Breaker_Unit

**Name of the Vulnerable Software and Affected Versions** com ewriting version 1.2.1 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `cat` parameter in a "selectcat" action within the index.php file of the com ewriting module. **Recommendations** For version 1.2.1, consider restricting access to the vulnerable `index.php` file in the com ewriting module until a patch is available. As a temporary workaround, avoid using the `cat` parameter in the "selectcat" action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** com quran versions 1.1 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `surano` parameter in a "viewayat" action within the index.php file of the com quran component for Mambo and Joomla!. **Recommendations** For com quran versions 1.1 and earlier, consider restricting access to the vulnerable index.php file until a patch is available. As a temporary workaround, avoid using the `surano` parameter in the "viewayat" action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MySpace Content Zone (MCZ) version 3.x **Description** The issue concerns the `admin/uploadgames.php` file, which does not require administrative privileges. This allows remote attackers to perform unrestricted file uploads. Attackers can upload malicious files, such as `.php` files or files with names like `.php%00.jpeg`, to potentially execute arbitrary code. **Recommendations** For MySpace Content Zone (MCZ) version 3.x, restrict access to the `admin/uploadgames.php` file to require administrative privileges, and validate all file uploads to prevent malicious files from being uploaded. As a temporary workaround, consider disabling the file upload functionality in `admin/uploadgames.php` until a proper fix is implemented.

Name of the Vulnerable Software and Affected Versions: Ourspace version 2.0.9 Description: The issue allows remote attackers to upload certain files via unspecified vectors, likely due to unrestricted functionality in the newswire/uploadmedia.cgi script. Recommendations: For Ourspace version 2.0.9, restrict access to the newswire/uploadmedia.cgi script to prevent unauthorized file uploads until a fix is available.