Elwaux

**Name of the Vulnerable Software and Affected Versions** GenCMS version 2006 **Description** The issue concerns directory traversal vulnerabilities that allow remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in specific parameters. For example, the `p` parameter to "show.php" and the `Template` parameter to "admin/pages/SiteNew.php" are vulnerable. **Recommendations** For GenCMS version 2006, as a temporary workaround, consider restricting access to the "show.php" and "admin/pages/SiteNew.php" scripts until a patch is available. Avoid using the `p` parameter in "show.php" and the `Template` parameter in "admin/pages/SiteNew.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpBMS version 0.96 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in multiple parameters, including the `id` parameter to "modules/bms/invoices discount ajax.php", the `f` parameter to "dbgraphic.php", and the `tid` parameter in a "show" action to "advancedsearch.php". **Recommendations** For phpBMS version 0.96, as a temporary workaround, consider restricting access to the vulnerable parameters `id`, `f`, and `tid` in the respective files until a patch is available. Avoid using these parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpBMS version 0.96 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the PATH INFO to several files, including index.php, modulesbasemyaccount.php, modules view.php, tabledefs options.php, and adminsettings.php. **Recommendations** For phpBMS version 0.96, as a temporary workaround, consider restricting access to the affected API endpoints, such as "index.php" and "modulesbasemyaccount.php", until a patch is available. Avoid using the `PATH INFO` variable in the affected files, including "modules view.php", "tabledefs options.php", and "adminsettings.php", to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpBMS version 0.96 **Description** The issue allows remote attackers to obtain sensitive information via direct requests to specific files, including `footer.php`, `header.php`, the `show` action in `advancedsearch.php`, and `choicelist.php`. These requests can reveal the installation path in an error message. **Recommendations** For phpBMS version 0.96, consider restricting access to the files `footer.php`, `header.php`, `advancedsearch.php`, and `choicelist.php` to minimize the risk of exploitation. As a temporary workaround, limit the information disclosed in error messages to prevent revealing sensitive details about the installation path.

Name of the Vulnerable Software and Affected Versions: Elgg version 1.5 Description: The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the css/js.php file when magic quotes gpc is disabled. This can be achieved by including a .. (dot dot) in the `js` parameter. Recommendations: For Elgg version 1.5, consider disabling the css/js.php file or restricting access to it until a fix is available. Additionally, enabling magic quotes gpc can help mitigate this issue.

**Name of the Vulnerable Software and Affected Versions** Simple Machines Forum (SMF) Member Awards component version 1.0.2 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `id` parameter in a profile action to "index.php" via the `awardsMembers` function in Sources/Profile.php. **Recommendations** For Simple Machines Forum (SMF) Member Awards component version 1.0.2, consider restricting access to the `awardsMembers` function in Sources/Profile.php until a patch is available. Avoid using the `id` parameter in the affected "index.php" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Related Sites plugin version 2.1 for WordPress **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `guid` parameter in the BTE RW webajax.php file. **Recommendations** For version 2.1 of the Related Sites plugin, consider disabling the BTE RW webajax.php file or restricting access to it until a patch is available. Avoid using the `guid` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** KerviNet Forum versions 1.1 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via two methods: (1) an `enter parol` cookie to "index.php" in an auto action, or (2) the `topic` parameter to "message.php". The second method can also be used for a cross-site scripting (XSS) attack. **Recommendations** For KerviNet Forum versions 1.1 and earlier, consider disabling the `index.php` auto action and restricting access to the `message.php` endpoint until a fix is available. Avoid using the `enter parol` cookie and the `topic` parameter in the affected API endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CMS Chainuk versions 1.2 and earlier **Description** The issue allows remote attackers to perform directory traversal, enabling them to include and execute arbitrary local files. This can be achieved by sending a .. (dot dot) in specific parameters to various PHP files, including the `menu` parameter to "admin/admin menu.php", and the `id` parameter to "index.php" and "admin/admin edit.php". Additionally, attackers can delete arbitrary local files by exploiting the `id` parameter in "admin/admin delete.php". It is also possible to leverage one of the vectors for static code injection by sending a crafted `menu` parameter to "admin/admin menu.php" and then sending an `id=../menu.csv` request to "index.php". **Recommendations** For CMS Chainuk versions 1.2 and earlier, consider disabling access to the vulnerable PHP files, specifically "admin/admin menu.php", "index.php", "admin/admin edit.php", and "admin/admin delete.php", until a patch is available. Restrict the use of the `menu` and `id` parameters in these files to minimize the risk of exploitation. Avoid using the `id` parameter with a .. (dot dot) sequence in "admin/admin delete.php" to prevent deletion of arbitrary local files.

**Name of the Vulnerable Software and Affected Versions** KerviNet Forum versions 1.1 and earlier **Description** The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the `v variant1` parameter in the "add voting.php" file. **Recommendations** For KerviNet Forum versions 1.1 and earlier, as a temporary workaround, consider restricting access to the "add voting.php" file until a patch is available. Avoid using the `v variant1` parameter in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KerviNet Forum versions 1.1 and earlier **Description** The issue allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks. This is possible because the admin/edit user.php file does not require administrative authentication. The `del user id` parameter is vulnerable to such attacks. **Recommendations** For KerviNet Forum versions 1.1 and earlier, consider restricting access to the admin/edit user.php file until a patch is available, and ensure that proper authentication mechanisms are in place to prevent unauthorized access. Avoid using the `del user id` parameter in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KerviNet Forum versions 1.1 and earlier **Description** The issue allows remote attackers to obtain sensitive information via a direct request to various PHP files in the include files/ directory, including "admin/head.php", "voting diagram.php", "voting.php", "topics search.php", "topics list.php", "top part.php", "quick search.php", "quick reply.php", "moder menu.php", "messages list.php", "menu.php", "head.php", "forums list.php", "forum statistics.php", "forum info.php", and "birthday.php". These requests can reveal the installation path in an error message. **Recommendations** For KerviNet Forum versions 1.1 and earlier, as a temporary workaround, consider restricting access to the include files/ directory to minimize the risk of exploitation. Avoid using direct requests to the mentioned PHP files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMS Chainuk versions 1.2 and earlier **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `menu` parameter in the admin/admin menu.php file. **Recommendations** For CMS Chainuk versions 1.2 and earlier, update to a version later than 1.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** CMS Chainuk versions 1.2 and earlier **Description** The issue allows remote attackers to inject arbitrary PHP code into specific files. This can be achieved in two ways: (1) by injecting code into settings.php via the `menu` parameter to "admin settings.php", or (2) by injecting code into a content/=NUMBER.php file via the `title` parameter to "admin new.php". **Recommendations** For CMS Chainuk versions 1.2 and earlier, as a temporary workaround, consider restricting access to the "admin settings.php" and "admin new.php" files until a patch is available. Avoid using the `menu` parameter in "admin settings.php" and the `title` parameter in "admin new.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMS Chainuk versions 1.2 and earlier **Description** The issue allows remote attackers to obtain sensitive information. This can be achieved via a crafted `id` parameter to "index.php" or by using a nonexistent folder name in the `id` parameter to "admin/admin delete.php", which reveals the installation path in an error message. **Recommendations** For CMS Chainuk versions 1.2 and earlier, consider restricting access to the "index.php" and "admin/admin delete.php" endpoints until a fix is available. As a temporary workaround, avoid using the `id` parameter in these endpoints to minimize the risk of exploitation.