XOOPS Uploader上传模块'filename'参数目录遍历漏洞

BUGTRAQ ID: 29600 CNCAN ID:CNCAN-2008061007 XOOPS Uploader是一款基于Xoops的上传组件。 XOOPS Uploader组件不正确处理'filename'参数，远程攻击者可以利用漏洞以WEB进程权限查看系统文件内容。 构建包含"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB进程权限查看系统文件内容。 Xoops Uploader 1.1 目前没有解决方案提供： http://www.xoops.org/modules/repository/singlefile.php?cid=28&lid=1243...

XOOPS Module Uploader 1.1 (filename) File Disclosure Vulnerability

No description provided by source. MMM MMM MMM MMM MMMMMMMMMMMMM MMMMMMMMM MMMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MM MMM MMM MM MMM MMM MMM MMM MMM MMM...

xoopsuploader-lfi.txt

MMM MMM MMM MMM MMMMMMMMMMMMM MMMMMMMMM MMMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MM MMM MMM MM MMM MMM MMM MMM MMM MMM MMM MMM MMM MM MMM MMM MMMMMMM MMMMMMMM MMM MMM MMM MMM MMM MMM MMM MMM MM MMM MMM MMMMMMM MMMMMMMM MMM MMMMM MMMMMMMMMM MMMMMMMMMM MMM MMM MM MMM MMM MM MMM MMM MMMN M...

XOOPS Module Uploader 1.1 - Filename File Disclosure

XOOPS Module Uploader 1.1 - Filename File Disclosure MMM MMM MMM MMM MMMMMMMMMMMMM MMMMMMMMM MMMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MM MMM MMM MM MMM MMM MMM MMM MMM MMM MMM MMM MMM MM MMM MMM MMMMMMM MMMMMMMM MMM MMM MMM MMM MMM MMM MMM MMM MM MMM MMM MMMMMMM MMMMMMMM MMM MMMMM...

XOOPS Module Uploader 1.1 - 'Filename' File Disclosure

MMM MMM MMM MMM MMMMMMMMMMMMM MMMMMMMMM MMMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MM MMM MMM MM MMM MMM MMM MMM MMM MMM MMM MMM MMM MM MMM MMM MMMMMMM MMMMMMMM MMM MMM MMM MMM MMM MMM MMM MMM MM MMM MMM MMMMMMM MMMMMMMM MMM MMMMM MMMMMMMMMM MMMMMMMMMM MMM MMM MM MMM MMM MM MMM MMM MMMN M...

XOOPS Module Uploader 1.1 (filename) File Disclosure Vulnerability

Exploit for unknown platform in category web applications ================================================================== XOOPS Module Uploader 1.1 filename File Disclosure Vulnerability ================================================================== MMM MMM MMM MMM MMMMMMMMMMMMM MMMMMMMMM...

PhotoStockPlus Uploader Tool ActiveX控件栈溢出漏洞

BUGTRAQ ID: 29279 CVECAN ID: CVE-2008-0957 Photostockplus是加拿大一家在线出售各种图库的网站。 PhotoStockPlus所提供的Uploader Tool ActiveX控件（PSPUploader.ocx）在处理某些初始化参数时存在栈溢出漏洞。如果用户受骗访问了恶意站点的话，就可能触发这个溢出，导致执行任意代码。 PhotoStockPlus Uploader Tool ActiveX 临时解决方法： 为以下CLSID设置kill bit： E48BB416-C578-4A62-84C9-5E3389ABE5FC...

Stack overflow

Multiple stack-based buffer overflows in the PhotoStockPlus Uploader Tool ActiveX control PSPUploader.ocx allow remote attackers to execute arbitrary code via unspecified initialization parameters...

CVE-2008-0957

Multiple stack-based buffer overflows in the PhotoStockPlus Uploader Tool ActiveX control PSPUploader.ocx allow remote attackers to execute arbitrary code via unspecified initialization parameters...

PhotoStockPlus Uploader Tool ActiveX stack buffer overflows

Overview The PhotoStockPlus Uploader Tool ActiveX control contains several stack buffer overflows, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description PhotoStockPlus provides an image uploader ActiveX control, which is provided by the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keywords parameter to upload/admin/index.php in a search action, the 2 msgcharset and 3 msgheader9 parameters to admin/inc/header.php, and the 4 keywords...

CVE-2008-2202

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keywords parameter to upload/admin/index.php in a search action, the 2 msgcharset and 3 msgheader9 parameters to admin/inc/header.php, and the 4 keywords...

CVE-2008-2202

Maian Uploader 4.0 is affected by multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote attackers to inject arbitrary web script or HTML via: (1) the keywords parameter to upload/admin/index.php in a search action, (2) the msg_charset parameter to admin/inc/header.php, (3) ...

CVE-2008-2202

Multiple cross-site scripting XSS vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keywords parameter to upload/admin/index.php in a search action, the 2 msgcharset and 3 msgheader9 parameters to admin/inc/header.php, and the 4 keywords...

Maian Uploader v4.0 XSS Vulnerabilities

---------------------------------------------------------------- Script : Maian Uploader v4.0 Type : XSS Vulnerabilities ---------------------------------------------------------------- Discovered by : Khashayar Fereidani Or Dr.Crash Our Team : IRCRASH...

Maian Uploader 4.0 - 'header.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/29051/info Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user...

Maian Uploader 4.0 - header.php Cross-Site Scripting

Maian Uploader 4.0 - header.php Cross-Site Scripting source: https://www.securityfocus.com/bid/29051/info Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitra...

Maian Uploader 4.0 - 'keywords' Cross-Site Scripting

source: https://www.securityfocus.com/bid/29051/info Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user...

Maian Uploader 4.0 - keywords Cross-Site Scripting

Maian Uploader 4.0 - keywords Cross-Site Scripting source: https://www.securityfocus.com/bid/29051/info Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary...

Maian Uploader 4.0 - index.php Cross-Site Scripting

Maian Uploader 4.0 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/29051/info Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrar...