Moodle 'filter/tex/texed.php' 'pathname' Parameter Remote Command Execution

The version of Moodle installed on the remote host fails to sanitize user-supplied input to the 'pathname' parameter before using it in the 'filter/tex/texed.php' script in a commandline that is passed to the shell. Provided that PHP's 'registerglobals' setting and the TeX Notation filter has bot...

[DSECRG-08-040] Multiple Local File Include Vulnerabilities in Xoops 2.3.x

Digital Security Research Group DSecRG Advisory DSECRG-08-040 Application: XOOPS Versions Affected: 2.3.1 Vendor URL: http://www.xoops.org/ Bug: Multiple Local File Include Exploits: YES Reported: 10.11.2008 Vendor response: 10.11.2008 Solution: YES Date of Public Advisory: 08.12.2008 Authors:...

XOOPS 2.3.1 Local File Inclusions

Digital Security Research Group DSecRG Advisory DSECRG-08-040 Application: XOOPS Versions Affected: 2.3.1 Vendor URL: http://www.xoops.org/ Bug: Multiple Local File Include Exploits: YES Reported: 10.11.2008 Vendor response: 10.11.2008 Solution: YES Date of Public Advisory: 08.12.2008 Authors:...

XOOPS 2.3.1 Multiple Local File Inclusion Vulnerabilities

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-040 Application: XOOPS Versions Affected: 2.3.1 Vendor URL: http://www.xoops.org/ Bug: Multiple Local File Include Exploits: YES Reported: 10.11.2008 Vendor response: 10.11.2008 Solution: YES Date of Publ...

Remote file inclusion

PHP remote file inclusion vulnerability in include/header.php in Werner Hilversum FAQ Manager 1.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the configpath parameter...

CVE-2008-5296

CVE-2008-5296 affects Gallery: versions 1.5.x before 1.5.10 and 1.6 before 1.6-RC3. When register_globals is enabled, remote attackers can bypass authentication and gain an administrative session via unspecified cookies. This is described across NVD/NVD-related entries and mirrored in OpenVAS/Ubu...

CVE-2008-5288

CVE-2008-5288 affects Werner Hilversum FAQ Manager 1.2. It is a PHP remote file inclusion vulnerability in include/header.php when register_globals is enabled, allowing an attacker to execute arbitrary PHP code via a URL supplied in the config_path parameter. Affects versions/hosting context are ...

Directory traversal

Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter to 1 agb.php, 2 angemeldet.php, 3 anmelden.php, 4 charts.php, 5...

CVE-2008-5204

CVE-2008-5204 affects PowerAward 1.1.0 RC1. The vulnerability consists of multiple directory traversal flaws in the lang parameter across 15 PHP scripts (including agb.php, angemeldet.php, anmelden.php, charts.php, external_vote.php, guestbook.php, impressum.php, index.php, rss-reader.php, statis...

CVE-2008-5204

Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter to 1 agb.php, 2 angemeldet.php, 3 anmelden.php, 4 charts.php, 5...

Remote file inclusion

PHP remote file inclusion vulnerability in layout/default/params.php in Boonex Orca 2.0 and 2.0.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the gConfdirlayouts parameter...

Pluck CMS 4.5.3 (g_pcltar_lib_dir) Local File Inclusion Vulnerability

No description provided by source. Hello, bugtraq. Digital Security Research Group DSecRG Advisory DSECRG-08-039 Application: Pluck CMS Versions Affected: 4.5.3 Vendor URL: http://www.pluck-cms.org/ Bug: Local File Include Exploits: YES Reported: 25.08.2008 Vendor Response: 30.08.2008 Solution: Y...

[DSECRG-08-039] Local File Include Vulnerability in Pluck CMS 4.5.3

Hello, bugtraq. Digital Security Research Group DSecRG Advisory DSECRG-08-039 Application: Pluck CMS Versions Affected: 4.5.3 Vendor URL: http://www.pluck-cms.org/ Bug: Local File Include Exploits: YES Reported: 25.08.2008 Vendor Response: 30.08.2008 Solution: YES Date of Public Advisory:...

DSECRG-08-039.txt

Hello, bugtraq. Digital Security Research Group DSecRG Advisory DSECRG-08-039 Application: Pluck CMS Versions Affected: 4.5.3 Vendor URL: http://www.pluck-cms.org/ Bug: Local File Include Exploits: YES Reported: 25.08.2008 Vendor Response: 30.08.2008 Solution: YES Date of Public Advisory:...

Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Local File Inclusion

Hello, bugtraq. Digital Security Research Group DSecRG Advisory DSECRG-08-039 Application: Pluck CMS Versions Affected: 4.5.3 Vendor URL: http://www.pluck-cms.org/ Bug: Local File Include Exploits: YES Reported: 25.08.2008 Vendor Response: 30.08.2008 Solution: YES Date of Public Advisory:...

Pluck CMS 4.5.3 (g_pcltar_lib_dir) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ===================================================================== Pluck CMS 4.5.3 gpcltarlibdir Local File Inclusion Vulnerability ===================================================================== Hello, bugtraq. Digital Security...

Pluck CMS 4.5.3 - g_pcltar_lib_dir Local File Inclusion

Pluck CMS 4.5.3 - gpcltarlibdir Local File Inclusion Hello, bugtraq. Digital Security Research Group DSecRG Advisory DSECRG-08-039 Application: Pluck CMS Versions Affected: 4.5.3 Vendor URL: http://www.pluck-cms.org/ Bug: Local File Include Exploits: YES Reported: 25.08.2008 Vendor Response:...

Enthusiast 3.1.4 (show_joined.php path) Remote File Inclusion Vuln

Exploit for unknown platform in category web applications ================================================================== Enthusiast 3.1.4 showjoined.php path Remote File Inclusion Vuln ==================================================================...

CVE-2008-4893

Cross-site scripting XSS vulnerability in templates/mytribiqsite/tribal-GPL-1066/includes/header.inc.php in Tribiq CMS 5.0.10a, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the templatepath parameter. NOTE: the provenance of this information ...

pppblog-disclose.txt

pppBlog = 0.3.11 randompic.php System File Disclosure Vulnerability url: http://sourceforge.net/projects/pppblog/ Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose. Use it at your own risk. Auth...