SiteBuilder Elite 'CarpPath'远程文件包含漏洞

SiteBuilder Elite是一款基于PHP的WEB应用程序。 SiteBuilder Elite不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于脚本对用户提交的'CarpPath'参数处理缺少充分过滤，提交远程服务器的任意文件作为包含对象，可导致以WEB权限执行任意PHP代码。 NovaSoft SiteBuilder Elite 1.2 厂商解决方案 目前没有详细解决方案提供： http://sitebuilderelite.com/...

CVE-2008-1123

Multiple PHP remote file inclusion vulnerabilities in SiteBuilder Elite 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the CarpPath parameter to 1 files/carprss.php and 2 files/amazon-bestsellers.php...

CVE-2008-1123

Multiple PHP remote file inclusion vulnerabilities in SiteBuilder Elite 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the CarpPath parameter to 1 files/carprss.php and 2 files/amazon-bestsellers.php...

CVE-2008-1123

CVE-2008-1123 affects SiteBuilder Elite 1.2. The vulnerability is a PHP remote file inclusion (RFI) in the CarpPath parameter, exploitable via two URLs (files/carprss.php and files/amazon-bestsellers.php). The underlying issue allows remote attackers to execute arbitrary PHP code on affected inst...

CVE-2006-3395

PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter...

CVE-2006-3395

PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter...

CVE-2006-3395

The CVE-2006-3395 item affects SiteBuilder-FX 3.5. The vulnerability is a remote file inclusion in the admin/top.php script, where the admindir parameter is unsafely used to include PHP code. This allows an attacker to execute arbitrary PHP code on the server, enabling potential compromise of the...

PT-2006-4287 · Sitebuilder Fx · Sitebuilder-Fx

Name of the Vulnerable Software and Affected Versions: SiteBuilder-FX version 3.5 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter. This can be achieved by manipulating the URL to include malicious PHP code, which can then be execute...

SiteBuilder-FX top.php admindir Parameter Remote File Inclusion

The remote host is running SiteBuilder-FX, a web-based design system written in PHP. The version of SiteBuilder-FX installed on the remote host fails to sanitize input to the 'admindir' parameter of the 'admin/top.php' script before using it to include PHP code. Regardless of the setting of PHP's...

SiteBuilder-FX - top.php Remote File Inclusion

SiteBuilder-FX - top.php Remote File Inclusion source: https://www.securityfocus.com/bid/18756/info SiteBuilder-FX is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to...

SiteBuilder-FX - 'top.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/18756/info SiteBuilder-FX is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing...

CVE-2003-0756

Directory traversal vulnerability in sitebuilder.cgi in SiteBuilder 1.4 allows remote attackers to read arbitrary files via .. dot dot sequences in the selectedpage parameter...

CVE-2003-0756

Directory traversal vulnerability in sitebuilder.cgi in SiteBuilder 1.4 allows remote attackers to read arbitrary files via .. dot dot sequences in the selectedpage parameter...

CVE-2003-0756

SiteBuilder 1.4 contains a directory traversal flaw in sitebuilder.cgi, exploitable via .. sequences in the selectedpage parameter that allows reading arbitrary files. Evidence from CVE-2003-0756 across NVD/Red Hat records confirms the same vector; no exploit status or active exploitation is prov...

Directory Traversal in SITEBUILDER - v1.4

Directory Traversal in SITEBUILDER - v1.4 With this Code you can view the /etc/passwd You need a Account. htmlbodypcenter bMein 31337 Exploit :-P/bbr form action="http://targethost.com/cgi-bin/sbcgi/sitebuilder.cgi" method=POST input type="hidden" name="username" value="targetuser" input...

Sitebuilder 1.4 - sitebuilder.cgi Directory Traversal

Sitebuilder 1.4 - sitebuilder.cgi Directory Traversal source: https://www.securityfocus.com/bid/8521/info Sitebuilder is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of system files. The problem occurs due to the application failing ...

Sitebuilder 1.4 - 'sitebuilder.cgi' Directory Traversal

source: https://www.securityfocus.com/bid/8521/info Sitebuilder is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of system files. The problem occurs due to the application failing to parse user-supplied input for directory traversal...