Code injection

Static code injection vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to inject arbitrary PHP code into phpreconfig.php via the formaula parameter...

CVE-2009-1779

PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the formincludetemplate parameter...

CVE-2009-1781

Static code injection vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to inject arbitrary PHP code into phpreconfig.php via the formaula parameter...

CVE-2009-1780

CVE-2009-1780 affects Frax.dk Php Recommend 1.3 and earlier. The issue is in the password-change flow where authentication is not required, enabling remote attackers to gain administrative privileges by submitting manipulated form_admin_user and form_admin_pass parameters. The core impact is unau...

CVE-2009-1781

CVE-2009-1781 describes a static code injection vulnerability in admin.php of Frax.dk Php Recommend 1.3 and earlier. The issue allows remote attackers to inject arbitrary PHP code into phpre_config.php through the form_aula parameter, indicating a file/configuration handling flaw in older version...

CVE-2009-1780

admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified formadminuser and formadminpass parameters...

Php Recommend <= 1.3 (AB/RFI/CI) Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ================================================================ Php Recommend "; $d = ""; $content = "".$b."?php // Php Recommmend // Created By Frax.dk // GNU Licens // Please do not delete this text $".$d."page = '".$formpage."';...

PHP Recommend 1.3 Bypass / Inclusion / Injection

Php Recommend "; $d = ""; $content = "".$b."?php // Php Recommmend // Created By Frax.dk // GNU Licens // Please do not delete this text $".$d."page = '".$formpage."'; $".$d."includetemplate = '".$formincludetemplate."'; $".$d."cap = '".$formcap."'; $".$d."title = '".$formtitle."'; $".$d."aula =...

CVE-2007-1179

WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to 1 the Recommend feature, Email Article 2 senders and 3 recipients, 4 New User Approval, 5 Edit Profiles, 6 the Newsletter Subscription form, 7 the Recommend form, and 8 sending of articles, which has...

PT-2005-4311 · Chipmunk · Chipmunk Topsites Script

Name of the Vulnerable Software and Affected Versions: Chipmunk Topsites script affected versions not specified Description: The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the ID parameter in the recommend.ph...

PT-2005-4312 · Chipmunk · Chipmunk Directory Script

Name of the Vulnerable Software and Affected Versions: Chipmunk Directory script affected versions not specified Description: A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the entryID parameter in the recommend.php file...

myegallery.txt

Product: MyeGallery Versions affected: all /tmp/cmdtemp 2&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp"; $output = obgetcontents; obendclean; printoutput; ? This allows execution of any command on the server with MyeGallery, under the privileges of the Web server usually apache or httpd. 3. Solution...