CVE-2009-1659

CVE-2009-1659 describes an unrestricted file upload in eLitius 1.0, via admin/uploadimage.php. Attackers could upload an avatar file (e.g., image/gif), bypass access restrictions, then request the uploaded file under admin/banners/ to execute arbitrary files. The documents do not provide remediat...

CVE-2009-1506

CVE-2009-1506 affects eLitius 1.0, specifically the classes/Xp.php component. The vulnerability is an SQL injection via the id parameter to banner-details.php, allowing remote attackers to execute arbitrary SQL commands. The details explicitly describe the vulnerable file and parameter, the impac...