awstats configdir remote command execution

AWSTATS CONFIGDIR REMOTE COMMAND EXECUTION CODE
AWSTATS CONFIGDIR REMOTE COMMAND EXECUTION DOWNLOAD

RedTeam has identified two security flaws in PAJAX versions 0.5.1 and below. The third vulnerability occurs within the blog comment functionality, allowing arbitrary files to be deleted. The second vulnerability lies within the image upload system provided to logged-in users there is no image validation function in the blogger to prevent an authenticated user from uploading any file type. The first vulnerability exposes the hash file (password.txt) to unauthenticated users. This Metasploit module combines three separate issues within The Simple PHP Blog (versions 0.4.0 and below) application to upload arbitrary data and thus execute a shell.

AWSTATS CONFIGDIR REMOTE COMMAND EXECUTION DOWNLOAD

tags | exploit, remote, arbitrary, php advisories | CVE-2007-5423 SHA-256 | 2c4a8a6e81f67352e72024e2f545f7d1ae145048bf376afb7ae97d09bf473fe9 Download | Favorite | View Simple PHP Blog 0.4.0 Command Execution Posted Authored by Matteo Cantoni The issue is due to 'tiki-graph_formula.php' script not properly sanitizing user input supplied to the f variable, which may allow a remote attacker to execute arbitrary PHP commands resulting in a loss of integrity. TikiWiki versions 1.9.8 and below contain a flaw that may allow a remote attacker to execute arbitrary commands.

AWSTATS CONFIGDIR REMOTE COMMAND EXECUTION CODE

tags | exploit, arbitrary, php, code execution advisories | CVE-2006-4602 SHA-256 | f7850ab13f084ee0399ccaa4266f25beedbf677492fc535ebf17997b1756a1ce Download | Favorite | View TikiWiki tiki-graph_formula Remote Command Execution Posted Authored by Matteo Cantoni The vulnerability has been reported in Tikiwiki version 1.9.4. It is possible that the flaw may allow arbitrary PHP code execution by uploading a malicious PHP script resulting in a loss of integrity.

The issue is triggered due to the jhot.php script not correctly verifying uploaded files.

TikiWiki contains a flaw that may allow a malicious user to execute arbitrary PHP code. tags | exploit, remote, arbitrary, php advisories | CVE-2016-5734 SHA-256 | 46f778fd23af1e4e604d32a71ab007e759502445aee2fac99855d70658df179c Download | Favorite | View TikiWiki jhot Remote Command Execution Posted Authored by Matteo Cantoni PhpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation. PhpMyAdmin 4.x Remote Code Execution Posted Authored by Matteo Cantoni, Cure53, Michal AihaA | Site

Awstats configdir remote command execution