An attacker can exploit this issue to cause the web server to crash, denying service to legitimate users.
The PhpBrowse script is vulnerable to Remote File Inclusion (RFI) attack. An attacker can exploit this vulnerability by including a malicious file using the 'include' function in the 'include_stream.inc.php' file. The attacker can then execute arbitrary code or perform unauthorized actions on the targeted system.
This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set the 'username' attribute before authentication. The second problem is that the settings-new.jsp file will only check the 'username' attribute before authorizing the 'uploadFile' action, which can be exploited and allows the attacker to upload a fake xls host list file to the server, and results in arbitrary code execution under the context of SYSTEM. Depending on the installation, by default the Change Advisor web server is listening on port 48080 for an express install. Otherwise, this service may appear on port 8080. Solarwinds has released a fix for this vulnerability as FSM-v6.6.5-HotFix1.zip. You may download it from the module's References section.
The Sisplet CMS is vulnerable to Remote File Inclusion (RFI) attack in the komentar.php file. An attacker can exploit this vulnerability by injecting a malicious URL in the 'site_path' parameter, leading to the inclusion of arbitrary remote files.
This exploit allows an attacker to perform a remote BLIND SQL injection attack on XOOPS Module Rha7 Downloads 1.0 (visit.php). By injecting malicious SQL code, the attacker can retrieve sensitive information such as usernames and passwords from the XOOPS users database.
This exploit targets a vulnerability in phpBB mutant 0.9.2 where the 'phpbb_root_path' variable is not properly declared before inclusion, allowing remote files to be included. By exploiting this vulnerability, an attacker can execute arbitrary remote code.
This exploit includes multiple vulnerabilities in the u-Auctions system. The first vulnerability is a blind SQL injection in /adsearch.php, where the 'category' input is vulnerable. The second vulnerability is an HTTP parameter pollution in /feedback.php, where the 'id' parameter is affected. These vulnerabilities can be exploited to override parameters, modify application behavior, access uncontrollable variables, and bypass input validation checkpoints and WAF rules.
TrueCrypt 4.3, when installed setuid root, allows local users to cause a denial of service (filesystem unavailability) or gain privileges by mounting a crafted TrueCrypt volume, as demonstrated using (1) /usr/bin or (2) another user's home directory, a different issue than CVE-2007-1589 (CVE-2007-1738).
The XOOPS Module WF-Snippets version 1.02 is vulnerable to Blind SQL Injection. An attacker can exploit this vulnerability to extract sensitive information from the database by injecting malicious SQL queries.
This module exploits a flaw in AOL Sb.SuperBuddy. We stole this code from a pre-existing metasploit module.
Services By CQR