EUVD-2006-0829

Malware in sbrugna...

Sql injection

SQL injection vulnerability in the checkbanlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2 allows remote attackers to execute arbitrary SQL commands via the email parameter to index.php. NOTE: some of these...

CVE-2010-4780

SQL injection in Enano CMS affects the check_banlist code path (includes/sessions.php) and can be triggered via the email parameter to index.php, allowing remote execution of arbitrary SQL. Impact is SQL-level access to the application database for affected versions (1.1.7pl1, 1.0.6pl2 and possib...

FestOS 2.2.1 Remote File Inclusion

Exploit Title: FestOs $reports header"Location:index.php"; include "includes/reportheader.php"; ? 3xplo!t : festospath/admin/reportsplacement.php?ABSOLUTEFILEPATH=Shell Code : FestOS.php requireonce$config'ABSOLUTEFILEPATH'."core/sessions.php"; 3xplo!t :...

Wheatblog (wB) Remote File inclusion ..

Hello,, Wheatblog wB Remote File inclusion .. tested on 1.1 and older versions are injected Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Remote File Inclusion file : includes/sessions.php line 2 : code:-...

Geeklog lib-sessions.php Session Cookie Handling Administrative Bypass

Binary data 3464.prm...

CVE-2006-0823

Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the 1 userid variable to users.php or 2 sessid variable to lib-sessions.php...

CVE-2005-0614

sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie...

CVE-2005-0614

sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie...

phpBB 2.0.13 - user level exploit

This one goes for all phpBB versions up to 2.0.13. While applying and testing the patch for the autologin bug I found that phpBB2 doesn't reset the $userdata'userlevel' variable after a failed autologin. This is the vulvernable code in sessions.php: if $userid != ANONYMOUS $autologinkey =...

CVE-2005-0614

Affected software/component: phpBB (versions