CVE-2007-4606

CVE-2007-4606 describes a PHP remote file inclusion in the Virtual War (VWar) module of PHPNuke-Clan (PNC) 4.2.0 and earlier. The vulnerability arises in convert/mvcw_conver.php where an attacker can cause arbitrary PHP code execution by supplying a crafted URL in the vwar_root parameter. The iss...

CVE-2007-4605

CVE-2007-4605 is a PHP remote file inclusion in Virtual War (VWar) prior to or including 1.5.0 R15. The vulnerability is triggered in convert/mvcw.php via the vwar_root parameter, allowing arbitrary PHP code execution. Related connected docs corroborate VWar RFI patterns affecting multiple script...

CVE-2007-4606

PHP remote file inclusion vulnerability in convert/mvcwconver.php in the Virtual War VWar module for PHPNuke-Clan PNC 4.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwarroot parameter, a different vector than CVE-2006-1602. NOTE: it is possible that this...

Sql injection

Multiple SQL injection vulnerabilities in the Virtual War VWar 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the n parameter to extra/online.php and other unspecified scripts in extra/. NOTE: this might be same vulnerability as CVE-2006-4142; however,...

CVE-2007-2312

Multiple SQL injection vulnerabilities in the Virtual War VWar 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the n parameter to extra/online.php and other unspecified scripts in extra/. NOTE: this might be same vulnerability as CVE-2006-4142; however,...

CVE-2007-2306

The CVE-2007-2306 entry describes multiple XSS vulnerabilities in the Virtual War (VWar) 1.5.0 R15 and earlier module for PHP-Nuke when register_globals is enabled. The affected components are the extra/login.php (memberlist parameter) and extra/today.php (title parameter). The impact is that rem...

waraxe-2007-SA-048.txt

waraxe-2007-SA048 - Multiple vulnerabilities in Virtual War 1.5 module for PhpNuke Author: Janek Vind "waraxe" Date: 13. April 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-48.html Target software description: VWar module for PhpNuke http://www.vwar.de/ VWar is a webbased...

VWar <= 1.50 R14 (online.php) Remote SQL Injection Vulnerability

No description provided by source. .: insecurity research team :. ....:...:. . .:. | |/ :/ // :/ .:. : | | | \\ /\ / :. . ..: ||| / \ \ .: .:.. .. ./ .:/:. ./. .:/: . ...:. .advisory. .:... :..................: 1o.o8.2oo6 .. Affected Application: VWar = v1.50 R14 . . : contact :...

vwarSQL.txt

Vendor : www.vwar.de Vuln. Ver. : 1.5.0 and lower Dork : "Powered by : Virtual War v1.5.0" intext:"www.vwar.de" ------------------------------------------- Author : MFox Homepage : Www.HackerZ.iR Www.H4ckerZ.Com Iran HackerZ Security Team ------------------------------------------- PoC :...

vwar150multi.txt

Virtual War v1.5.0 SQL injection and XSS http://host/vwar/war.php?s=SQL http://host/vwar/war.php?page=SQLorxss http://host/vwar/war.php?showgame=SQL http://host/vwar/war.php?sortby=sql http://host/vwar/war.php?sortorder=sql http://host/vwar/calendar.php?year=xss vendor: www.vwar.de google:"Powere...

CVE-2006-4224

Cross-site scripting XSS vulnerability in calendar.php in Virtual War VWar 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the year parameter. NOTE: The page parameter vector is covered by CVE-2006-4009...

CVE-2006-4224

CVE-2006-4224 is an XSS vulnerability in Virtual War (VWar) calendar.php affecting VWar 1.5.0 and earlier. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the year parameter. The CVE also notes that the page parameter vector is covered by CVE-2006-4009. No fur...

virualWar.txt

Title : Virtual War v1.5.0 Remote File Include vwarroot Discovered By :::: :::: :::: AG-Spider :::: :::: :::: ----------------------------------------------------------------------------- Class : Remote file include Rish : Danger Application : Virtual War v1.5.0 URL : www.vwar.de...

Virtual War v1.5.0 SQL injection and XSS

Virtual War v1.5.0 SQL injection and XSS http://host/vwar/war.php?s=SQL http://host/vwar/war.php?page=SQLorxss http://host/vwar/war.php?showgame=SQL http://host/vwar/war.php?sortby=sql http://host/vwar/war.php?sortorder=sql http://host/vwar/calendar.php?year=xss vendor: www.vwar.de google:"Powere...

CVE-2006-4141

SQL injection vulnerability in news.php in Virtual War VWar 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 sortby and 2 sortorder parameters...

CVE-2006-4142

SQL injection vulnerability in extra/online.php in Virtual War VWar 1.5.0 R14 and earlier allows remote attackers to execute arbitrary SQL commands via the n parameter...

CVE-2006-4141

SQL injection vulnerability in news.php in Virtual War VWar 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 sortby and 2 sortorder parameters...

CVE-2006-4142

CVE-2006-4142 describes an SQL injection in Virtual War (VWar) 1.5.0 R14 and earlier, occurring in extra/online.php via the n parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands and has an attack surface classified as network with low complexity and no authentic...

Virtual War v1.5.0 <= Sql Injection vuln

Vendor : www.vwar.de Vuln. Ver. : 1.5.0 and lower Dork : "Powered by : Virtual War v1.5.0" intext:"www.vwar.de" ------------------------------------------- Author : MFox Homepage : Www.HackerZ.iR Www.H4ckerZ.Com Iran HackerZ Security Team ------------------------------------------- PoC :...

VWar 1.50 R14 - online.php SQL Injection

VWar 1.50 R14 - online.php SQL Injection .: insecurity research team :. ....:...:. . .:. | |/ :/ // :/ .:. : | | | \\ /\ / :. . ..: ||| / \ \ .: .:.. .. ./ .:/:. ./. .:/: . ...:. .advisory. .:... :..................: 1o.o8.2oo6 .. Affected Application: VWar query" line 64: SELECT memberid,...