CVE-2008-3355

CVE-2008-3355 : SQL injection in sitemap.xml.php of Camera Life 2.6.2 (and related builds) allows remote attackers to execute arbitrary SQL via the id parameter in a photos action. Public references (e.g., Exploit-DB) indicate available exploit information. The affected version is listed as Camer...

CVE-2008-3355: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in sitemap.xml.php in Camera Life 2.6.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a photos action...

Camera Life 'sitemap.xml.php' SQL注入漏洞

BUGTRAQ ID: 30369 CNCAN ID：CNCAN-2008072802 Camera Life是一款基于PHP的WEB应用程序。 Camera Life不正确过滤用户提交的WEB数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息。 问题是'sitemap.xml.php'脚本对用户提交给'id'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或数据库 Camera Life Camera Life 2.6.2 目前没有解决方案提供： http://fdcl.sourceforge.net/...

cameralife-sql.txt

Camera Life 2.6.2id Sql Injection Vulnerability Author: nuclear script: http://downloads.sourceforge.net/fdcl/cameralife-2.6.2aa.zip exploit: sitemap.xml.php?page=photos&id=999999 union select concatusername,0x3a,password,null from users -- greetz cAs, Mi4night, zYzTeM ,THEMAN, DiGitalX, sys32r,...

CVE-2007-6488: Improper Input Validation

Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in 1 the dirclasses parameter to sitemap.xml.php or 2 the error parameter to errors.php...

CVE-2006-3749: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in sitemap.xml.php in Sitemap component comsitemap 2.0.0 for Mambo 4.5.1 CMS, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...