Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		23.12.2008
Source:
SecurityVulns ID:		9541
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. NetCat CMS: directory traversal, SQL injection.

Affected:		ROUNDCUBE : Roundcube Webmail 0.2
		NAGIOS : Nagios 3.0
		OP5MONITOR : op5 Monitor 4.0
		NETCAT : NetCat 3.12
CVE:		CVE-2008-5619 (html2text.php in RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.)
		CVE-2008-5028 (Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.)
		CVE-2008-5027 (The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.)

Original document		S4aVRd0w, Многочисленные уязвимости в NetCat CMS <= 3.12 (23.12.2008)
		Marc Deslauriers, [USN-698-1] Nagios vulnerability (23.12.2008)
		Jacobo Avariento Gimeno, POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection) (23.12.2008)
		ISecAuditors Security Advisories, [ISecAuditors Security Advisories] Wordpress is vulnerable to an unauthorized upgrade and XSS (23.12.2008)

Files:		Blind SQL Injection exploit for CMS NetCat v3.12
Discuss:		Read or add your comments to this news (0 comments)