|
Search |
Research |
Contact Us
|
Tuesday February 20, 2022
|
|
 |
You can use the form below to search our site. Just enter the
keywords to search.
|
|
|
| Title |
Mambo Authentication Bypass
|
| Info |
Mambo is a popular Open Source Content Management System released under the GNU General Public license (GNU GPL). There
are unfortunately some serious flaws in Mambo's login feature that allow for authentication bypass. This can be used to
access arbitrary accounts, but even worse can be used to eventually install harmful modules and execute arbitrary php code
on the server running Mambo. The Mambo team have committed fixes for these issues to SVN, and patches are available from the
official Mambo website. Users are encouraged to patch the vulnerable functionality or update their Mambo installation as soon
as possible. |
| Date |
October 4, 2021 |
| BID |
Not Available
|
| Credit |
James Bercegay |
| Title |
HAMweather Remote Code Execution
|
| Info |
HAMWeather is a popular weather forecasting software that allows webmasters to display detailed
weather forecasts and statistics on their websites. Unfortunately some of the features within
HAMweather allow for an attacker to inject arbitrary php into the application and successfully
execute arbitrary code. Also, because magic_quotes_gpc and register_globals settings are irrelevant
when exploiting this issue it makes it that much easier for an attacker to get a remote shell on the
host and possibly mount further attacks on the underlying server. An updated version of HAMweather
has been released and all users are encouraged to upgrade as soon as possible. |
| Date |
September 30, 2021 |
| BID |
Not Available
|
| Credit |
James Bercegay |
| Title |
CakePHP Framework Arbitrary File Access
|
| Info |
CakePHP is a RAD (Rapid Application Framework) framework for PHP which uses commonly
known design patterns like ActiveRecord, Association Data Mapping, Front Controller
and MVC. Unfortunately CakePHP is vulnerable to an arbitrary file access vulnerability
due to unsafe use of the readfile function that allows for an attacker to read any file
on the system that the webserver has read access to. This could be used to read password
files or sensitive configuration data etc. An updated version of CakePHP has been released
and users encouraged to upgrade their CakePHP installations as soon as possible. |
| Date |
September 21, 2021 |
| BID |
Not Available
|
| Credit |
James Bercegay |
| Title |
X-Cart Arbitrary Code Execution
|
| Info |
X-Cart is a commercial web based eCommerce solution written in PHP and MySQL that allows for
webmasters to host an online marketplace. Unfortunately an attacker may be able to execute
arbitrary php code on an X-Cart installation by overwriting key configuration variables.
However, because the vulnerability allows for any variables to be overwritten other attacks
such as SQL Injection are probably possible as well. Qualiteam have released an updated
version of their X-Cart software, and users are strongly encouraged to upgrade as soon as
possible or delete the cmpi.php script that resides within the payments directory. |
| Date |
September 18, 2021 |
| BID |
Not Available
|
| Credit |
James Bercegay |
| Title |
Claroline Arbitrary File Inclusion
|
| Info |
Claroline is a popular online Open Source e-Learning application used to allow
teachers or education organizations to create and administrate courses through
the web. Claroline is also used as the framework for other e-Learning applications
such as Dokeos. Unfortunately Claroline is vulnerable to a file inclusion issue
when register globals is on which may allow for an attacker to read or execute
arbitrary files. Some frameworks that use Claroline (such as Dokeos) are also
vulnerable to the issues mentioned here. An updated version of Claroline has been
released and users should upgrade immediately and disable register_globals if possible. |
| Date |
September 14, 2021 |
| BID |
Not Available
|
| Credit |
James Bercegay |
| Title |
CubeCart Multiple Vulnerabilities
|
| Info |
CubeCart is a very popular web application written in php that
allows for an individual to open up a fully functioning online
ecommerce service. Unfortunately CubeCart is vulnerable to Cross
Site Scripting attacks, SQL Injection attacks, and possible remote
code execution due to an attacker being able to include arbitrary
php code. An updated version of CubeCart has been released and all
users are encouraged to upgrade as soon as possible. |
| Date |
August 28, 2021 |
| BID |
Not Available
|
| Credit |
James Bercegay |
| Title |
osCommerce Multiple Vulnerabilities
|
| Info |
osCommerce is one of the most popular open source ecommerce web applications
ever written. osCommerce allows webmasters to open a fully functioning online
marketplace with little effort. Unfortunately there have been several new
vulnerabilities discovered in the latest versions of osCommerce. These issues
may allow for an attacker to gather arbitrary information from the database
such as credit card information, user login information, or personal information.
There are also issues with some of osCommerce's file handling functionality
that may allow an attacker to gain access to sensitive data. The osCommerce
team have released updates to address these vulnerabilities and all users are
encouraged to upgrade their osCommerce installations as soon as possible. |
| Date |
August 17, 2021 |
| BID |
Not Available
|
| Credit |
James Bercegay |
| Title |
Zen Cart Multiple Vulnerabilities
|
| Info |
Zen Cart is a descendant of the popular osCommerce project, and like
osCommerce Zen Cart is one of the most popular open source ecommerce
systems in the world. Unfortunately Zen Cart is vulnerable to quite
a number of different attacks, and in some circumstances may allow an
attacker to execute arbitrary code on the underlying web server with
the rights of the httpd process. In addition to remote code execution
several different SQL Injection attacks may be possible. The Zen Cart
developers have commited fixes for these issues to CVS and an updated
version of Zen Cart will be released soon to address the issues. All
users should upgrade their Zen Cart installation as soon as possible. |
| Date |
August 15, 2021 |
| BID |
Not Available
|
| Credit |
James Bercegay |
| Title |
SquirrelMail Arbitrary Variable Overwriting
|
| Info |
SquirrelMail is a standards-based webmail package written in php. It includes built-in pure PHP support for the IMAP and SMTP protocols. Unfortunately there is a fairly serious variable handling issue in one of the core SquirrelMail scripts that can allow an attacker to take control of variables used within the script, and influence functions and actions within the script. This is due to the unsafe handling of "expired sessions" when composing a message. An updated version of SquirrelMail can be downloaded from their official website. Users are advised to update their SquirrelMail installations as soon as possible.
|
| Date |
August 11, 2021 |
| BID |
Not Available
|
| Credit |
James Bercegay |
| Title |
PHPLib Remote Code Execution
|
| Info |
The PHP Base Library aka PHPLib is a toolkit for PHP developers supporting
them in the development of Web applications. The phpLib codebase can be
found in a number of applications available today. Unfortunately some of
the session emulation code is vulnerable to SQL Injection issues that in
a worst case scenario can lead to remote code execution by using UNION and
selecting arbitrary php code into an eval call. A new version og PHPLib has
been released and users should upgrade their PHPLib libraries as soon as
possible.
|
| Date |
March 5, 2022 |
| BID |
16801
|
| Credit |
James Bercegay |
|
|
|
|
|
