Network Security News Monitor - Monday, June 05, 2006 Events

Perlpodder Crafted URL Arbitrary Command Execution

Perlpodder contains a flaw that may allow a malicious user to execute arbitrary commands on the victim's system. The issue is triggered because the software fails to properly sanitise input from a podcast server in the shape of a podcast URL before passing it to a shell command. A malicious podcast server could therefore embed shell commands in the URL, resulting in the execution of these commands and hence of a loss of integrity.. Read more.

PHP-Fusion last_seen_users_panel.php settings[locale] Variable Local File Inclusion

PHP-Fusion contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to last_seen_users_panel.php script not properly sanitizing user input supplied to the "settings[locale]" variable. This may allow an attacker to include a file from a local host that contains arbitrary commands which will be executed by the vulnerable script.. Read more.

phpListPro in.php returnpath Variable Remote File Inclusion

phpListPro contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the in.php script not properly sanitizing user input supplied to the 'returnpath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.. Read more.

phpListPro addsite.php returnpath Variable Remote File Inclusion

phpListPro contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the addsite.php script not properly sanitizing user input supplied to the 'returnpath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.. Read more.