Authentication flaw

admin/upload.php in le.cms 1.4 and earlier allows remote attackers to bypass administrative authentication, and upload and execute arbitrary files in images/, via a nonzero value for the submit0 parameter in conjunction with filenames in the filename and upload parameters...

CVE-2008-2832

Unrestricted file upload vulnerability in calendaradmin.asp in Full Revolution aspWebCalendar 2008 allows remote attackers to upload and execute arbitrary code via the FILE1 parameter in an uploadfileprocess action, probably followed by a direct request to the file in calendar/eventimages/...

Unrestricted file upload

Unrestricted file upload vulnerability in calendaradmin.asp in Full Revolution aspWebCalendar 2008 allows remote attackers to upload and execute arbitrary code via the FILE1 parameter in an uploadfileprocess action, probably followed by a direct request to the file in calendar/eventimages/...

LE.CMS 1.4 - Arbitrary File Upload

!/usr/bin/perl use strict; use warnings; use LWP::UserAgent; use HTTP::Request::Common; print ; print "\nEnter Local File Path To Uploadie: C:\file.txt: "; chompmy $file=; my $ext = substr $file, rindex $file, '.'; my $fname = int rand 9999; my $ua = LWP::UserAgent-new agent = 'Mozilla/4.0...

AspWebCalendar 2008 - Arbitrary File Upload

AspWebCalendar 2008 - Arbitrary File Upload Title:AspWebCalendar 2008 Remote File Upload Vulnerability Discovered by : AleminKrali Dork :calendar.asp?eventdetail http://site.com/path/calendaradmin.asp?action=uploadfile == upload your Asp shell http://site.com/path/calendar/eventimages/yourshell.a...

FreeCMS.us 0.2 (fckeditor) Arbitrary File Upload Exploit

Exploit for unknown platform in category web applications ======================================================== FreeCMS.us 0.2 fckeditor Arbitrary File Upload Exploit ======================================================== ?php / --------------------------------------------------------------...

Analysis upload vulnerability-vulnerability warning-the black bar safety net

In a brief introduction through the injection vulnerability check and fill, following the coupling re-introduce a vulnerability--upload vulnerability, which is a ratio to inject more lethal vulnerability. By injecting the resultant is often a database of some sensitive information such as...

CVE-2008-2648

Unrestricted file upload vulnerability in upload/uploader.html in meBiblio 0.4.7 allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the files/ directory...

CVE-2008-2648

Unrestricted file upload vulnerability in upload/uploader.html in meBiblio 0.4.7 allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the files/ directory...

CVE-2008-2574

Unrestricted file upload vulnerability in admin/Editor/imgupload.php in FlashBlog 0.31 beta allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the file in tusimagenes/...

CVE-2008-2216

Unrestricted file upload vulnerability in src/yopyupload.php in Project-Based Calendaring System PBCS 0.7.1 allows remote authenticated users to upload arbitrary files to tmp/uploads...

Internet Photoshow (Special Edition) Insecure Cookie Handling Vuln

Exploit for unknown platform in category web applications ================================================================== Internet Photoshow Special Edition Insecure Cookie Handling Vuln ==================================================================...

CVE-2008-2110

Unrestricted file upload vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request...

CVE-2008-1958

CVE-2008-1958 affects Tr Script News 2.1, where an unrestricted file upload in the ajout_cat mode of admin/main.php allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .php extension. For this entry, the vulnerability description is supported by multiple con...

CVE-2008-1958

Unrestricted file upload vulnerability in the ajoutcat mode in admin/main.php in Tr Script News 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with a .php extension...

VulnCheck KEV: CVE-2008-1840

SQL injection vulnerability in upload.php in Coppermine Photo Gallery CPG 1.4.16 and earlier allows remote authenticated users or user-assisted remote HTTP servers to execute arbitrary SQL commands via the Content-Type HTTP response header provided by the HTTP server that is used for an upload...

CVE-2008-1790

Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbitrary files via a crafted logo file in the "Manage Settings" functionality. NOTE: remote exploitation is facilitated by a separate SQL injection vulnerability...

CVE-2008-1790

This CVE affects iScripts SocialWare . It describes an unrestricted file upload vulnerability where remote authenticated administrators can upload arbitrary files through a crafted logo file in the Manage Settings function. The exploit is noted to be facilitated by a separate SQL injection vulner...

phpTournois G4 - Arbitrary File Upload Code Execution

phpTournois G4 - Arbitrary File Upload Code Execution Date: 04-06-08 - Remote Code Execution - Remote File Upload When testing if we are admin, phpTournois checks if $grade'a'=='a'. But when we are not loggued in, this var is not defined. So, using registerglobals, we can define it and let the CM...

CVE-2008-1495

Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by 1 image/gif and 2 application/pdf...