Remote file inclusion

PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the filepath parameter in 1 index.php, 2 feedback.php, and 3 printfriendly.php...

[MajorSecurity #9]HostAdmin <= 3.1 - Remote File Include Vulnerability

MajorSecurity 9HostAdmin = 3.1 - Remote File Include Vulnerability ------------------------------------------------------------------------- Software: HostAdmin Version: =3.1 Type: Remote File Include Vulnerability Date: June, 3rd 2006 Vendor: dreamcost Page: http://dreamcost.com Risc: High...

major_rls7.txt

MajorSecurity 7dotWidget CMS = 1.0.6 - Remote File Include Vulnerability ------------------------------------------------------------------------------------- Software: dotWidget CMS Version: =1.0.6 Type: Remote File Include Vulnerability Date: June, 2nd 2006 Vendor: dotWidget Page:...

[MajorSecurity #7]dotWidget CMS <= 1.0.6 - Remote File Include Vulnerability

MajorSecurity 7dotWidget CMS = 1.0.6 - Remote File Include Vulnerability ------------------------------------------------------------------------------------- Software: dotWidget CMS Version: =1.0.6 Type: Remote File Include Vulnerability Date: June, 2nd 2006 Vendor: dotWidget Page:...

Remote file inclusion

PHP remote file inclusion vulnerability in METAjour 2.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the 1 systempath parameter in a large number of files in the a app/edocument/, b app/eproject/, c app/erek/, and d extension/ directories, and the 2...

CVE-2006-2767

CVE-2006-2767 is a PHP remote file inclusion vulnerability in Ottoman 1.1.2, triggered when register_globals is enabled. The vulnerability allows an attacker to execute arbitrary PHP code via the default_path parameter in the following files: error.php, index.php, and classes/main_class.php. The ...

CVE-2006-2768

METAjour 2.1 contains a PHP remote file inclusion vulnerability exploitable when register_globals is enabled. An attacker can execute arbitrary PHP code via (1) the system_path parameter in files under app/edocument/, app/eproject/, app/erek/, and extension/ directories, and (2) the GLOBALS[syste...

Squirrelmail local file inclusion

Squirrelmail local file inclusion bug in functions/plugin.php . Tested on the latest 1.4.x version. No authentication needed. if isset$plugins && isarray$plugins foreach $plugins as $name useplugin$name; ... function useplugin $name if fileexistsSMPATH . "plugins/$name/setup.php" includeonceSMPAT...

Remote file inclusion

PHP remote file inclusion vulnerability in blenddata/blendcommon.php in Blend Portal 1.2.0, as used with phpBB when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter. NOTE: This is a similar vulnerability to CVE-2006-2507...

Remote file inclusion

PHP remote file inclusion vulnerability in language/langenglish/langactivity.php in Activity MOD Plus Amod 1.1.0, as used with phpBB when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter. NOTE: This is a similar vulnerabili...

Remote file inclusion

PHP remote file inclusion vulnerability in footers.php in Epicdesigns tinyBB 0.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the tinybbfooters parameter...

CVE-2006-2730

The CVE-2006-2730 entry concerns a PHP remote file inclusion vulnerability in Hot Open Tickets (HOT) 11012004_ver2f. When register_globals is enabled, an attacker could abuse the GLOBALS[CLASS_PATH] parameter in admin/lib_action_step.php to include arbitrary files. The vulnerability aligns with a...

CVE-2006-2736

CVE-2006-2736 is a PHP remote file inclusion vulnerability affecting Blend Portal 1.2.0 when used with phpBB with register_globals enabled. The flaw resides in blend_data/blend_common.php and allows code execution via a URL in the phpbb_root_path parameter. This entry is corroborated across multi...

CVE-2006-2730

PHP remote file inclusion vulnerability in admin/libactionstep.php in Hot Open Tickets HOT 11012004ver2f, when registerglobals is enabled, allows remote attackers to include arbitrary files via the GLOBALSCLASSPATH parameter. NOTE: this issue might be resultant from a global overwrite vulnerabili...

CVE-2006-2735

CVE-2006-2735 is a PHP remote file inclusion vulnerability in Activity MOD Plus (Amod) 1.1.0 (language/lang_english/lang_activity.php) used with phpBB when register_globals is on. The flaw allows an attacker to execute arbitrary PHP code by supplying a URL in the phpbb_root_path parameter. The en...

squirrelmail -- plugin.php local file inclusion vulnerability

The SquirrelMail Project Team reports: A security issue has been uncovered in functions/plugin.php that could allow a remote user to access local files on the server without requiring login. This issue manifests itself if registerglobals is enabled, and magicquotesgpc is disabled...

pppBlog-0.3.8.txt

!/usr/bin/php -q -d shortopentag=on ? echo "pppBlog = 0.3.8 system disclosure exploit\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "dork: intext:"Powered by pppblog"\r\n\r\n"; / works with: registerglobals=On / if $argc4 echo "Usage: php...

CVE-2006-2685

PHP remote file inclusion vulnerability in Basic Analysis and Security Engine BASE 1.2.4 and earlier, with registerglobals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BASEpath parameter to 1 baseqrycommon.php, 2 basestatcommon.php, and 3...

Remote file inclusion

PHP remote file inclusion vulnerability in Basic Analysis and Security Engine BASE 1.2.4 and earlier, with registerglobals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BASEpath parameter to 1 baseqrycommon.php, 2 basestatcommon.php, and 3...

CVE-2006-2685

PHP remote file inclusion vulnerability in Basic Analysis and Security Engine BASE 1.2.4 and earlier, with registerglobals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BASEpath parameter to 1 baseqrycommon.php, 2 basestatcommon.php, and 3...