CVE-2009-1613

Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 searchterm or 2 email parameter...

TinyWebGallery <= 1.7.6 LFI / Remote Code Execution Exploit

No description provided by source. ?php / ----------------------------------------------------------- TinyWebGallery = 1.7.6 LFI / Remote Code Execution Exploit ----------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....:...

TinyWebGallery 1.7.6 - Local File Inclusion / Remote Code Execution

?php / ----------------------------------------------------------- TinyWebGallery = 1.7.6 LFI / Remote Code Execution Exploit ----------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....: http://www.tinywebgallery.com/ details..: this...

Directory traversal

Directory traversal vulnerability in index.php in PastelCMS 0.8.0, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the setlng parameter...

CVE-2009-1405

Directory traversal vulnerability in index.php in PastelCMS 0.8.0, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the setlng parameter...

chCounter 3.1.3 - Authentication Bypass

chCounter 3.1.3 - Authentication Bypass chCounter 3.1.3 Login Bypass ======================================================================================================================= Critical Level : Dangerous Vendor site : http://chcounter.org/ Download :...

Aqua CMS (username) SQL Injection Vulnerability

Exploit for unknown platform in category web applications =============================================== Aqua CMS username SQL Injection Vulnerability =============================================== ================================================================================ Found : halkfild...

Ubuntu: Security Advisory (USN-493-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sql injection

Multiple SQL injection vulnerabilities in CelerBB 0.0.2, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 viewforum.php and 2 viewtopic.php...

PHP Director 0.21 - SQL Into Outfile 'eval()' Injection

include include include include include include / Dork "Powered by PHP Director 0.2" | PHP Director 0.2.1 sql into outfile eval Injection Exploit | Exploit- index.php?cat=%27+UNION+SELECT+1,'lol',3,4,5,6,7,8,9,10,11,12,13,14,15+INTO+OUTFILE+'/var/www/ex.php'/ PHP.ini- Magic Quotes off Written- by...

Wili-CMS 0.4.0 Multiple Vulnerabilities (Remote/Local File Inclusion - Authentication Bypass)

Salvatore "drosophila" Fresta + Application: Wili-CMS + Version: 0.4.0 + Website: http://wili-cms.sourceforge.net/ + Bugs: A Multiple Remote/Local File Inclusion B Authentication Bypass + Exploitation: Remote + Date: 06 Mar 2009 + Discovered by: Salvatore "drosophila" Fresta + Author: Salvatore...

Zabbix Web Interface extlang[] Parameter Remote Code Execution

The remote web server hosts a version of the Zabbix web interface that is affected by a remote code execution vulnerability. The vulnerability involves the 'extlang' parameter of the 'locales.php' script. Provided PHP's 'magicquotesgpc' setting is disabled, an unauthenticated, remote attacker can...

Blue Eye CMS 1.0.0 - Remote Cookie SQL Injection

Blue Eye CMS 1.0.0 - Remote Cookie SQL Injection BlueEye CMS Download: http://kent.dl.sourceforge.net/sourceforge/blueeyecms/blueeyecms-100preRC.rar need magicquotesgpc = Off - Vuln code: 10: if !empty$COOKIE"BlueEyeCMSlogin" // -- Only?? 11: $clogin = $COOKIE"BlueEyeCMSlogin"; // -- Not clean??...

EZ-Blog 'public/view.php' SQL Injection Vulnerability

EZ-Blog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying...

Demium CMS 0.2.1B Multiple Vulnerabilities and Exploit

No description provided by source. Demium CMS, version 0.2.1 Beta, is prone to multiple remote vulnerabilities, because of insufficient security on it. Let's see them. In this advisory you can find vulnerabilities, afflicted source, and multiple Remote Exploit. Credits to : Giovanni Buzzin, Osiry...

PT-2009-1778 · Xt · Xt:Commerce

Name of the Vulnerable Software and Affected Versions: xt:Commerce versions prior to 3.0.4 Sp2.1 Description: The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors when magic quotes gpc is enabled and the SEO URLs are activated. Recommendations: For versions...

CVE-2009-0730

Multiple SQL injection vulnerabilities in the GigCalendar comgigcal component 1.0 for Mambo and Joomla!, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via 1 the gigcal venuesid parameter in a details action to index.php, which is not properly handled by...

CVE-2009-0730

Multiple SQL injection vulnerabilities in the GigCalendar comgigcal component 1.0 for Mambo and Joomla!, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via 1 the gigcal venuesid parameter in a details action to index.php, which is not properly handled by...

Sql injection

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via 1 the checkuser parameter aka username field, or 2 the checkpass parameter aka password field, to...

Directory traversal

Multiple directory traversal vulnerabilities in LightBlog 9.8, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 username parameter to viewmember.php, 2 usernamepost parameter to login.php, and the 3 Lightblogusername...