CVE-2007-4014

Cross-site scripting XSS vulnerability in a certain index.php installation script related to the 1 Blix 0.9.1, 2 Blixed 1.0, and 3 BlixKrieg Blix Krieg 2.2 themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to...

wordpresstheme-xss.txt

There is an XSS in the Wordpress default theme. Tested on WordPress version 2.2 Filename functions.php, line 387. Code: " $SERVER'REQUESTURI' is directly echoed to the user. This problem can be exploited if the adminstrator is logged in. Sample exploit URL...

Wordpress default theme XSS (admin) and other problems

There is an XSS in the Wordpress default theme. Tested on WordPress version 2.2 Filename functions.php, line 387. Code: form style="display: inline" method="post" name="hicolor" id="hicolor" action="?php echo $SERVER'REQUESTURI'; ?" $SERVER'REQUESTURI' is directly echoed to the user. This problem...

[Full-disclosure] Wordpress default theme XSS (admin) and other problems

There is an XSS in the Wordpress default theme. Tested on WordPress version 2.2 Filename functions.php, line 387. Code: form style="display: inline" method="post" name="hicolor" id="hicolor" action="?php echo $SERVER'REQUESTURI'; ?" $SERVER'REQUESTURI' is directly echoed to the user. This problem...

Ol' Bookmarks Themes Root远程文件包含漏洞

Ol' Bookmarks是一款基于PHP的WEB应用程序。 Ol' Bookmarks不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是多个脚本对用户提交的'root'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Ol' Bookmarks 0.7.4 目前没有解决方案提供： http://olbookmarks.sourceforge.net/ http://www.example.com/path/themes/blackorange.php?root=shell...

Ol BookMarks Manager 0.7.4 - root Remote File Inclusion

Ol BookMarks Manager 0.7.4 - root Remote File Inclusion Olbookmarks =0.7.4 multiple RFI root Download script : D0rk : allintitle:ol'bookmarks Thanks Str0ke Exploit : http://mesh.dl.sourceforge.net/sourceforge/olbookmarks/olbookmarks-0.7.4.tar.gz...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in GPL PHP Board GPB unstable-2001.11.14-1 allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 db.mysql.inc.php or 2 gpb.inc.php in include/, or the 3 theme parameter to themes/ubb/login.php...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Post Revolution 6.6 and 7.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to 1 common.php or 2 themes/default/previewpostcompleto.php...

postrev-rfi.txt

Post Revolution Remote File Inclusion Affected Software .: Post Revolution 6.6 / 7.0 Release Candidate 2 Download..: http://www.fabio.com.ar/postrev/ Risk ..............: high Date .........: 25/3/2007 Found by ..........: InyeXion Contact ...........: InyeXionatgmail.com Web .............:...

Post Revolution <= 0.7.0 RC 2 (dir) Remote File Inclusion Vulnerability

No description provided by source. Post Revolution Remote File Inclusion Affected Software .: Post Revolution 6.6 / 7.0 Release Candidate 2 Download..: http://www.fabio.com.ar/postrev/ Risk ..............: high Date .........: 25/3/2007 Found by ..........: InyeXion Contact ...........:...

Post REvolution 0.7.0 RC 2 - 'dir' Remote File Inclusion

Post Revolution Remote File Inclusion Affected Software .: Post Revolution 6.6 / 7.0 Release Candidate 2 Download..: http://www.fabio.com.ar/postrev/ Risk ..............: high Date .........: 25/3/2007 Found by ..........: InyeXion Contact ...........: InyeXionatgmail.com Web .............:...

KISGB default_path_for_themes参数文件包含漏洞

KISGB（Keep It Simple Guest Book）是一款高级的PHP留言簿程序。 KISGB在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 KISGB的authenticate.php脚本没有正确地验证defaultpathforthemes参数的输入，允许攻击者通过包含本地或外部资源的任意文件导致执行任意代码。 KISGB KISGB 5.x 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://sourceforge.net/projects/kisgb KISG...

KISGB <= 5.1.1 (authenticate.php) Remote File Include Vulnerability

No description provided by source. KISGB Keep It Simple Guest Book defaultpathforthemes Remote File Include +class : Remote File Include Vulnerability + +download link : http://phpnuke-downloads.com/modules.php?name=Downloads&dop=nsgetit&cid=14&lid=156&type=urlget +Author : mdx +Files :...

Bandwebsite 1.5 - 'LOGIN' Remote Add Admin

Name: Pass: milw0rm.com 2006-12-16...

PwsPHP <= 1.1 (themes/fin.php) Remote File Include Vulnerablity

No description provided by source. ========================================================================================================================== PwsPHP v1.1 theme File inclusion Vulnerablity =============================================== Script:PwsPHP ============= Version:1.1...

PwsPHP <= 1.1 (themes/fin.php) Remote File Include Vulnerablity

Exploit for unknown platform in category web applications =============================================================== PwsPHP = 1.1 themes/fin.php Remote File Include Vulnerablity ===============================================================...

CVE-2006-5498

CVE-2006-5498 concerns a directory traversal in Segue CMS prior to or at version 1.5.8, specifically in themes/program/themesettings.inc.php. The flaw lets remote attackers include and execute arbitrary local files by supplying a .. (dot dot) in the theme parameter. Impact is reflected as Partial...

Segue CMS 1.5.8 - themesdir Remote File Inclusion

Segue CMS 1.5.8 - themesdir Remote File Inclusion +------------------------------------------------------------------------------------------- + Segue CMS +------------------------------------------------------------------------------------------- + Details: + Segue CMS...

Segue CMS <= 1.5.8 (themesdir) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ================================================================ Segue CMS +------------------------------------------------------------------------------------------- + Details: + Segue CMS themes/program/themesettings.inc.php does not...

Coppermine Photo Gallery 1.2.2b (Nuke Addon) - Remote File Inclusion

Coppermine Photo Gallery 1.2.2b Nuke Addon - Remote File Inclusion ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Coppermine Photo Gallery v1.2.2b for...