Christopher Kunz

A directory traversal issue might allow remote authenticated users to execute arbitrary PHP code. This can be achieved by including a .. (dot dot) in the `path` parameter and a %00 at the end of the `filename`, as demonstrated by an avatar `filename` ending with .png%00.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via multiple vectors, including the `account name`. This can lead to the execution of malicious scripts on the client-side.

The issue allows remote attackers to read or include arbitrary files and ultimately execute arbitrary PHP code via directory traversal vulnerabilities. This is achieved by using .. (dot dot) and null byte ("%00") sequences in the `module` parameter and `action` parameter in the Leads module. Attackers can also inject PHP code into log messages and access the log file.

The issue allows remote attackers to upload arbitrary files, including PHP files, via the `add2db` action in the uploads module.

The issue allows remote attackers to execute arbitrary PHP code via an arbitrary file in the `templatename` parameter, which is passed to the `eval()` function.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `username` in the login form or the `record` parameter, as seen in the EditView action for the Contacts module.

The issue allows remote attackers to spoof web content and poison web caches. This is achieved via CRLF sequences in the `charset` parameter.

Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) sensor program parameter or the (2) SERVER[HTTP ACCEPT LANGUAGE] parameter, which overwrites an internal variable, a variant of CVE-2003-0536. NOTE: due to a typo in an advisory, an issue in osh was inadvertently linked to this identifier; the proper identifier for the osh issue is CVE-2005-3346.

The issue allows remote attackers to execute arbitrary PHP code via a string containing the code within `{` and `}` characters, which are processed by the PHP `eval()` function.

The issue allows remote attackers to execute arbitrary PHP code via the `language` parameter.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `value` parameter to the "poll module" or the `pId` parameter to the "gallery module".

The issue allows remote attackers to obtain sensitive information. This can be achieved by making a direct request to the "/config/version.xml" API endpoint.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the `term` parameter to the search module or the `title` in the blog aggregation module.