Network Security News Monitor - Saturday, April 15, 2006 Events

PAJAX pajax_call_dispatcher.php Arbitrary PHP Code Execution

PAJAX contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when PHP code is included in the 'method' and 'args' variables. This flaw may lead to a loss of integrity.. Read more.

Indexu Multiple Script theme_path Variable Remote File Inclusion

Indexu contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to multiple scripts not properly sanitizing user input supplied to the 'theme_path' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.. Read more.

Indexu invoice.php base_path Variable Remote File Inclusion

Indexu contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to invoice.php not properly sanitizing user input supplied to the 'base_path' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.. Read more.