Upload Service 1.0 - 'top.php?maindir' Remote File Inclusion

------------------------------------------------------------------------------------ ECHOADV62$2007 Upload Service 1.0 remote file inclusion ------------------------------------------------------------------------------------ Author : Ahmad Muammar W.K a.k.a y3dips Date Found : January, 21st 2007...

X-Scripts X-Poll Top.PHP SQL注入漏洞

X-Poll是一款基于PHP的投票程序。 X-Poll不正确处理用户提交的WEB数据，远程攻击者可以利用漏洞进行SQL注入获得敏感信息。 问题存在于'Top.PHP'脚本中，由于对用户提交的'poll'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 X-Scripts X-Poll 1.10 http://members.lycos.co.uk/xscripts03/ http://www.example.com/poll/top.php?poll=' AND 0 UNION SELECT 0,...

CVE-2006-3960

The CVE-2006-3960 entry concerns a SQL injection in the X-Scripts X-Poll component, specifically in top.php (likely version 2.30). The vulnerability can be triggered via the poll parameter, enabling remote attackers to execute arbitrary SQL commands. Impact is listed as partial confidentiality/in...

CVE-2006-3960: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in top.php in X-Scripts X-Poll, probably 2.30, allows remote attackers to execute arbitrary SQL commands via the poll parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-3519: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in The Banner Engine tbe 4.0 allow remote attackers to execute arbitrary web script or HTML via the 1 text parameter in a search action to a top.php, and the 2 adminpass or 3 adminlogin parameter to b signup.php...

CVE-2006-3395: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter...

TBE 4.0 XSS

The Banner Engine - tbe4.0 Native Solutions -------------------------- Cross Site Scripting XSS -------------------------- http://target.xx/top.php?action=search&catid=catid&text=3Cscript3Ealert22Ellipsis+Security+Test223C/script3E...

SiteBuilder-FX top.php admindir Parameter Remote File Inclusion

The remote host is running SiteBuilder-FX, a web-based design system written in PHP. The version of SiteBuilder-FX installed on the remote host fails to sanitize input to the 'admindir' parameter of the 'admin/top.php' script before using it to include PHP code. Regardless of the setting of PHP's...

Sql injection

Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sessionid parameter in 1 top.php and 2 member.php. NOTE: this issue has also been reported to affect 1.7.2...

CVE-2006-2214

Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sessionid parameter in 1 top.php and 2 member.php. NOTE: this issue has also been reported to affect 1.7.2...

CVE-2006-2214: Undefined Security Weakness

Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sessionid parameter in 1 top.php and 2 member.php. NOTE: this issue has also been reported to affect 1.7.2...

CVE-2005-2900: Undefined Security Weakness

Cross-site scripting XSS vulnerability in top.php in CjLinkOut 1.0 allows remote attackers to inject arbitrary web script or HTML via the 123 parameter...