CVE-2009-2330

CVE-2009-2330 describes a cross-site scripting (XSS) vulnerability in the CMS Chainuk 1.2 and earlier. The flaw exists in admin/admin_menu.php and is exploitable via the menu parameter, allowing remote attackers to inject arbitrary web script or HTML. Documents consistently identify the affected ...

CVE-2009-2331

CVE-2009-2331 affects CMS Chainuk 1.2 and earlier. Two static code injection flaws permit remote PHP code execution: (1) settings.php via the menu parameter to admin_settings.php, and (2) a content/=NUMBER.php file via the title parameter to admin_new.php. Root cause: insecure handling of paramet...

CVE-2009-2333

CVE-2009-2333 affects CMS Chainuk 1.2 and earlier. Multiple directory traversal flaws allow remote attackers to include and execute arbitrary local files via .. in (1) menu parameter to admin/admin_menu.php, and (2) id parameter to index.php, and (3) id parameter to admin/admin_edit.php; and (4) ...

CVE-2009-2332

CMS Chainuk 1.2 and earlier is affected by a remote information-disclosure vulnerability. An attacker can cause the system to reveal the installation path in an error message by supplying (1) a crafted id parameter to index.php or (2) a nonexistent folder name in the id parameter to admin/admin_d...