CVE-2010-1867

CVE-2010-1867 affects Campsite 3.3.5 and earlier. The vulnerable code is ArticleAttachment::GetAttachmentsByArticleNumber in javascript/tinymcs/plugins/campsiteattachment/attachments.php, where the article_id parameter can be manipulated to execute arbitrary SQL commands. This is a remote SQL inj...

CVE-2009-2182

CVE-2009-2182 affects Campsite 3.3.0 RC1, with multiple PHP remote file inclusion vulnerabilities. The issue allows remote attackers to execute arbitrary PHP code by supplying a URL via the GLOBALS[g_campsiteDir] parameter to a set of PHP scripts across admin-files and articles directories, inclu...

CVE-2009-2181

CVE-2009-2181 is a cross-site scripting (XSS) vulnerability in Campsite 3.3.0 RC1. The flaw exists in admin-files/templates/list_dir.php, where the listbasedir parameter is not properly sanitized, allowing remote attackers to inject arbitrary web script or HTML. Public references (NVD, OpenVAS en...

CVE-2009-2183

Campsite 3.3.0 RC1 is affected by a Directory Traversal (CVE-2009-2183) in admin-files/ad.php, due to a crafted value in GLOBALS[g_campsiteDir] that allows remote attackers to read and possibly execute arbitrary local files via a .. sequence. The issue is a Local/Remote File Inclusion vulnerabili...

CVE-2006-5911

CVE-2006-5911 concerns multiple PHP remote file inclusion vulnerabilities in Campware Campsite prior to 2.6.2. The flaw allows an attacker to cause arbitrary PHP code execution by supplying a URL in the g_documentRoot parameter to a large set of Campware PHP scripts (including Alias.php, Article....

CVE-2006-5910

CVE-2006-5910 involves multiple PHP remote file inclusion vulnerabilities in Campware Campsite prior to 20061110. The underlying flaw allows an attacker to cause remote code execution by supplying a URL in the g_documentRoot parameter to (1) bugreporter/thankyou.php and (2) feedback/thankyou.php ...

CVE-2006-5912

Technical details for CVE-2006-5912 are not publicly available in the provided documents; Campware Campsite

CVE-2005-4661

The CVE-2005-4661 entry affects Campsite prior to version 2.3.3. The notifyendsubs cron job sends an e-mail that contains an unencrypted MySQL password, which can be captured by remote attackers and leads to partial confidentiality loss. The public documents do not provide explicit remediation st...