EUVD-2008-6639

Malware in sbrugna...

EUVD-2008-6640

Malware in sbrugna...

CVE-2008-6676

QuickerSite 1.8.5 allows remote attackers to obtain sensitive information via a request to showThumb.aspx without any parameters, which reveals the installation path in an error message...

Design/Logic Flaw

asp/bslogin.asp in QuickerSite 1.8.5 does not properly restrict access to administrative functionality, which allows remote attackers to 1 change the admin password via the cSaveAdminPW action; 2 modify site information, such as the contact address, via the saveAdmin; and 3 modify the site design...

CVE-2008-6678

SQL injection vulnerability in asp/includes/contact.asp in QuickerSite 1.8.5 allows remote attackers to execute arbitrary SQL commands via the sNickName parameter in a profile action to default.asp...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in QuickerSite 1.8.5 allow remote attackers to inject arbitrary web script or HTML via 1 the close parameter to showThumb.aspx; 2 SBredirect and 3 SBfeedback parameters in processsend.asp, as reachable through default.asp; 4 paramCode and 5 cColor...

Code injection

mailPage.asp in QuickerSite 1.8.5 allows remote attackers to flood e-mail accounts with messages via a large number of requests with a modified sEmail parameter...

CVE-2008-6674

mailPage.asp in QuickerSite 1.8.5 allows remote attackers to flood e-mail accounts with messages via a large number of requests with a modified sEmail parameter...

Design/Logic Flaw

QuickerSite 1.8.5 allows remote attackers to obtain sensitive information via a request to showThumb.aspx without any parameters, which reveals the installation path in an error message...

CVE-2008-6673

asp/bslogin.asp in QuickerSite 1.8.5 does not properly restrict access to administrative functionality, which allows remote attackers to 1 change the admin password via the cSaveAdminPW action; 2 modify site information, such as the contact address, via the saveAdmin; and 3 modify the site design...

CVE-2008-6675

CVE-2008-6675 affects QuickerSite 1.8.5 with multiple reflected XSS vectors. The vulnerabilities arise in (1) showThumb.aspx via the close parameter, (2) process_send.asp via SB_redirect and SB_feedback as reachable through default.asp, (3) picker.asp via paramCode and cColor, and (4) rss.asp via...

CVE-2008-6674

mailPage.asp in QuickerSite 1.8.5 allows remote attackers to flood e-mail accounts with messages via a large number of requests with a modified sEmail parameter...

CVE-2008-6677

In CVE-2008-6677, Unrestricted file upload in QuickerSite 1.8.5 (fckeditor251/editor/filemanager/connectors/asp/upload.asp) allows remote attackers to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct request. This is supported by multiple ...

CVE-2008-6678

The CVE-2008-6678 entry describes a SQL injection in QuickerSite 1.8.5, exploitable through the sNickName parameter in asp/includes/contact.asp during a profile action to default.asp. Remote attackers can execute arbitrary SQL commands. The public documents confirm the vulnerable component and in...