CVE-2006-2981

Arantius Vice Stats is affected by SQL injection in multiple PHP files. CVE-2006-2981 affects vs_search.php (Vice Stats before 1.0.1), enabling remote SQL commands via unknown vectors; CVE-2006-2972 affects vs_resource.php (versions 0.5b and 1.0) via the ID parameter. Root cause in the PHP code a...

CVE-2006-2981

SQL injection vulnerability in vssearch.php in Arantius Vice Stats before 1.0.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors, a different issue than CVE-2006-2972...

Sql injection

SQL injection vulnerability in vsresource.php in Arantius Vice Stats 0.5b and 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter...

CVE-2006-2972

SQL injection vulnerability in vsresource.php in Arantius Vice Stats 0.5b and 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter...

CVE-2006-2972

CVE-2006-2972 concerns Arantius Vice Stats (versions 0.5b and 1.0). The vulnerability is a SQL injection in vs_resource.php that lets remote attackers execute arbitrary SQL commands via the ID parameter. This is a persistent risk to data integrity and confidentiality for affected installations, a...

CVE-2006-2972

SQL injection vulnerability in vsresource.php in Arantius Vice Stats 0.5b and 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter...

Vice Stats 0.5b SQL injection

=================================== DISCOVERED BY: CrAzY CrAcKeR Site:www.alshmokh.com I want to thank my friend:- nono225-mHOn-rageh-LoverHacker-Breeeeh BoNym-Rootshill-LiNuXrOOt-SauDiVirUs =================================== Example:- /vsresource.php?ID=SQL ===================================...

Redaxo CMS <= 3.2 (INCLUDE_PATH) Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ==================================================================== Redaxo CMS = 3.2 INCLUDEPATH Remote File Include Vulnerabilities ==================================================================== Script: Redaxo CMS Redaxo 3.2 - 3.1 ...

Linpha 1.1.0 - XSS Vulnerabilities

Linpha 1.1.0 - XSS Vulnerabilities -------------------------------------------------------- Software: Linpha Version: 1.1.0 Type: Cross Site Scripting Vulnerability Date: Mon Apr 17 22:59:39 CEST 2006 Vendor: The LinPHA developers Page: http://linpha.sourceforge.net/ Risc: Low credits:...

Sql injection

Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the optionprefix parameter in admin.php and other unspecified PHP scripts, and 2 the PCREMOTEADDR HTTP header to click.php...

Authentication flaw

admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the optionadminpass parameter and setting the passcookie to the MD5 hash of the specified password...

CVE-2006-1084

Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the optionprefix parameter in admin.php and other unspecified PHP scripts, and 2 the PCREMOTEADDR HTTP header to click.php...

CVE-2006-1083

Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. dot dot in the 1 optionlanguage and 2 optiontemplate parameters, and 3 possibly other parameters, to a admin.php and b other unspecified...

CVE-2006-1087

Direct static code injection vulnerability in the modifyconfig action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the optionnewcompatibilitymode parameter, which is not filtered before being stored in config.php. NOTE...

Code injection

Direct static code injection vulnerability in the modifyconfig action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the optionnewcompatibilitymode parameter, which is not filtered before being stored in config.php. NOTE...

Information disclosure

PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database tableprefix...

Directory traversal

Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. dot dot in the 1 optionlanguage and 2 optiontemplate parameters, and 3 possibly other parameters, to a admin.php and b other unspecified...

CVE-2006-1085

admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the optionadminpass parameter and setting the passcookie to the MD5 hash of the specified password...

CVE-2006-1088

PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database tableprefix...

CVE-2006-1087

Direct static code injection vulnerability in the modifyconfig action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the optionnewcompatibilitymode parameter, which is not filtered before being stored in config.php. NOTE...