Computer Security
[EN] securityvulns.ru no-pyccku


Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:17.01.2007
Source:
SecurityVulns ID:7062
Type:remote
Threat Level:
5/10
Description:PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.
Affected:JTR : Jax Petition Book 1.0
 DTGUESTBOOK : dt_guestbook 1.0
 SMEFILEMAILER : SmE FileMailer 1.21
 NICECODER : INDEXU 5.1
 INSTANTASP : InstantForum.NET 4.1
CVE:CVE-2007-0350 (Multiple SQL injection vulnerabilities in (a) index.php and (b) dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ps, (2) us, (3) f, or (4) code parameter. NOTE: the us vector in index.php is already covered by CVE-2007-0346. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.)
 CVE-2007-0350 (Multiple SQL injection vulnerabilities in (a) index.php and (b) dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ps, (2) us, (3) f, or (4) code parameter. NOTE: the us vector in index.php is already covered by CVE-2007-0346. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.)
 CVE-2007-0349 (Directory traversal vulnerability in upgrade.php in nicecoder.com INDEXU 5.x allows remote attackers to include arbitrary local files via a .. (dot dot) in the gateway parameter.)
 CVE-2007-0346 (SQL injection vulnerability in index.php in SmE FileMailer 1.21 allows remote attackers to execute arbitrary SQL commands via the us parameter.)
 CVE-2007-0339 (SQL injection vulnerability in index.php (aka the login form) in Scriptme SMe FileMailer 1.21 allows remote attackers to execute arbitrary SQL commands via the Password field (ps parameter). NOTE: some of these details are obtained from third party information.)
 CVE-2007-0335 (Multiple directory traversal vulnerabilities in Jax Petition Book 1.0.3.06 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the languagepack parameter to (1) jax_petitionbook.php or (2) smileys.php.)
 CVE-2007-0332 ((1) admin/adminlien.php3 and (2) admin/modif.php3 in liens_dynamiques 2.1 do not require authentication, which allows remote attackers to perform unauthorized administrative actions using a direct request.)
 CVE-2007-0331 (Cross-site scripting (XSS) vulnerability in liens.php3 in liens_dynamiques 2.1 allows remote attackers to inject arbitrary web script or HTML by using the ajouter=1 query string and the add menu.)
 CVE-2007-0312 (wcSimple Poll stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password hashes via a direct request for password.txt.)
 CVE-2007-0305 (SQL injection vulnerability in etkinlikbak.asp in Okul Web Otomasyon Sistemi 4.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.)
 CVE-2007-0302 (Multiple cross-site scripting (XSS) vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to (a) Logon.aspx, and the (2) Username and (3) Update parameters to (b) Members1.aspx.)
 CVE-2006-6487 (Cross-site scripting (XSS) vulnerability in index.php in DT Guestbook (dt_guestbook) 1.0f, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the error[] parameter.)
Original documentdocumentHackers Center Security Group, InstantForum.NET Multiple Cross-Site Scripting Vulnerability (17.01.2007)
 documentilkerKandemir_(at)_mynet.com, wcSimple Poll (password.txt) Remote Password Disclosure Vulnerablity (17.01.2007)
 documentilkerKandemir_(at)_mynet.com, Okul Web Otomasyon Sistemi (etkinlikbak.asp) SQL Injection Vulnerability (17.01.2007)
 documentgamr-14_(at)_hotmail.com, vulnerability script indexu all versions (17.01.2007)
 documentCorryL, [x0n3-h4ck] SmE FileMailer 1.21 Remote Sql Injextion Exploit (17.01.2007)
 documentJesper Jurcenoks, dt_guestbook version 1.0f XSS vulnerability (17.01.2007)
 documentnightmare_(at)_onhackerline.ir, PHPATM Remote Password Disclosure Vulnerablity (17.01.2007)
 documentsn0oPy.team_(at)_gmail.com, liens_dynamiques xss and admin authentification (17.01.2007)
 documentJohn McGuire, Re: Jax Petition Book (languagepack) Remote File Include Vulnerabilities (17.01.2007)
 documentilkerKandemir_(at)_mynet.com, Jax Petition Book (languagepack) Remote File Include Vulnerabilities (17.01.2007)
Files:Exploits PHPATM Remote Password Disclosure Vulnerablity

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod