SQL-Ledger serious security vulnerability and workaround

Hi; This post is to inform everyone that there is a serious security hole that has been discovered in SQL-Ledger involving session handling. The flaw allows anyone with network access to the server to access the application as any logged in user using trivial mechanisms. I have previously brought...

IRSR <= 0.2 (_sysSessionPath) Remote File Include Vulnerability

Exploit for unknown platform in category web applications =============================================================== IRSR pageheaderdefault.inc.php line 28-36: code // // Perform the session handling preprocessing. // requireonce $sysSessionPath; // Include the session handling functions...

IRSR 0.2 - '_sysSessionPath' Remote File Inclusion

/ + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - IRSR - Invisionix Roaming System Remote pageheaderdefault.inc.php line 28-36: code // // Perform the session handling preprocessing. // requireonce $sysSessionPath; // Include the session handling functions...

CVE-2006-3016

CVE-2006-3016 is a PHP vulnerability in the session handling code (session.c) that could allow a remote attacker to trigger a cross-site scripting or HTTP response splitting attack by supplying a crafted session identifier. The issue is associated with using non-alphanumeric session names and is ...

Directory traversal

Directory traversal vulnerability in the session handling class GallerySession.class in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie, which is used in constructing file paths before the session value is sanitized...

CVE-2006-1128

Directory traversal vulnerability in the session handling class GallerySession.class in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie, which is used in constructing file paths before the session value is sanitized...

CVE-2006-1128

CVE-2006-1128 is a directory traversal vulnerability in Gallery 2 (up to 2.0.2) where the session value from a cookie is used to build file paths before sanitization, allowing remote attackers to access and delete files. Connected sources confirm the affected component is GallerySession.class and...

Geeklog lib-sessions.php Session Cookie Handling Authentication Bypass

The version of Geeklog installed on the remote contains a flaw in its session-handling library that can be exploited by an attacker to bypass authentication and gain access as any user, including the admin. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CVE-2006-1069

Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors...

CVE-2006-1069

Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors...

CVE-2006-1069

CVE-2006-1069 affects Geeklog versions with a flaw in the session-handling library (lib-sessions.php) that can be exploited to bypass authentication and gain access as any user, including admin. Affected: Geeklog 1.4.x before 1.4.0sr2; 1.3.11 before 1.3.11sr5; 1.3.9 before 1.3.9sr5 (and possibly ...

CVE-2006-1069: Undefined Security Weakness

Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors...

CVE-2006-0517

Multiple SQL injection vulnerabilities in formulaires/inc-formulaireforum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 idforum, 2 idarticle, or 3 idbreve parameters to forum.php3; 4 unspecified vectors related...

DEBIAN-CVE-2006-0517

Multiple SQL injection vulnerabilities in formulaires/inc-formulaireforum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 idforum, 2 idarticle, or 3 idbreve parameters to forum.php3; 4 unspecified vectors related...

CVE-2006-0517

Multiple SQL injection vulnerabilities in formulaires/inc-formulaireforum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 idforum, 2 idarticle, or 3 idbreve parameters to forum.php3; 4 unspecified vectors related...

CVE-2006-0517

Multiple SQL injection vulnerabilities in formulaires/inc-formulaireforum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 idforum, 2 idarticle, or 3 idbreve parameters to forum.php3; 4 unspecified vectors related...

Advisory 01/2006: PHP ext/session HTTP Response Splitting Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: PHP ext/session HTTP Response Splitting Vulnerability Release Date: 2006/01/12 Last Modified: 2006/01/12 Author: Stefan Esser [email protected] Application: PHP5 = 5.1.1...

CVE-2005-3416

CVE-2005-3416 affects phpBB up to version 2.0.17 (and earlier) where, if register_globals is enabled and session handling omits a call to session_start, an attacker can bypass security checks by assigning strings to $_SESSION and $HTTP_SESSION_VARS, which causes an array_merge to fail. OpenVAS/De...

PHPsFTPd - Admin password leak

Author: Stefan Lochbihler Date: 11. Juli 2005 Affected Software: PHPsFTPd Software Version: 0.2 - 0.4 Software URL: http://phpsftpd.sourceforge.net/ Attack: Admin password leak about PHPsFTPd: PHPsFTPd is a web based administration and configuration interface for the SLimFTPd ftp serverIt can be...