nexen

3 exploits Active since Sep 2007
CVE-2007-6604 EXPLOITDB text WORKING POC
XCMS <= 1.82 - Path Traversal via Admin Page s Parameter or Module pg Parameter
Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the s parameter to the admin page or (2) the pg parameter to an arbitrary module, as demonstrated by reading a password hash in a .dtb file under dati/membri/ or by executing embedded PHP code in images under uploads/avatar/.
CVE-2007-4984 EXPLOITDB perl WORKING POC
Ktauber StylesDemo - SQL Injection via s Parameter
SQL injection vulnerability in index.php in the Ktauber.com StylesDemo mod for phpBB 2.0.xx allows remote attackers to execute arbitrary SQL commands via the s parameter.
CVE-2007-6237 EXPLOITDB python WORKING POC
DeluxeBB 1.09 - Authenticated Profile Update via Membercookie Parameter Manipulation
cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote authenticated users to change the e-mail addresses of arbitrary accounts via a modified membercookie parameter, a different vector than CVE-2006-4078. NOTE: this can be leveraged for administrative access by requesting password-reset e-mail through a lostpw action to misc.php.