 |
|
|
| Affected: |  | MAMBOSERVER : Mambo Server 4.6 | | | | INDEXU : INDEXU 5.0 | | | | BITWEAVER : bitweaver 1.3 | | | | MCGUESTBOOK : mcGuestbook 1.3 | | | | AXENT : aXentForum II | | | | NUCLEUS : nucleus 3.23 | | | | CALENDARIX : Calendarix 0.7 | | | | DOTWIDGETA : dotwidgeta 2 | | | | CMSFAETHON : CMS Faethon 1.3 | | CVE: |  | CVE-2006-7017 (Multiple PHP remote file inclusion vulnerabilities in Indexu 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the admin_template_path parameter to admin/ scripts (1) app_change_email.php, (2) app_change_pwd.php, (3) app_mod_rewrite.php, (4) app_page_caching.php, (5) app_setup.php, (6) cat_add.php, (7) cat_delete.php, (8) cat_edit.php, (9) cat_path_update.php, (10) cat_search.php, (11) cat_struc.php, (12) cat_view.php, (13) cat_view_hidden.php, (14) cat_view_hierarchy.php, (15) cat_view_registered_only.php, (16) checkurl_web.php, (17) db_alter.php, (18) db_alter_change.php, (19) db_backup.php, (20) db_export.php, (21) db_import.php, (22) editor_add.php, (23) editor_delete.php, (24) editor_validate.php, (25) head.php, (26) index.php, (27) inv_config.php, (28) inv_config_payment.php, (29) inv_create.php, (30) inv_delete.php, (31) inv_edit.php, (32) inv_markpaid.php, (33) inv_markunpaid.php, (34) inv_overdue.php, (35) inv_paid.php, (36) inv_send.php, (37) inv_unpaid.php, (38) lang_modify.p) | | | | CVE-2006-7011 (** DISPUTED ** PHP remote file inclusion vulnerability in adminips.php in Develooping Flash Chat allows remote attackers to execute arbitrary PHP code via a URL in the banned_file parameter. NOTE: CVE disputes this vulnerability because banned_file is set to a constant value.) |
| Original document |  | nanoymaster_(at)_gmail.com, XSS in GardenWeb (18.06.2006) |
| | | :) :), Cline Communications Sql injection (18.06.2006) |
| | | eufrato_(at)_gmail.com, [ECHO_ADV_33$2006] CMS Faethon 1.3.2 mainpath Remote File Inclusion (18.06.2006) |
| | | alp_eren_(at)_ayyildiz.org, Simple PHP Poll Authecnication Admin ByPass (17.06.2006) |
| | | SWEET SWEET, file include exploits in dotwidgeta Version 2 (17.06.2006) |
| | | root-hacked_(at)_hotmail.com, PictureDis Products "lang" Parameter File Inclusion Vulnerability (17.06.2006) |
| | | gamr-14_(at)_hotmail.com, file include exploits in mcGuestbook 1.3 (17.06.2006) |
| | | mins_(at)_wins21.com, Zeroboard File Upload & extension bypass Vulnerability (17.06.2006) |
| | | SpC-x, Ji-takz Chat (mycfg) Remote File Inclusion (17.06.2006) |
| | | Federico Fazzi, Calendarix 0.7.20060401, SQL Injection Vulnerabilities (17.06.2006) |
| | | gamr-14_(at)_hotmail.com, Calendarix 0.7.20060401, SQL Injection Vulnerabilities (17.06.2006) |
| | | gamr-14_(at)_hotmail.com, file include exploits in nucleus 3.23 (17.06.2006) |
| | | SnoBMSN_(at)_Hotmail.De, aXentForum II XSS vuLLn (17.06.2006) |
| | | KARKOR23_(at)_hotmail.com, Indexu v 5.0.01 Multiple Remote File Include Vulnerabilities (17.06.2006) |
| | | SpC-x, Develooping Flash Chat (banned_file) Remote File Inclusion (17.06.2006) |
| | | CrAzY.CrAcKeR_(at)_hotmail.com, dvdwolf SQL injection/XSS (17.06.2006) |
| | | :) :), Cline Communications Sql injection (17.06.2006) |
|
|
|
|
|
|
|
|
