CVE-2008-3769

CVE-2008-3769 describes a PHP remote file inclusion vulnerability in Freeway 1.4.1.171, specifically in admin/create_order_new.php. When register_globals is enabled, an attacker can supply a URL in the include_page parameter to cause the application to include remote PHP code, enabling arbitrary ...

Aardvark Topsites <= 4.2.2 Remote File Inclusion Vulnerability

The remote system contains a PHP application that is prone to remote file inclusions attacks. Description : Aardvark Topsites PHP is installed on the remote host. It is an open source Toplist management system written in PHP. The application does not sanitize user-supplied input to the...

CVE-2008-3763

Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when registerglobals is enabled, allows remote attackers to overwrite arbitrary variables related to the db config file. NOTE: this can be leveraged for code injection by overwriting the language file...

CVE-2008-3763

CVE-2008-3763 describes a variable overwrite vulnerability in libsecure.php of Turnkey PHP Live Helper 2.0.1 and earlier. When register_globals is enabled, remote attackers can overwrite arbitrary variables related to the db config file, potentially enabling code injection by overwriting the lang...

CVE-2008-3712

Multiple cross-site scripting XSS vulnerabilities in Mambo 4.6.2 and 4.6.5, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 query string to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php and the 2...

CVE-2008-3712

Multiple cross-site scripting XSS vulnerabilities in Mambo 4.6.2 and 4.6.5, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 query string to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php and the 2...

flexcms-xss.txt

---------------------------------------------------------------- Script : FlexCMS alertdocument.cookie Attacker can hijack admin cookie with this vulnerability .... Solution for patch : filter PreviousColorsString variable with htmlspecialchars function...

Directory traversal

Directory traversal vulnerability in contrib/phpBB2/modules.php in Gallery 1.5.7 and 1.6-alpha3, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the phpEx parameter within a modload action...

CVE-2008-3600

Directory traversal vulnerability in contrib/phpBB2/modules.php in Gallery 1.5.7 and 1.6-alpha3, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the phpEx parameter within a modload action...

CVE-2008-3569

Multiple cross-site scripting XSS vulnerabilities in XAMPP 1.6.7, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the text parameter to 1 iart.php and 2 ming.php...

CVE-2008-3574

Multiple cross-site scripting XSS vulnerabilities in Pluck 4.5.2, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 langfooter parameter to a data/inc/footer.php; the 2 pluckversion, 3 langinstall22, 4 titelkop, 5 langkop1, 6 langkop2, 7...

CVE-2008-3569

Multiple cross-site scripting XSS vulnerabilities in XAMPP 1.6.7, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the text parameter to 1 iart.php and 2 ming.php...

DSECRG-08-035.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-035 Application: Gallery Versions Affected: 1.5.7, 1.6-alpha3 Vendor URL: http://gallery.menalto.com/ Bug: Local File Include Exploits: YES Reported: 14.07.2008 Vendor response: 15.07.2008 Solution: YES Date of Public Advisory: 08.08.2008...

[DSECRG-08-035] Local File Include Vulnerability in Gallery 1.5.7, 1.6-alpha3

Digital Security Research Group DSecRG Advisory DSECRG-08-035 Application: Gallery Versions Affected: 1.5.7, 1.6-alpha3 Vendor URL: http://gallery.menalto.com/ Bug: Local File Include Exploits: YES Reported: 14.07.2008 Vendor response: 15.07.2008 Solution: YES Date of Public Advisory: 08.08.2008...

Pluck 4.5.2 Multiple Cross Site Scripting Vulnerabilities

---------------------------------------------------------------- Script : Pluck 4.5.2 Type : Multiple Cross Site Scripting Vulnerabilities Alert : Medium ---------------------------------------------------------------- Download From : http://www.pluck-cms.org/downloads/pluck-452.tar.gz...

xampp-xss.txt

---------------------------------------------------------------- Program : Xampp Linux 1.6.7 Type : Multiple Cross Site Scripting Vulnerabilities Alert : Medium ---------------------------------------------------------------- Download From :...

Remote file inclusion

PHP remote file inclusion vulnerability in activities/workflow-activities.php in XRMS CRM 1.99.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the includedirectory parameter...

CVE-2008-3365

Pixelpost 1.7.1 on Windows is affected by a directory traversal vulnerability in index.php that, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. in the language_full parameter. Root cause is a path traversal in input handling; impact...

[DSECRG-08-034] Local File Include Vulnerability in Minishowcase v09b136

Digital Security Research Group DSecRG Advisory DSECRG-08-034 Application: Minishowcase Image Gallery Versions Affected: v09b136 Vendor URL: http://minishowcase.frwrd.net Bug: Local File Include Exploits: YES Reported: 14.07.2008 Second report: 22.07.2008 Vendor response: NONE Solution: NONE Date...

[DSECRG-08-033] Local File Include Vulnerability in Pixelpost 1.7.1

Digital Security Research Group DSecRG Advisory DSECRG-08-033 Application: Pixelpost photoblog Versions Affected: 1.7.1 Vendor URL: http://www.pixelpost.org/ Bug: Local File Include Exploits: YES Reported: 22.07.2008 Vendor response: 23.07.2008 Solution: YES Date of Public Advisory: 28.07.2008...