Remote file inclusion

PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when registerglobals is enabled, allows remote attackers to execute arbitrary code via an FTP URL in the datadir parameter, which satisfies the fileexists function call...

Sphider configset.php settings_dir Parameter Remote File Inclusion

The remote host is running Sphider, an open source web spider and search engine written in PHP. The version of Sphider installed on the remote host fails to sanitize user-supplied input to the 'settingsdir' parameter of the 'admin/configset.php' script before using it in a PHP 'include' function...

Remote file inclusion

PHP remote file inclusion vulnerability in admin/configset.php in Sphider 1.3 and earlier, when registerglobals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the settingsdir parameter...

CVE-2006-1784

PHP remote file inclusion vulnerability in admin/configset.php in Sphider 1.3 and earlier, when registerglobals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the settingsdir parameter...

Sphider <= 1.3 (configset.php) Arbitrary Remote Inclusion Exploit

Exploit for unknown platform in category web applications ================================================================= Sphider works with registerglobals = On & allowurlfopen = On\r\n"; print "by rgod rgodautisticiorg\r\n"; print "site: http://retrogod.altervista.org\r\n"; print "\r\ndork:...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party ALP, allow remote attackers to execute arbitrary PHP code via a URL in the libpath parameter to scripts in the lib directory including 1 ase.php, 2 devi.php, 3 doom3.php,...

PHProjekt authform.inc.php path_pre Parameter Remote File Inclusion

The remote host is running PHProjekt, an open source groupware suite written in PHP. The version of PHProjekt installed on the remote host fails to sanitize user-supplied input to the 'pathpre' parameter of the 'lib/authform.inc.php' script before using it in a PHP 'includeonce' function. Provide...

AngelineCMS loadkernel.php installPath Parameter Remote File Inclusion

The remote host is running AngelineCMS, an open source content management system written in PHP. The version of AngelineCMS installed on the remote host fails to sanitize user-supplied input to the 'installPath' parameter of the '/kernel/loadkernel.php' script before using it in a PHP 'includeonc...

Remote file inclusion

PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party ALP, allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. NOTE: this only occurs when registerglobals is disabled...

CVE-2006-1610

PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party ALP, allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. NOTE: this only occurs when registerglobals is disabled...

Mantis File Inclusion and SQL Injection Flaws

The remote web server contains a PHP application that is affected by multiple flaws. Description : The remote version of Mantis suffers from a remote file inclusion vulnerability. Provided PHP's 'registerglobals' setting is enabled, An attacker may be able to leverage this issue to read arbitrary...

SugarCRM <= 4.0 beta Remote File Inclusion Vulnerability

The remote web server contains a PHP script that is prone to multiple flaws. Description : SugarCRM is a Customer Relationship Manager written in PHP. The version of SugarCRM installed on the remote host does not properly sanitize user input in the 'beanFiles' parameter in the 'acceptDecline.php'...

SugarCRM <= 4.0 beta Remote File Inclusion Vulnerability

The version of SugarCRM installed on the remote host does not properly sanitize user input in the SPDX-FileCopyrightText: 2005 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

phpDocumentor <= 1.3.0 RC4 LFI/RFI Vulnerability - Active Check

phpDocumentor is prone to local and remote file inclusion LFI/RFI vulnerabilities. SPDX-FileCopyrightText: 2006 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CuteNews inc/function.php archive Parameter Arbitrary File Access

The version of CuteNews installed on the remote host fails to properly sanitize the 'archive' parameter before using it to read a news file and return it. An unauthenticated, remote attacker may be able to leverage this issue to read arbitrary files on the remote host subject to permissions of th...

Gallery stepOrder Parameter Local File Inclusion

The version of Gallery hosted on the remote web server fails to sanitize input to the 'stepOrder' parameter of the 'upgrade/index.php' and 'install/index.php' scripts before using it in a PHP 'require' function. An unauthenticated attacker may be able to exploit this issue to view arbitrary files...

CVE-2006-1120

CVE-2006-1120 describes multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 (and earlier) when register_globals is enabled. The affected entry lists numerous vulnerable input points across several pages: its_url in documents.php; url in send_write.php (index.php); ...

txtForum: Script Injection Vulnerability

=========================================================== txtForum: Script Injection Vulnerability =========================================================== Technical University of Vienna Security Advisory TUVSA-0603-004, March 9, 2006 =========================================================...

DCP Portal: Multiple XSS Vulnerabilities

=========================================================== DCP Portal: Multiple XSS Vulnerabilities =========================================================== Technical University of Vienna Security Advisory TUVSA-0603-001, March 9, 2006 =========================================================...

Gallery 2.0.3 - stepOrder[] Remote Command Execution

Gallery 2.0.3 - stepOrder Remote Command Execution !/usr/bin/php -q -d shortopentag=on autisticiorg \r\n"; echo "site: http://retrogod.altervista.org \r\n\r\n"; echo "- works with registerglobals = On and magicquotesgpc = Off \r\n"; if $argc5 echo "Usage: php ".$argv0." host path user pass cmd...