php. A remote attacker could exploit this to influence database queries and potentially expose information. Related advisories corroborate exploitation potential and indicate the issue affects PHPNews prio...
CVE-2005-2156
SQL injection vulnerability in news.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the prevnext parameter...
PHPNews news.php prevnext Parameter SQL Injection
The remote host is running PHPNews, an open source news application written in PHP. The installed version of PHPNews is prone to a SQL injection attack due to its failure to sanitize user-supplied input via the 'prevnext' parameter of the 'news.php' script. An attacker can exploit this flaw to...
PHPNews < 1.2.6 news.php prevnext Parameter SQL Injection
Binary data 3047.prm...
[SA15911] PHPNews "prevnext" SQL Injection Vulnerability
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
CVE-2005-0632
CVE-2005-0632 concerns PHPNews, an open‑source PHP-based news application. The vulnerability is a remote file include in the script auth.php , allowing an attacker to execute arbitrary PHP code via the path parameter on PHPNews versions 1.2.4 (and possibly 1.2.3). Root cause is a missing validati...
PHPNews < 1.2.5 auth.php path Parameter Remote File Inclusion
Binary data 2665.prm...
PHPNews auth.php path Parameter Remote File Inclusion
The remote host is running PHPNews, an open source news application written in PHP. The installed version of PHPNews has a remote file include vulnerability in the script 'auth.php'. By leveraging this flaw, a attacker can cause arbitrary PHP code to be executed on the remote host using the...