CVE-2006-3363

PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the pa parameter...

CVE-2006-3363

The CVE-2006-3363 entry documents a PHP Remote File Inclusion vulnerability in the Glossaire module 1.7 for XOOPS. The flaw enables remote attackers to execute arbitrary PHP code via a URL supplied in the pa parameter, impacting the module’s normal handling of file inclusion. The NVD record lists...

CVE-2006-3363

PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the pa parameter...

CVE-2006-3363: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the pa parameter...

CVE-2006-3341

SQL injection vulnerability in annonces-p-f.php in MyAds module 2.04jp for Xoops allows remote attackers to execute arbitrary SQL commands via the lid parameter...

CVE-2006-3341

CVE-2006-3341: SQL injection in annonces-p-f.php of the MyAds module 2.04jp for XOOPS (file: annonces-p-f.php; parameter: lid) allows remote execution of arbitrary SQL. Affected software is the MyAds 2.04jp XOOPS module; CVSSv2 shows AV:N/AC:L/Au:N/C:P/I:P/A:P with base score 7.5 (HIGH). Connecte...

CVE-2006-3341

SQL injection vulnerability in annonces-p-f.php in MyAds module 2.04jp for Xoops allows remote attackers to execute arbitrary SQL commands via the lid parameter...

CVE-2006-3341: Undefined Security Weakness

SQL injection vulnerability in annonces-p-f.php in MyAds module 2.04jp for Xoops allows remote attackers to execute arbitrary SQL commands via the lid parameter...

XOOPS myAds Module (lid) Remote SQL Injection Vulnerability

No description provided by source. Xoops myAds module SQL-Injection Discovered: KeyCoder Turkish Coder Visit : www.grisapka.org Contact: [email protected] Thanx: SecretlyX-BeLa --------------------------------------- Details : Xoops myAds module SQL-Injection Vulnerability Website :...

XOOPS myAds Module - lid SQL Injection

XOOPS myAds Module - lid SQL Injection Xoops myAds module SQL-Injection Discovered: KeyCoder Visit : www.grisapka.org Contact: [email protected] Thanx: SecretlyX-BeLa --------------------------------------- Details : Xoops myAds module SQL-Injection Vulnerability Website : http://www.xoops.org/...

XOOPS myAds Module (lid) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications =========================================================== XOOPS myAds Module lid Remote SQL Injection Vulnerability =========================================================== Xoops myAds module SQL-Injection Discovered: KeyCoder Visit :...

XOOPS myAds Module - 'lid' SQL Injection

Xoops myAds module SQL-Injection Discovered: KeyCoder Visit : www.grisapka.org Contact: [email protected] Thanx: SecretlyX-BeLa --------------------------------------- Details : Xoops myAds module SQL-Injection Vulnerability Website : http://www.xoops.org/ Vulnerable File : annonces-p-f.php PoC :...

xoops20132.txt

!/usr/bin/php -q -d shortopentag=on ? echo "XOOPS = 2.0.13.2 'xoopsOptionnocommon' exploit\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; / works with: magicquotesgpc = Off registerglobals = On / if $argc4 echo "Usage: php ".$argv0." host path cm...

XOOPS xoopsConfig Parameter Variable Overwrite Local File Inclusion

The version of XOOPS installed on the remote host allows an unauthenticated attacker to skip processing of the application's 'include/common.php' script and thereby to gain control of the variables '$xoopsConfiglanguage' and '$xoopsConfigthemeset', which are used by various scripts to include PHP...

CVE-2006-2516

mainfile.php in XOOPS 2.0.13.2 and earlier, when registerglobals is enabled, allows remote attackers to overwrite variables such as $xoopsOption'nocommon' and conduct directory traversal attacks or include PHP files via 1 xoopsConfiglanguage to misc.php or 2 xoopsConfigthemeset to index.php, as...

Directory traversal

mainfile.php in XOOPS 2.0.13.2 and earlier, when registerglobals is enabled, allows remote attackers to overwrite variables such as $xoopsOption'nocommon' and conduct directory traversal attacks or include PHP files via 1 xoopsConfiglanguage to misc.php or 2 xoopsConfigthemeset to index.php, as...

CVE-2006-2516

This CVE (CVE-2006-2516) affects XOOPS 2.0.13.2 and earlier when PHP register_globals is enabled. An attacker can overwrite variables (e.g., $xoopsOption['nocommon']) and perform directory traversal or include PHP files by injecting PHP sequences via xoopsConfig[language] to misc.php or via xoops...

CVE-2006-2516

mainfile.php in XOOPS 2.0.13.2 and earlier, when registerglobals is enabled, allows remote attackers to overwrite variables such as $xoopsOption'nocommon' and conduct directory traversal attacks or include PHP files via 1 xoopsConfiglanguage to misc.php or 2 xoopsConfigthemeset to index.php, as...

XOOPS < 2.0.9.4 include/common.php nocommon Parameter Local File Inclusion

Binary data 3629.prm...

CVE-2006-2516: Improper Limitation of a Pathname to a Restricted Directory

mainfile.php in XOOPS 2.0.13.2 and earlier, when registerglobals is enabled, allows remote attackers to overwrite variables such as $xoopsOption'nocommon' and conduct directory traversal attacks or include PHP files via 1 xoopsConfiglanguage to misc.php or 2 xoopsConfigthemeset to index.php, as...