Stored cross-site scripting vulnerability in PHPOK up***_co***.php file

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. A stored cross-site scripting vulnerability exists in the PHPOK upco.php file. An attacker can insert malicious js code into the page to obtain user cookies and other information, leading to user hijacking...

Remote Code Execution Vulnerability in PHPOK 5.0.003

PHPOK enterprise station system is a set of enterprise station CMS system developed in PHP + MYSQL language. PHPOK5.0.003 has a remote code execution vulnerability that can be exploited by attackers to execute arbitrary code...

CVE-2018-20006

An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save reachable via the index.php?id=book URI...

Cross site scripting

An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save reachable via the index.php?id=book URI...

CVE-2018-20006

An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save reachable via the index.php?id=book URI...

CVE-2018-20006

An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save reachable via the index.php?id=book URI...

CVE-2018-20006

CVE-2018-20006 affects PHPok v5.0.055. A Stored XSS flaw exists in the title parameter passed to api.php?c=post&f=save, reachable via index.php?id=book. The underlying issue is unencoded user input being stored and subsequently rendered, enabling script execution in a victim’s browser. Public ref...

PT-2018-15232

Name of the Vulnerable Software and Affected Versions PHPok version 5.0.055 Description A Stored XSS issue was found, which can be exploited via the title parameter to the "api.php?c=post&f=save" API endpoint, accessible through the "index.php?id=book" URI. Recommendations For PHPok version...

CVE-2018-20006: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save reachable via the index.php?id=book URI...

PHPOK 5.0.055 suffers from a SQL Injection Vulnerability

PHPOK system is a content management system for website construction developed by Shenzhen 锟铻科技有限公司formerly known as PHPOK Studio. A SQL injection vulnerability exists in PHPOK 5.0.055. The vulnerability is caused by poor filtering of user-submitted parameters. An attacker can exploit this...

CVE-2018-19562

An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background Program Upgrade Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive...

CVE-2018-19562

An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background Program Upgrade Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive...

Code injection

An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background Program Upgrade Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive...

CVE-2018-19562

An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background Program Upgrade Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive...

CVE-2018-19562

PHPok 4.9.015 is affected. The vulnerability exists in the admin path admin.php?c=update&f=unzip, where a ZIP delivered through the Login Background > Program Upgrade > Compressed Packet Upgrade can contain a .php file, enabling remote code execution. Publicly described by multiple sources ...

CVE-2018-19562: Unrestricted Upload of File with Dangerous Type

An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background Program Upgrade Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive...

PHPok Arbitrary Code Execution Vulnerability

PHPOK is an enterprise building system that supports expansion. A security vulnerability exists in PHPOK version 4.9.015 on the 'Login Backend Program Upgrade Compressed Package Upgrade' page. A remote attacker can exploit this vulnerability to execute arbitrary code...

PT-2018-15007

Name of the Vulnerable Software and Affected Versions PHPok version 4.9.015 Description An issue was discovered that allows remote attackers to execute arbitrary code. This is achieved through the "Login Background Program Upgrade Compressed Packet Upgrade" action, where a .php file is placed...

File upload vulnerability in PHPOK frontend us***.php file

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. A file upload vulnerability exists in the us.php file in the frontend of PHPOK. Allows attackers to upload webshell and gain server privileges...

PHPOK version 4.9.015 suffers from information leakage vulnerability

PHPOK enterprise station system is a set of enterprise station CMS system developed in PHP + MYSQL language. PHPOK version 4.9.015 suffers from an information leakage vulnerability, which originates from the program saving SESSION in the web directory, which can be exploited by attackers to obtai...