PHP Scripts Mall Professional Service Script Information Disclosure Vulnerability (CNVD-2018-00493)

Professional Service Script is a script from PHP Scripts Mall with search, task creation and task management features. An information disclosure vulnerability exists in PHP Scripts Mall Professional Service Script. A remote attacker can exploit this vulnerability to obtain sensitive full path...

CVE-2017-17927

PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATHINFO to service-list/category/...

CVE-2017-17930: Cross-Site Request Forgery (CSRF)

PHP Scripts Mall Professional Service Script has CSRF via admin/generalsettingupd.php, as demonstrated by modifying a setting in the user panel...

CVE-2017-17929: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter...

CVE-2017-17928: Improper Neutralization of Special Elements used in an SQL Command

PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter...

CVE-2017-17927: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATHINFO to service-list/category/...

CVE-2017-17926: Exposure of Sensitive Information to an Unauthorized Actor

PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address...

CVE-2017-17925: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Professional Service Script has XSS via the admin/generalsettingupd.php websitetitle parameter...

CVE-2017-17924: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/reviewuserwise.php...

PT-2017-15105

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Professional Service Script affected versions not specified Description The issue is related to SQL injection, which occurs via the id parameter in the "admin/review.php" API endpoint. Recommendations At the moment, there is n...

PT-2017-15104

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Professional Service Script affected versions not specified Description The issue allows remote attackers to obtain sensitive full-path information. This can be achieved by sending a crafted PATH INFO to the...

PT-2017-15106

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Professional Service Script affected versions not specified Description The issue is related to a security problem where an attacker can inject malicious code. The problem is exploited through the view parameter in the...

PT-2017-15107

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Professional Service Script affected versions not specified Description The issue concerns a CSRF problem via the "admin/general settingupd.php" endpoint, which can be exploited to modify settings in the user panel...

PT-2017-15102

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Professional Service Script affected versions not specified Description The issue is related to a security problem where an attacker can inject malicious code into the website. This is possible due to the lack of proper input...