diff options
| author | Vsevolod Stakhov <vsevolod@FreeBSD.org> | 2005-09-28 22:54:43 +0000 |
|---|---|---|
| committer | Vsevolod Stakhov <vsevolod@FreeBSD.org> | 2005-09-28 22:54:43 +0000 |
| commit | 2c558cfdfd2e1ee4935f231e3fd255f958a2b69e (patch) | |
| tree | 9a28454b5bab728ef648f6964dcdf37c529286ac /security | |
| parent | - Update to 1.5.2 that fixes some security issues and have lots of (diff) | |
Document vulnerabilities in www/phpmyfaq
Notes
Notes:
svn path=/head/; revision=143731
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 25228171993e..3216a4855ac6 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -21506,4 +21506,29 @@ misc.c: <entry>2005-09-15</entry> </dates> </vuln> + + <vuln vid="c6b9aee8-3071-11da-af18-000ae4641456"> + <topic>phpMyFAQ -- SQL injection, takeover, path disclosure, remote code execution in phpMyFAQ 1.5.x</topic> + <affects> + <package> + <name>phpmyfaq</name> + <range><lt>1.5.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>If magic quotes are off there's a SQL injection when sending a forgotten password. + It's possible to overwrite the admin password and to take over the whole system. + In some files in the admin section there are some cross site scripting vulnerabilities. + In the public frontend it's possible to include arbitrary php files.</p> + </body> + </description> + <references> + <url>http://www.phpmyfaq.de/advisory_2005-09-23.php</url> + </references> + <dates> + <discovery>2005-09-23</discovery> + <entry>2005-09-29</entry> + </dates> + </vuln> </vuxml> |