CVE-2009-3716

CVE-2009-3716 describes an unrestricted file upload vulnerability in MCshoutbox 1.1. The flaw exists in the admin.php upload handling, allowing remote authenticated users to upload a file with an executable extension and then access it via a direct request to the file under the smilies/ directory...

CVE-2009-3714

CVE-2009-3714 affects MCshoutbox 1.1; the XSS flaw is in admin_login.php and is exploitable by providing a crafted loginerror parameter to inject arbitrary scripts/HTML into the victim’s browser. The public documents describe the vulnerability type and affected component but do not specify a patc...

CVE-2009-3715

MCshoutbox 1.1 is affected by multiple SQL injection vulnerabilities in scr_login.php, exploitable when magic_quotes_gpc is disabled. Attacks can remotely inject SQL via the username and password fields, potentially yielding arbitrary SQL execution. OpenVAS also notes related web vulnerabilities ...