EUVD-2007-1124

Malware in sbrugna...

EUVD-2007-1125

Malware in sbrugna...

CVE-2007-1127

Directory traversal vulnerability in enc/stylecss.php in shopkitplus allows remote attackers to read arbitrary files via a .. dot dot in the changetheme parameter...

Directory traversal

Directory traversal vulnerability in enc/stylecss.php in shopkitplus allows remote attackers to read arbitrary files via a .. dot dot in the changetheme parameter...

CVE-2007-1128

shopkitplus allows remote attackers to obtain sensitive information via a request to 1 events.php with a curmonth=01 query string or 2 enc/stylecss.php with a changetheme= query string, which reveals the path in various error messages...

CVE-2007-1127

Directory traversal vulnerability in enc/stylecss.php in shopkitplus allows remote attackers to read arbitrary files via a .. dot dot in the changetheme parameter...

CVE-2007-1127

CVE-2007-1127 describes a directory traversal in shopkitplus: enc/stylecss.php accepts a changetheme parameter and can be coerced with .. to read arbitrary files. NVD lists CVSS v2.0 base score 6.4 (Medium) with network attack vector and no authentication, confidentiality and integrity partially ...

CVE-2007-1128

CVE-2007-1128 affects shopkitplus. The issue is an information disclosure where requests to (1) events.php with curmonth[]=01 or (2) enc/stylecss.php with changetheme[]= reveal the installation path in error messages. The affected component is PHP-based endpoints; root cause is improper handling ...

CVE-2007-1128

shopkitplus allows remote attackers to obtain sensitive information via a request to 1 events.php with a curmonth=01 query string or 2 enc/stylecss.php with a changetheme= query string, which reveals the path in various error messages...

CVE-2007-1127: Undefined Security Weakness

Directory traversal vulnerability in enc/stylecss.php in shopkitplus allows remote attackers to read arbitrary files via a .. dot dot in the changetheme parameter...

CVE-2007-1128: Undefined Security Weakness

shopkitplus allows remote attackers to obtain sensitive information via a request to 1 events.php with a curmonth=01 query string or 2 enc/stylecss.php with a changetheme= query string, which reveals the path in various error messages...

shopkitplus local file include

lfi: /shopkitplus/enc/stylecss.php?changetheme=../../../../../../../../../../../../etc/passwd full path: /shopkitplus/events.php?curmonth=01 /shopkitplus/enc/stylecss.php?changetheme= regards laurent gaffie...

shopkitplus-lfi.txt

lfi: /shopkitplus/enc/stylecss.php?changetheme=../../../../../../../../../../../../etc/passwd full path: /shopkitplus/events.php?curmonth=01 /shopkitplus/enc/stylecss.php?changetheme= regards laurent gaffié...