CVE-2005-4173

CVE-2005-4173 affects eFiction 1.0, 1.1, and 2.0. The vulnerability allows remote attackers to disclose sensitive information by requesting phpinfo.php, which executes PHP's phpinfo function. The documents do not specify exploitation methods beyond the information disclosure, nor do they provide ...

CVE-2005-4168

CVE-2005-4168 affects eFiction versions 1.0, 1.1, and 2.0. The vulnerabilities are SQL injections in two inputs: (1) the let parameter in the titles.php viewlist action, and (2) the username. The issue allows remote attackers to execute arbitrary SQL commands. The available documents do not provi...

CVE-2005-4171

The CVE reports a remote PHP code execution in eFiction 1.1 when image-upload is allowed. An uploaded file named with a .php extension can start as a GIF (passes image validation) but contains PHP code that gets executed by the web server, enabling arbitrary code execution. The vulnerability stem...

CVE-2005-4167

CVE-2005-4167 affects eFiction 1.0 and 1.1, where the let parameter in titles.php’s viewlist action is not sanitized, enabling stored or reflected XSS by remote attackers to inject arbitrary script/HTML. The vulnerability arises from unsanitized user input used to generate dynamic pages, allowing...

CVE-2005-4172

CVE-2005-4172 affects eFiction 1.0, 1.1, and 2.0. The issue allows remote attackers to obtain sensitive information by requesting storyblock.php with no arguments, causing a PHP error message that leaks the full pathname. This is an information-disclosure flaw arising from an error message reveal...

CVE-2005-4169

CVE-2005-4169 affects eFiction 1.0 with multiple SQL injection vulnerabilities. Specifically, remote attackers can inject SQL through the let parameter in authors.php (viewlist action) and the sid parameter in viewstory.php. The issue is documented in NVD/NASL/Nessus entries among related vulnera...

CVE-2005-4170

An SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands through the uid parameter to viewuser.php. This CVE-2005-4170 (NVD entry) has a base score of 7.5 (HIGH) with NETWORK access, LOW complexity, no authentication, and partial impacts on confiden...