Directory traversal

Directory traversal vulnerability in makepost.php in DaZPHPNews 0.1-1, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the prefixdir parameter...

CVE-2008-1696

Directory traversal vulnerability in makepost.php in DaZPHPNews 0.1-1, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the prefixdir parameter...

PowerBook 1.21 (index.php page) Local File Inclusion Vulnerability

No description provided by source. DSECRG-08-019 Digital Security Research Group DSecRG Advisory Application: PowerBook Versions Affected: 1.21 Vendor URL: http://www.powerscripts.org/ Bug: Local File Include Exploits: YES Reported: 01.02.2008 Vendor Response: none Solution: none Date of Public...

PowerPHPBoard 1.00b - Multiple Local File Inclusions

PowerPHPBoard 1.00b - Multiple Local File Inclusions DSECRG-08-021 Digital Security Research Group DSecRG Advisory Application: PowerPHPBoard Versions Affected: 1.00b Vendor URL: http://www.powerscripts.org/ Bug: Multiple Local File Include Exploits: YES Reported: 01.02.2008 Vendor Response: none...

PowerPHPBoard 1.00b - Multiple Local File Inclusions

DSECRG-08-021 Digital Security Research Group DSecRG Advisory Application: PowerPHPBoard Versions Affected: 1.00b Vendor URL: http://www.powerscripts.org/ Bug: Multiple Local File Include Exploits: YES Reported: 01.02.2008 Vendor Response: none Solution: none Date of Public Advisory: 24.03.2008...

PowerBook 1.21 (index.php page) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================== PowerBook 1.21 index.php page Local File Inclusion Vulnerability ================================================================== DSECRG-08-019 Digital Security Research...

PHPAuction Multiple Script include_path Parameter File Inclusion

The remote host is running PHPAuction, a PHP script for building auction websites. The version of PHPAuction installed on the remote host fails to sanitize input to the 'includepath' parameter of several scripts before using it to include PHP code. An unauthenticated, remote attacker can exploit...

joomlaoldconfig-rfi.txt

Affects: Joomla 1.0.13 - 1.0.14 Vulnerability: remote PHP file inclusion possible if old configuration.php Date: 14-feb-2008 Introduction: Remote PHP file inclusion is possible when RGEMULATION is not defined in configuration.php. This is typical when upgrading from an older version, leaving...

journalness-exec.txt

!/usr/bin/perl Vendor url: journalness.sourceforge.net note: exploit requires Registerglobals = On in php.ini Iron http://www.randombase.com require LWP::UserAgent; print " Journalness ; if$target ! /^http:/// $target = "http://".$target; if$target ! //$/ $target .= "/"; print "PHP code to...

openrealty-exec.txt

!/usr/bin/perl Vendor url: www.open-realty.org note: exploit requires Registerglobals = On in php.ini Iron http://www.randombase.com require LWP::UserAgent; print " Open-Realty ; if$target ! /^http:/// $target = "http://".$target; if$target ! //$/ $target .= "/"; print "PHP code to evaluate? ";...

Mindmeld 1.2.0.10 Multiple Remote File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications ================================================================ Mindmeld 1.2.0.10 Multiple Remote File Inclusion Vulnerabilities ================================================================ Summary Mindmeld is an, "enterprise-capable...

SQLiteManager confirm.php spaw_root Parameter Remote File Inclusion

The remote host is running SQLiteManager, a web-based application for managing SQLite databases. The version of SQLiteManager installed on the remote host fails to sanitize user-supplied input to the 'spawroot' parameter of the 'spaw/dialogs/confirm.php' script before using it to include PHP code...

Debian Security Advisory DSA 1096-1 (webcalendar)

The remote host is missing an update to webcalendar announced via advisory DSA 1096-1. A vulnerability has been discovered in webcalendar, a PHP-based multi-user calendar, that allows a remote attacker to execute arbitrary PHP code when registerglobals is turned on. The old stable distribution...

Debian: Security Advisory (DSA-1096-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2008-0274

Cross-site scripting XSS vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files...

pMachinePro-241-xss.txt

[email protected] found: pMachine Pro 2.4.1 Cross Site Scripting Vulnerability http://pmachinepro.com/ Vulnerable: site/path/pm/language/spanish/preferences.php Variables: LPREFGROUPS100 LPREFGROUPS110 LPREFNAME810 LPREFNAME850 etc PoC:...

SA-2008-007 - Drupal core - Cross site scripting (register_globals)

When theme .tpl.php files are accessible via the web and the PHP setting registerglobals is set to enabled, anonymous users are able to execute cross site scripting attacks via specially crafted links. Drupals .htaccess attempts to set registerglobals to disabled and also prevents access to...

drupal -- cross site scripting (register_globals)

The Drupal Project reports: When theme .tpl.php files are accessible via the web and the PHP setting registerglobals is set to enabled, anonymous users are able to execute cross site scripting attacks via specially crafted links. Drupal's .htaccess attempts to set registerglobals to disabled and...

Remote file inclusion

PHP remote file inclusion vulnerability in xoopsgallery/initbasic.php in the modgallery module for XOOPS, when registerglobals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the GALLERYBASEDIR parameter...

CVE-2008-0138

Summary : CVE-2008-0138 concerns the XoopsGallery mod_gallery module for XOOPS, specifically the init_basic.php script. When register_globals is disabled, the GALLERY_BASEDIR parameter can be controlled by a remote attacker to cause a remote file inclusion, allowing execution of arbitrary PHP cod...