Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		07.05.2007
Source:
SecurityVulns ID:		7672
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Affected:		NUKEDKLAN : Nuked-Klan 1.7
		SMF : Simple Machines Forum 1.1
		CUBECART : CubeCart 3.0
		NPDS : NPDS 5.10
		RUNCMS : RunCms 1.5
		ACP3 : ACP3 4.0
		MINIWEBSHOP : Mini Web Shop 2
		SUNSHOP : SunShop Shopping Cart 4
		DRAKECMS : Drake CMS 0.4
		KAYAKO : Kayako eSupport 3.00

Original document		e1c4_(at)_hotmail.com, Kayako eSupport v3.00.90 Cross Site Scripting (XSS) (07.05.2007)
		john_(at)_martinelli.com, Drake CMS (v0.4.0) - CRLF Injection Vulnerability (07.05.2007)
		john_(at)_martinelli.com, UPDATED: CubeCart (v3.0.15) - CRLF Injection Vulnerability (07.05.2007)
		CorryL, [Full-disclosure] Mini Web Shop v.2 vulnerable to XSS (07.05.2007)
		aeroxteam_(at)_gmail.com, NPDS <= 5.10 - Multiple SQL injections (07.05.2007)
		RaeD Hasadya, Remote File Include In Script impex (07.05.2007)
		Aesthetico, [MajorSecurity Advisory #47]Simple Machines Forum (SMF) - Session fixation Issue (07.05.2007)

Files:		Nuked-klaN 1.7.6 Remote Code Execution Exploit
		NPDS <= 5.10 Remote Code Execution exploit
		PHPSecurityAdmin <= Remote File Include Exploit
		Podium CMS - Cookie Manipulation Exploit
		Exploits SunShop (v4) Multiple Vulnerabilities
		RunCms <= 1.5.2 /class/debug/debug_show.php sql injection / credentials disclosure exploit
		Exploits ACP3 (v4.0b3) - Multiple Vulnerabilities
Discuss:		Read or add your comments to this news (0 comments)