K-159

**Name of the Vulnerable Software and Affected Versions** JobHut versions 1.2 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `pk` parameter in the "browse.php" endpoint. **Recommendations** For JobHut versions 1.2 and earlier, avoid using the `pk` parameter in the "browse.php" endpoint until the issue is resolved. Consider restricting access to the "browse.php" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Joomla! component Hotel Booking Reservation System (aka HBS or com hbssearch) (affected versions not specified) **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `adult` parameter in a `showhoteldetails` action to "index.php". **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or com hbssearch) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) h id, (2) id, and (3) rid parameters to longDesc.php, and the h id parameter to (4) detail.php, (5) detail1.php, (6) detail2.php, (7) detail3.php, (8) detail4.php, (9) detail5.php, (10) detail6.php, (11) detail7.php, and (12) detail8.php, different vectors than CVE-2008-5865, CVE-2008-5874, and CVE-2008-5875.

**Name of the Vulnerable Software and Affected Versions** taifajobs versions 1.0 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `jobid` parameter in the "jobdetails.php" file. **Recommendations** For versions 1.0 and earlier, consider restricting access to the "jobdetails.php" file until a patch is available. As a temporary workaround, avoid using the `jobid` parameter in the affected file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BusinessSpace versions 1.2 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter to "index.php". **Recommendations** For BusinessSpace versions 1.2 and earlier, update to a version later than 1.2 to resolve the issue. As a temporary workaround, consider restricting access to the "classified.php" page and avoid using the `id` parameter in the "index.php" endpoint until a patch is available.

Name of the Vulnerable Software and Affected Versions: Attachmax Dolphin versions 2.1.0 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `category` parameter in a Search action to "index.php". Recommendations: For Attachmax Dolphin versions 2.1.0 and earlier, update to a version later than 2.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the "index.php" endpoint or limiting the input for the `category` parameter to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Attachmax Dolphin versions 2.1.0 and earlier Description: The issue allows remote attackers to obtain sensitive information via a direct request to the info.php file in the main folder, which invokes the `phpinfo` function. Recommendations: For Attachmax Dolphin versions 2.1.0 and earlier, restrict access to the info.php file in the main folder to prevent remote attackers from obtaining sensitive information. As a temporary workaround, consider removing or restricting access to the info.php file until a proper fix is applied.

Name of the Vulnerable Software and Affected Versions: Attachmax Dolphin versions 2.1.0 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved via a URL in the `rel path` parameter. Recommendations: For Attachmax Dolphin versions 2.1.0 and earlier, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the config.php file to minimize the risk of arbitrary PHP code execution.

Name of the Vulnerable Software and Affected Versions: Relative Real Estate Systems versions 3.0 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `listing id` parameter in a "listings" action. Recommendations: For versions 3.0 and earlier, update to a version later than 3.0 to resolve the issue. As a temporary workaround, consider restricting access to the `listing id` parameter in the affected API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** AnServ Auction XL (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `cat` parameter in the `viewfaqs.php` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Kmita Tellfriend versions 2.0 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the `file` parameter when `register globals` is enabled. This is due to a PHP remote file inclusion vulnerability in `htmlcode.php`. Recommendations: For Kmita Tellfriend versions 2.0 and earlier, consider disabling the `register globals` setting to prevent exploitation until a patch is available. Restrict access to the `htmlcode.php` file to minimize the risk of arbitrary PHP code execution. Avoid using the `file` parameter in affected URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BackLinkSpider (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `cat id` parameter in site-specific component names, such as "link.php" or "backlinkspider.php". **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Softbiz Web Host Directory Script (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `host id` parameter in the "search result.php" file when magic quotes gpc is disabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Prozilla Hosting Index (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `cat id` parameter in a 'list' action when `magic quotes gpc` is disabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RSGallery (com rsgallery) versions 2.0 beta 5 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `catid` parameter in an inline page action in the index.php file. **Recommendations** For versions 2.0 beta 5 and earlier, consider restricting access to the `catid` parameter in the inline page action until a patch is available. As a temporary workaround, avoid using the `catid` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** AlstraSoft E-Friends versions 4.98 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `seid` parameter in a "viewevent" action. **Recommendations** For versions 4.98 and earlier, consider restricting access to the vulnerable `index.php` file until a patch is available. As a temporary workaround, avoid using the `seid` parameter in the "viewevent" action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProfileCMS versions 1.0 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `id` parameter in various actions across different modules, including (1) codes action in the profile-codes module, (2) videos action in the video-codes module, or (3) games action in the arcade-games module. **Recommendations** For ProfileCMS versions 1.0 and earlier, as a temporary workaround, consider restricting access to the `id` parameter in the mentioned modules until a patch is available. Avoid using the `id` parameter in the affected API endpoints, such as those related to the profile-codes, video-codes, and arcade-games modules, until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the svr rootscript parameter, a different vector than CVE-2007-4094 and CVE-2006-3776.

**Name of the Vulnerable Software and Affected Versions** wp-Table plugin for WordPress versions 1.43 and earlier **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `wpPATH` parameter when `register globals` is enabled. **Recommendations** For wp-Table plugin for WordPress versions 1.43 and earlier, consider disabling the `register globals` setting to prevent exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** wp-Table plugin for WordPress versions 1.43 and earlier **Description** A directory traversal issue exists when register globals is enabled, allowing remote attackers to include and execute arbitrary local files via the `wpPATH` parameter in the js/wptable-button.php file. **Recommendations** For wp-Table plugin for WordPress versions 1.43 and earlier, consider disabling the register globals setting to mitigate the risk of exploitation. Additionally, restrict access to the js/wptable-button.php file to minimize the risk of arbitrary file inclusion. Avoid using the `wpPATH` parameter in the affected file until the issue is resolved.