CVE-2006-2685

PHP remote file inclusion vulnerability in Basic Analysis and Security Engine BASE 1.2.4 and earlier, with registerglobals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BASEpath parameter to 1 baseqrycommon.php, 2 basestatcommon.php, and 3...

pppBlog 0.3.8 - System Disclosure

pppBlog 0.3.8 - System Disclosure !/usr/bin/php -q -d shortopentag=on ? echo "pppBlog = 0.3.8 system disclosure exploit\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "dork: intext:"Powered by pppblog"\r\n\r\n"; / works with:...

Advisory: Blend Portal <= 1.2.0 for phpBB 2.x (blend_data/blend_common.php) File Inclusion Vulnerability

--Security Report-- Advisory: Blend Portal = 1.2.0 for phpBB 2.x blenddata/blendcommon.php File Inclusion Vulnerability. --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 28/05/06 07:52 PM --- Contacts: ICQ: 10072 MSN/Email: [email protected] Web: http://www.nukedx.com --- Vendo...

WebCalendar -- information disclosure vulnerability

Secunia reports: socsam has discovered a vulnerability in WebCalendar, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information. Input passed to the "includedir" parameter isn't properly verified, before it is used in an "fopen" call...

Blend Portal 1.2.0 - phpBB Mod Remote File Inclusion

Blend Portal 1.2.0 - phpBB Mod Remote File Inclusion Blend Portal ICQ: 10072 MSN/Mail: [email protected] web: www.nukedx.com This exploits works on Blend Portal http://victim/phpBB/blenddata/blendcommon.php?phpbbrootpath=FILE EXAMPLE -...

[MajorSecurity #6]Socketmail <= 2.2.6 - Remote File Include Vulnerability

MajorSecuritySocketmail = 2.2.6 - Remote File Include Vulnerability -------------------------------------------------------- Software: Socketmail Version: =2.2.6 Type: Remote File Include Vulnerability Date: May, 25th 2006 Vendor: Creative Digital Resources Page: http://socketmail.com Risc: High...

Nucleus CMS < 3.23 PLUGINADMIN.php DIR_LIBS Parameter Remote File Inclusion

Binary data 3633.prm...

Nucleus CMS PLUGINADMIN.php DIR_LIBS Parameter Remote File Inclusion

The remote host is running Nucleus CMS, an open source content management system. The version of Nucleus CMS installed on the remote host fails to sanitize input to the 'DIRLIBS' parameter before using it in a PHP include function in the 'nucleus/libs/PLUGINADMIN.php' script. Provided PHP's...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in 1 wherecms, 2 wherelms, 3 whereupgrade, 4 BBCLIBPATH, and 5 BBCLANGUAGEPATH parameters in various unspecified scripts...

CVE-2006-2577

Docebo in Docebo LMS 3.0.3 and earlier is affected by multiple PHP remote file inclusion vulnerabilities that can let an attacker execute arbitrary PHP code. The issue arises when PHP register_globals is enabled and an attacker can supply a URL via the parameters where_cms, where_lms, where_upgra...

CVE-2006-2576

CVE-2006-2576 corresponds to Docebo PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier when register_globals is enabled. The issue allows remote code execution by supplying a URL via GLOBALS[where_framework] (files: lib.simplesel.php, lib.filelist.php, tree.documents.php, lib.r...

phpwcms spaw_control.class.php spaw_root Parameter Remote File Inclusion

The remote host is running phpwcms, an open source content management system written in PHP. The version of phpwcms installed on the remote host fails to sanitize user-supplied input to the 'spawroot' parameter before using it in PHP include functions in the...

Fusion News 1.0 (fil_config) - Remote File Inclusion

!/usr/bin/perl use IO::Socket; Exploit coded by: X0r1 Bug found by: X0r1 release: 21.05.06 vulnerable code in sources\post.php at lines 32-35: ---------------------------------------------------------------------------------- ... global $VARS, $TEMPLATE, $fillang, $filconfig, $urlfs, $urlsmil,...

Fusion News v.1.0 (fil_config) Remote File Inclusion Exploit

No description provided by source. !/usr/bin/perl use IO::Socket; Exploit coded by: X0r1 Bug found by: X0r1 release: 21.05.06 vulnerable code in sources\post.php at lines 32-35: ---------------------------------------------------------------------------------- ... global $VARS, $TEMPLATE, $fillan...

Directory traversal

Sugar Suite Open Source SugarCRM 4.2 and earlier, when registerglobals is enabled, does not protect critical variables such as $GLOBALS and $SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion, as demonstrated by...

CVE-2006-2460

Sugar Suite Open Source SugarCRM 4.2 and earlier, when registerglobals is enabled, does not protect critical variables such as $GLOBALS and $SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion, as demonstrated by...

CVE-2006-2460

SugarCRM (Sugar Suite Open Source)

Remote file inclusion

PHP remote file inclusion vulnerability in ezUserManager 1.6 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the ezUserManagerPath parameter to ezusermanagerpwdforgott.php, possibly due to an issue in ezusermanagercore.inc.php...

CVE-2006-2424

PHP remote file inclusion vulnerability in ezUserManager 1.6 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the ezUserManagerPath parameter to ezusermanagerpwdforgott.php, possibly due to an issue in ezusermanagercore.inc.php...

Newsportal: code injection vulnerability

Hello, there is a code injection vulnerability in NewsPortal that could give everyone the ability to execute php code on the webserver where newsportal is installed. This bug should only occur if "registerglobals=on" is set in the php.ini. To remove the problem: - install the recent version:...