PHP-Stats 0.1.9.2 - Multiple Vulnerabilities

32 break; 100. 103. $title='?'; 104. if$option'pagetitle' && isset$GET't' 105. 106. $tmpTitle=htmlspecialcharsaddslashesurldecode$GET't'; 107. if$tmpTitle!='\\\" t \\\"' $title=$tmpTitle; 108. 109. 174. if $loaded=='?' && $title!='?' 175. $result=sqlquery"SELECT lastpage FROM...

Php-Stats 0.1.9.2 Multiple Vulnerabilities Exploit

Exploit for unknown platform in category web applications ================================================== Php-Stats 0.1.9.2 Multiple Vulnerabilities Exploit ================================================== 32 break; 100. 103. $title='?'; 104. if$option'pagetitle' && isset$GET't' 105. 106...

PHP-Stats 0.1.9.2 - Multiple Vulnerabilities

PHP-Stats 0.1.9.2 - Multiple Vulnerabilities 32 break; 100. 103. $title='?'; 104. if$option'pagetitle' && isset$GET't' 105. 106. $tmpTitle=htmlspecialcharsaddslashesurldecode$GET't'; 107. if$tmpTitle!='\\\" t \\\"' $title=$tmpTitle; 108. 109. 174. if $loaded=='?' && $title!='?' 175...

Remote file inclusion

PHP remote file inclusion vulnerability in init.php in Jens Tkotz myIpacNG-stats MINGS 0.05 allows remote attackers to execute arbitrary PHP code via a URL in the MINGSBASE parameter. NOTE: this issue is disputed by CVE because MINGSBASE is defined before use...

CVE-2007-5165

PHP remote file inclusion vulnerability in init.php in Jens Tkotz myIpacNG-stats MINGS 0.05 allows remote attackers to execute arbitrary PHP code via a URL in the MINGSBASE parameter. NOTE: this issue is disputed by CVE because MINGSBASE is defined before use...

CVE-2007-5165

The CVE-2007-5165 issue affects myIpacNG-stats (MINGS) v0.05, where init.php accepts a URL in the MINGS_BASE parameter, enabling potential remote PHP code execution via a remote file inclusion vulnerability. The description notes that this claim is disputed by CVE because MINGS_BASE is defined be...

CVE-2007-5165: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in init.php in Jens Tkotz myIpacNG-stats MINGS 0.05 allows remote attackers to execute arbitrary PHP code via a URL in the MINGSBASE parameter. NOTE: this issue is disputed by CVE because MINGSBASE is defined before use...

PT-2007-6258 · Unknown · Myipacng-Stats

Name of the Vulnerable Software and Affected Versions: myIpacNG-stats MINGS version 0.05 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the MINGS BASE parameter. This is a remote file inclusion vulnerability in the init.php file. Note that this issue is...

Sql injection

Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the pseudo parameter to login.php, 2 the id parameter to index.php in a carnet editer action in the MemberSpace espacemembre module, or 3 the typenav parameter to index.php in a...

CVE-2007-4956

Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the pseudo parameter to login.php, 2 the id parameter to index.php in a carnet editer action in the MemberSpace espacemembre module, or 3 the typenav parameter to index.php in a...

kwsstats-sql.txt

Script..........................: KwsPHP ver 1.0 stats Module Script Site..................: http://kws.koogar.org/ Vulnerability...............: Remote SQL injection Exploit Access.........................: Remote level.............................: Dangerous Author..........................: S4...

phpstats0192-xss.txt

I found a new xss in php-stats 0.1.9.2 http://phpstats.net/ http://www.example.com/php-stats-path/tracking.php?what=online&ip=XSS Stats must have public access for this difference from whois.php XSS...

Cross site scripting

Cross-site scripting XSS vulnerability in tracking.php in PHP-Stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the ip parameter in an online action, a different vector than CVE-2007-4334...

CVE-2007-4917

CVE-2007-4917 is an XSS vulnerability in tracking.php of PHP-Stats 0.1.9.2. The issue allows remote attackers to inject arbitrary web script or HTML via the ip parameter in an online action, a vector distinct from CVE-2007-4334. The connected records corroborate the vulnerability’s existence in P...

CVE-2007-4917

Cross-site scripting XSS vulnerability in tracking.php in PHP-Stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the ip parameter in an online action, a different vector than CVE-2007-4334...

new XSS vulnerability in php-stats -tracking.php

I found a new xss in php-stats 0.1.9.2 http://phpstats.net/ http://www.example.com/php-stats-path/tracking.php?what=online&ip=XSS Stats must have public access for this difference from whois.php XSS...

KwsPHP 1.0 stats Module Remote SQL Injection Exploit

No description provided by source. Script..........................: KwsPHP ver 1.0 stats Module Script Site..................: http://kws.koogar.org/ Vulnerability...............: Remote SQL injection Exploit Access.........................: Remote level.............................: Dangerous...

CVE-2007-4917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in tracking.php in PHP-Stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the ip parameter in an online action, a different vector than CVE-2007-4334...

KwsPHP 1.0 stats Module - SQL Injection

KwsPHP 1.0 stats Module - SQL Injection Script..........................: KwsPHP ver 1.0 stats Module Script Site..................: http://kws.koogar.org/ Vulnerability...............: Remote SQL injection Exploit Access.........................: Remote level.............................:...

PHP-Stats 0.1.9.2 - 'Tracking.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/25674/info Php-Stats is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in th...