eFront 3.6.10 Multiple Security Vulnerabilities

eFront is prone to multiple security vulnerabilities, including: - A remote code injection vulnerability - Multiple SQL injection vulnerabilities - An authentication bypass and privilege escalation vulnerability - A remote code execution vulnerability - A file upload vulnerability...

PHP Photo Album 0.4.1.16 Cross Site Scripting / Disclosure

---------------------------------------------------------------- PHP Photo Album Poc 2 http://localhost/phpAlbum/main.php?cmd=albumnew&keyword=XSS Demo :http://www.iloveazucar.com/phpAlbum/main.php?cmd=albumnew&keyword="onmouseover%3dprompt975554 bad%3d" Demo :http://www.dolfpretorius.com/main.ph...

phpLDAPadmin functions.php 远程PHP代码注入漏洞

BUGTRAQ ID: 50331 phpLDAPadmin是基于web的LDAP客户端，允许方便的管理LDAP服务器。 phpLDAPadmin在实现上存在远程PHP代码注入漏洞，攻击者可利用此漏洞在受影响应用程序中注入和执行PHP代码，控制系统。 1）cmd.php中的URL后附加的输入在返回给用户之前没有正确过滤，可被利用在受影响站点用户浏览器中执行任意HTML和脚本代码。 2）cmd.php中的"orderby"参数中传递的输入在用于"createfunction"函数调用之前，没有在lib/functions.php中正确过滤。可被利用注入和执行任意PHP代码。...

FreeBSD : phpmyfaq -- Remote PHP Code Injection Vulnerability (395e0faa-ffa7-11e0-8ac4-6c626dd55a41)

The phpMyFAQ project reports : The phpMyFAQ Team has learned of a serious security issue that has been discovered in our bundled ImageManager library we use in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library allows injection of arbitrary PHP code via POST requests. %NASLMINLEVEL 70300 C...

phpLDAPadmin -- Remote PHP code injection vulnerability

EgiX n0b0d13s at gmail dot com reports: The $sortby parameter passed to 'masort' function in file lib/functions.php isn't properly sanitized before being used in a call to createfunction at line 1080. This can be exploited to inject and execute arbitrary PHP code. The only possible attack vector ...

phpLDAPadmin 1.2.1.1 Remote PHP Code Injection

$key \n"; 1018. $code .= " asort$a-$key;\n"; 1019. $code .= " $aa = arrayshift$a-$key;\n";...

Dolphin 7.0.7 - 'member_menu_queries.php' Remote PHP Code Injection

?php / ---------------------------------------------------------------------------- Dolphin = 7.0.7 membermenuqueries.php Remote PHP Code Injection Exploit ---------------------------------------------------------------------------- author...............: EgiX mail.................:...

CVE-2010-4890

CVE-2010-4890 affects the TYPO3 extension ke_yac (Yet Another Calendar) version prior to 1.1.2. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The available sources indicate the affected component...

PhpMyAdmin of 3. x Swekey remote code injection vulnerability and fix-vulnerability warning-the black bar safety net

? php echo phpsapiname!==' cli'?'& lt;/pre':"; ifphpsapiname==='cli' if! isset$argv1 output" Usage\n ".$ argv0." "; killme; $pmaurl = $argv1; else $pmaurl = isset$REQUEST'url'?$ REQUEST'url':"; $code = 'foreach$GET as $k=$vif$k==="eval"eval$v;'; $cookie = null; $token = null; if!...

Feed on Feeds 0.5 - Remote PHP Code Injection

Feed on Feeds 0.5 - Remote PHP Code Injection strtolower$b"'.$key.'" ? -1 : 1;'; 1096. 1097. else 1098. 1099. $compare = createfunction'$a,$b','if strtolower$a"'.$key.'" == strtolower$b"'.$key.'" return 0;else return strtolower$a"'.$key.'" strtolower$b"'.$key.'" ? -1 : 1;'; 1100. 1101. 1102...

Feed on Feeds 0.5 - Remote PHP Code Injection

strtolower$b"'.$key.'" ? -1 : 1;'; 1096. 1097. else 1098. 1099. $compare = createfunction'$a,$b','if strtolower$a"'.$key.'" == strtolower$b"'.$key.'" return 0;else return strtolower$a"'.$key.'" strtolower$b"'.$key.'" ? -1 : 1;'; 1100. 1101. 1102. usort$tab,$compare ; 1103. return $tab ; 1104. The...

Feed on Feeds <= 0.5 Remote PHP Code Injection Exploit

Exploit for php platform in category web applications strtolower$b"'.$key.'" ? -1 : 1;'; 1096. 1097. else 1098. 1099. $compare = createfunction'$a,$b','if strtolower$a"'.$key.'" == strtolower$b"'.$key.'" return 0;else return strtolower$a"'.$key.'" strtolower$b"'.$key.'" ? -1 : 1;'; 1100. 1101...

CVE-2010-4850

CVE-2010-4850 affects Diferior 8.03, with multiple XSS vulnerabilities in post_content (post/edit/2/p1.html), slogan (admin/site/2.html), and subcatname/description (admin/forum/create_sub.html). Root cause is insufficient input sanitization, allowing remote attackers to inject arbitrary script/H...

CVE-2011-2932

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a...

DEBIAN-CVE-2011-2506

setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal...

phpMyAdmin Prior to 3.3.10.2 and 3.4.3.1 多个远程漏洞

phpMyAdmin是容易发生多个远程漏洞，包括PHP代码执行和本地文件包含漏洞。 成功的攻击可能会危及受影响的应用程序和可能底层的计算机。 phpMyAdmin版本3.3.10.2和3.4.3.1是脆弱的。 Typo3 phpMyAdmin 4.11.1 phpMyAdmin phpMyAdmin 3.4.3 phpMyAdmin phpMyAdmin 3.3.8 phpMyAdmin phpMyAdmin 3.3.7 phpMyAdmin phpMyAdmin 3.3.6 phpMyAdmin phpMyAdmin 3.4.1 phpMyAdmin phpMyAdmin 3.3.9....

phpMyAdmin 3.x Swekey Remote Code Injection Exploit

Exploit for php platform in category web applications ':'';? . , \ . . ,/ , / , \ \ // / / / \ | | \ / | |\ /| | | | | | | | / | | | | / | | | || | | | | | \ \ | | | || | \ \ | | | | | | | | | | | | / / | | | | | | | | | | | | | | | |// || || | |// || || ||| | || ||| || | ||...

phpMyAdmin 3.x - Swekey Remote Code Injection

phpMyAdmin 3.x - Swekey Remote Code Injection ':'';? . , \ . . ,/ , / , \ \ // / / / \ | | \ / | |\ /| | | | | | | | / | | | | / | | | || | | | | | \ \ | | | || | \ \ | | | | | | | | | | | | / / | | | | | | | | | | | | | | | |// || || | |// || || ||| | || ||| || | ||...

phpMyAdmin 3.x - Swekey Remote Code Injection

':'';? . , \ . . ,/ , / , \ \ // / / / \ | | \ / | |\ /| | | | | | | | / | | | | / | | | || | | | | | \ \ | | | || | \ \ | | | | | | | | | | | | / / | | | | | | | | | | | | | | | |// || || | |// || || ||| | || ||| || | ||...

phpMyAdmin 3.x Swekey Remote Code Injection Exploit

No description provided by source. ?php / Exploit Title: phpMyAdmin 3.x Swekey Remote Code Injection Exploit Date: 2011-07-09 Author: Mango of ha.xxor.se Version: phpMyAdmin 3.3.10.2 || phpMyAdmin 3.4.3.1 CVE : CVE-2011-2505, CVE-2011-2506 Advisory:...