CVE-2007-1576

PHProjekt 5.2.0 is affected by CVE-2007-1576 (XSS) when magic_quotes_gpc is disabled, allowing an authenticated user to inject script/HTML through multiple modules (Projects, Contacts, Helpdesk, Search, Notes, Mail summary page, etc.). Gentoo GLSA 200706-07 recommends upgrading to PHProjekt-5.2.1...

CVE-2007-1575

PHProjekt 5.2.0 is affected by multiple SQL injection vulnerabilities when magic_quotes_gpc is off, allowing remote authenticated users to execute arbitrary SQL via (a) calendar and (b) search module vectors and via a logout cookie. The issues are documented in CVE-2007-1575 and cited advisories ...

CVE-2007-1575

Multiple SQL injection vulnerabilities in PHProjekt 5.2.0, when magicquotesgpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via 1 unspecified vectors to the a calendar and 2 search modules, and an 2 unspecified cookie when the user logs out...

CVE-2007-1576

Multiple cross-site scripting XSS vulnerabilities in PHProjekt 5.2.0, when magicquotesgpc is disabled, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the 1 Projects, 2 Contacts, 3 Helpdesk, 4 Search only Gecko engine driven Browsers, and 5 Notes...

PHProjekt任意文件上传漏洞

PHProjekt是一款基于PHP的WEB应用程序。 PHProjekt存在任意文件上传问题，远程攻击者可以利用漏洞上传任意PHP文件，并以WEB权限执行。 目前没有详细漏洞细节提供。 PHProjekt PHProjekt 5.2 PHProjekt PHProjekt 5.1.2 PHProjekt PHProjekt 5.1.1 PHProjekt PHProjekt 5.1 升级程序： PHProjekt PHProjekt 5.1 PHProjekt PHProjekt 5.2.1 http://www.phprojekt.com/download/phprojekt.tar....

n.runs-SA-2007.005 - PHProjekt 5.2.0 - Cross Site Request Forgery

n.runs AG http://www.nruns.com/ security at nruns.com n.runs-SA-2007.005 14-Mar-2007 Vendor: Mayflower GmbH, http://www.mayflower.de Affected Products: PHProjekt 5.2.0 Vulnerability: Cross Site Request Forgery Risk: HIGH Vendor communication: 2006/12/31 initial notification of Mayflower 2007/01/0...

n.runs-SA-2007.006 - PHProjekt 5.2.0 - Privilege escalation

n.runs AG http://www.nruns.com/ security at nruns.com n.runs-SA-2007.006 14-Mar-2007 Vendor: Mayflower GmbH, http://www.mayflower.de Affected Products: PHProjekt 5.2.0 Vulnerability: Privilege escalation Risk: HIGH Vendor communication: 2006/12/31 initial notification of Mayflower 2007/01/02...

n.runs-SA-2007.003 - PHProjekt 5.2.0 - SQL Injection

n.runs AG http://www.nruns.com/ security at nruns.com n.runs-SA-2007.003 14-Mar-2007 Vendor: Mayflower GmbH, http://www.mayflower.de Affected Products: PHProjekt 5.2.0 Vulnerability: SQL Injection Risk: HIGH Vendor communication: 2006/12/31 initial notification of Mayflower 2007/01/02 Mayflower...

PHProjekt Content Management 远程文件包含漏洞

PHProjekt Content Management是一款基于PHP的内容管理程序。 PHProjekt Content Management不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于多个脚本对用户提交的'pathpre'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 MarioValdez PHProjekt Content Management Module 0.6.1 http://www.phprojekt.com/...

PHProjekt远程文件包含漏洞

PHProjekt是一款基于PHP的WEB应用程序。 PHProjekt不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是多个脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 PHProjekt PHProjekt 5.1 目前没有解决方案提供,请关注以下链接： http://www.phprojekt.com/...

PHProjekt <= 5.1 Multiple Remote File Include Vulnerabilities

No description provided by source. / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Script name: PHProjekt v. 5.1 - Script site: http://www.phprojekt.com/ + + + - Find by: Kacper a.k.a Rahim + - Contact: [email protected] - or - http://www.devilteam.yum.pl + + + - Greetz: DragonHeart - a...

CVE-2006-5123

Multiple PHP remote file inclusion vulnerabilities in Albrecht Guenther PHProjekt 5.1.x before 5.1.2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 libpath or 2 langpath parameter in unspecified files, related to code changes intended to fix inclusion, a different...

CVE-2006-5123

PHProjekt 5.1.x before 5.1.2 has multiple PHP remote file inclusion vulnerabilities. An attacker can trigger arbitrary PHP code execution by supplying a URL in the lib_path or lang_path parameters (across unspecified files). A related CVE-2006-4609 variant notes the issue in the Content Manager (...

CVE-2006-5123

Multiple PHP remote file inclusion vulnerabilities in Albrecht Guenther PHProjekt 5.1.x before 5.1.2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 libpath or 2 langpath parameter in unspecified files, related to code changes intended to fix inclusion, a different...

[Full-disclosure] Advisory 06/2006: PHProjekt (Remote) Include Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: PHProjekt Remote Include Vulnerabilities Release Date: 2006/09/29 Last Modified: 2006/09/29 Author: Stefan Esser [email protected] Application: PHProjekt 5.1.1 Severity:...

CVE-2006-4609

Multiple PHP remote file inclusion vulnerabilities in the Content Management module "Content manager" for PHProjekt 0.6.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via the pathpre parameter in 1 cmlib.inc.php, 2 doc/br.edithelp.php, 3...

CVE-2006-4609

PHProjekt 0.6.1 is affected by multiple PHP remote file inclusion vulnerabilities tied to the Content Manager and register_globals being enabled. The CVE-2006-4609 entry cites six vectors using the path_pre parameter (cm_lib.inc.php, doc/br.edithelp.php, doc/de.edithelp.php, doc/ct.edithelp.php, ...

PT-2006-5395 · Phprojekt · Phprojekt

Name of the Vulnerable Software and Affected Versions: PHProjekt version 0.6.1 Description: The issue allows remote attackers to execute arbitrary PHP code via the path pre parameter in several PHP files, including cm lib.inc.php, doc/br.edithelp.php, doc/de.edithelp.php, doc/ct.edithelp.php,...

CVE-2006-4609

Multiple PHP remote file inclusion vulnerabilities in the Content Management module "Content manager" for PHProjekt 0.6.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via the pathpre parameter in 1 cmlib.inc.php, 2 doc/br.edithelp.php, 3...

PHProjekt <= 5.1 Multiple Remote File Inclusions

The remote host is running PHProjekt, an open source groupware suite written in PHP. The version of PHProjekt installed on the remote host fails to sanitize user-supplied input to the 'pathpre' parameter of the 'lib/specialdays.php' script as well as the 'libpath' parameter of the...