Vice Stats 0.5b SQL injection

=================================== DISCOVERED BY: CrAzY CrAcKeR Site:www.alshmokh.com I want to thank my friend:- nono225-mHOn-rageh-LoverHacker-Breeeeh BoNym-Rootshill-LiNuXrOOt-SauDiVirUs =================================== Example:- /vsresource.php?ID=SQL ===================================...

CVE-2006-2844: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REXINCLUDEPATH parameter to 1 simpleuser/pages/index.inc.php and 2 stats/pages/index.inc.php...

Redaxo CMS <= 3.2 (INCLUDE_PATH) Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ==================================================================== Redaxo CMS = 3.2 INCLUDEPATH Remote File Include Vulnerabilities ==================================================================== Script: Redaxo CMS Redaxo 3.2 - 3.1 ...

Linpha 1.1.0 - XSS Vulnerabilities

Linpha 1.1.0 - XSS Vulnerabilities -------------------------------------------------------- Software: Linpha Version: 1.1.0 Type: Cross Site Scripting Vulnerability Date: Mon Apr 17 22:59:39 CEST 2006 Vendor: The LinPHA developers Page: http://linpha.sourceforge.net/ Risc: Low credits:...

Sql injection

Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the optionprefix parameter in admin.php and other unspecified PHP scripts, and 2 the PCREMOTEADDR HTTP header to click.php...

Authentication flaw

admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the optionadminpass parameter and setting the passcookie to the MD5 hash of the specified password...

CVE-2006-1087

Direct static code injection vulnerability in the modifyconfig action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the optionnewcompatibilitymode parameter, which is not filtered before being stored in config.php. NOTE...

CVE-2006-1083

Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. dot dot in the 1 optionlanguage and 2 optiontemplate parameters, and 3 possibly other parameters, to a admin.php and b other unspecified...

CVE-2006-1084

Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the optionprefix parameter in admin.php and other unspecified PHP scripts, and 2 the PCREMOTEADDR HTTP header to click.php...

Directory traversal

Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. dot dot in the 1 optionlanguage and 2 optiontemplate parameters, and 3 possibly other parameters, to a admin.php and b other unspecified...

Code injection

Direct static code injection vulnerability in the modifyconfig action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the optionnewcompatibilitymode parameter, which is not filtered before being stored in config.php. NOTE...

Information disclosure

PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database tableprefix...

CVE-2006-1085

admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the optionadminpass parameter and setting the passcookie to the MD5 hash of the specified password...

CVE-2006-1088

PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database tableprefix...

CVE-2006-1085: Undefined Security Weakness

admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the optionadminpass parameter and setting the passcookie to the MD5 hash of the specified password...

CVE-2006-1087

Direct static code injection vulnerability in the modifyconfig action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the optionnewcompatibilitymode parameter, which is not filtered before being stored in config.php. NOTE...

CVE-2006-1085

PHP-Stats 0.1.9.1 and earlier is affected by CVE-2006-1085. An authentication bypass allows remote attackers to gain administrator privileges and execute arbitrary PHP code by altering option[admin_pass] and setting pass_cookie to the MD5 hash of the target password. This vector can be used in co...

CVE-2006-1083

CVE-2006-1083 describes multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier. The flaws allow remote attackers to read (and possibly execute) arbitrary files by supplying a .. (dot dot) in parameters such as option[language] and option[template], targeting admin.php and o...

CVE-2006-1084

CVE-2006-1084 affects PHP-Stats versions 0.1.9.1 and earlier. The vulnerability stems from multiple SQL injection flaws in the application, notably via the parameter option[prefix] in admin.php and the PC_REMOTE_ADDR HTTP header to click.php. Successful exploitation could allow remote attackers t...

CVE-2006-1088

PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database tableprefix...