CVE-2008-5860

CVE-2008-5860 affects Constructr CMS up to version 3.02.5, where a directory traversal flaw in backend/template.php can be exploited when register_globals is enabled and magic_quotes_gpc is disabled. The vulnerability allows a remote attacker to create or read arbitrary files via directory traver...

CVE-2008-5859

CVE-2008-5859 describes an SQL injection in index.php of Constructr CMS 3.02.5 and earlier. When register_globals is enabled and magic_quotes_gpc is disabled, remote attackers can inject arbitrary SQL via the show_page parameter. The affected component is the CMS’s index.php; root cause is improp...