Trex

**Name of the Vulnerable Software and Affected Versions** WebSPELL versions 4.01.02 and earlier **Description** The issue allows remote attackers to read arbitrary files via the `file` parameter in the picture.php script. **Recommendations** For WebSPELL versions 4.01.02 and earlier, consider restricting access to the picture.php script until a patch is available. As a temporary workaround, avoid using the `file` parameter in the picture.php script to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WebSPELL versions 4.01.02 and earlier **Description** The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the `id` parameter of the picture.php file when using PHP before 4.3.0. **Recommendations** For WebSPELL versions 4.01.02 and earlier, consider updating PHP to version 4.3.0 or later to mitigate the risk of exploitation. As a temporary workaround, restrict access to the picture.php file until a patch is available. Avoid using the `id` parameter in the picture.php file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Lappy512 PHP Krazy Image Host Script (phpkimagehost) version 0.7a **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter in the display.php file. **Recommendations** For version 0.7a, avoid using the `id` parameter in the display.php file until the issue is resolved. As a temporary workaround, consider restricting access to the display.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WebSPELL versions 4.01.01 and earlier **Description** The issue allows remote attackers to bypass authentication and gain sensitive information stored in the database. This is achieved by modifying the `userID` parameter in a write action to the "admin/database.php" endpoint when `register globals` is enabled. **Recommendations** For WebSPELL versions 4.01.01 and earlier, consider disabling the `register globals` setting to prevent exploitation. Additionally, restrict access to the "admin/database.php" endpoint until a fix is available. Avoid using the `userID` parameter in the affected endpoint until the issue is resolved.