Dr.Crash

**Name of the Vulnerable Software and Affected Versions** Easy Photo Gallery version 2.1 **Description** The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the `galleryid` parameter to "gallery.php", and the `size` or `imageid` parameters to "show.php". **Recommendations** For Easy Photo Gallery version 2.1, consider restricting access to the "gallery.php" and "show.php" scripts until a patch is available. As a temporary workaround, avoid using the `galleryid`, `size`, and `imageid` parameters in the affected scripts.

**Name of the Vulnerable Software and Affected Versions** Easy Photo Gallery version 2.1 **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `username` parameter in the gallery.php file. **Recommendations** For Easy Photo Gallery version 2.1, consider restricting access to the gallery.php file until a patch is available, and avoid using the `username` parameter in this context to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PhpWebGallery version 1.3.4 **Description** The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting directory traversal vulnerabilities using a .. (dot dot) in the `user[language]` and `user[template]` parameters to "init.inc.php" and the `user[language]` parameter to "isadmin.inc.php". **Recommendations** For PhpWebGallery version 1.3.4, as a temporary workaround, consider restricting access to the vulnerable parameters `user[language]` and `user[template]` in "init.inc.php" and the `user[language]` parameter in "isadmin.inc.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PhpWebGallery version 1.3.4 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `lang[access forbiden]` and `lang[ident title]` parameters in the admin/include/isadmin.inc.php file. **Recommendations** For PhpWebGallery version 1.3.4, as a temporary workaround, consider restricting access to the admin/include/isadmin.inc.php file until a patch is available. Avoid using the `lang[access forbiden]` and `lang[ident title]` parameters in the affected file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** NooMS version 1.1 **Description** The issue allows remote attackers to conduct brute force attacks against passwords. This is achieved by providing a `username` in the `g dbuser` parameter and a `password` in the `g dbpwd` parameter. The attack might also involve setting the `g dbhost` parameter to a "localhost" value. **Recommendations** For NooMS version 1.1, consider restricting access to the db.php file to prevent brute force attacks, and limit the number of login attempts to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the `g dbuser` and `g dbpwd` parameters until a patch is available.

**Name of the Vulnerable Software and Affected Versions** NooMS version 1.1 **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `page id` parameter to "smileys.php" and the `q` parameter to "search.php". **Recommendations** For NooMS version 1.1, consider restricting access to the "smileys.php" and "search.php" scripts until a fix is available. As a temporary workaround, avoid using the `page id` and `q` parameters in the affected API endpoints.

**Name of the Vulnerable Software and Affected Versions** NooMS version 1.1 **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved by manipulating a URL in the `g site url` parameter in the admin/auth.php file. **Recommendations** For NooMS version 1.1, consider restricting access to the admin/auth.php file until a patch is available, and avoid using the `g site url` parameter in this context to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** phsBlog version 0.2 **Description** The issue concerns SQL injection vulnerabilities in the index.php file of phsBlog. Remote attackers can execute arbitrary SQL commands via the `sid` parameter in a pickup action or the `sql cid` parameter. **Recommendations** For phsBlog version 0.2, consider restricting access to the `sid` and `sql cid` parameters in the index.php file to minimize the risk of exploitation. As a temporary workaround, avoid using these parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pluck version 4.5.2 **Description** The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can occur through various parameters in different PHP files, including `lang footer` in `data/inc/footer.php`, multiple parameters in `data/inc/header.php` and `data/inc/header2.php`, and `lang theme6` in `data/inc/themeinstall.php`. The affected parameters are: `lang footer`, `pluck version`, `lang install22`, `titelkop`, `lang kop1`, `lang kop2`, `lang modules`, `lang kop4`, `lang kop15`, `lang kop5`, and `lang theme6`. **Recommendations** For Pluck version 4.5.2, consider disabling the `register globals` setting to mitigate the risk of exploitation. As a temporary workaround, restrict access to the vulnerable parameters, such as `lang footer`, `pluck version`, `lang install22`, `titelkop`, `lang kop1`, `lang kop2`, `lang modules`, `lang kop4`, `lang kop15`, `lang kop5`, and `lang theme6`, in the affected PHP files until a patch is available. Avoid using these parameters in the "data/inc/footer.php", "data/inc/header.php", "data/inc/header2.php", and "data/inc/themeinstall.php" files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** MyioSoft EasyE-Cards versions 3.5 through 3.10a **Description** The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including `ResultHtml`, `dir`, `SenderName`, `RecipientName`, `SenderMail`, and `RecipientMail`. This can be exploited by sending malicious input to the affected API endpoint. **Recommendations** For MyioSoft EasyE-Cards versions 3.5 through 3.10a, as a temporary workaround, consider restricting access to the `staticpages/easyecards/index.php` endpoint until a patch is available. Avoid using the parameters `ResultHtml`, `dir`, `SenderName`, `RecipientName`, `SenderMail`, and `RecipientMail` in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MyioSoft EasyE-Cards versions 3.5 through 3.10a **Description** The issue allows remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. This is achieved via the `sid` parameter in a "pickup" action. **Recommendations** For MyioSoft EasyE-Cards versions 3.5 through 3.10a, consider disabling the `pickup` action or restricting access to it until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Mjguest version 6.7 GT Rev.01 Description: The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the `goto` parameter in a redirect action to "mjguest.php". The attack is user-assisted, meaning there is a delay and a notification before the redirection occurs. Recommendations: For Mjguest version 6.7 GT Rev.01, consider restricting access to the "interface/redirect.htm.php" file or avoiding the use of the `goto` parameter in redirect actions to "mjguest.php" until a fix is available. As a temporary workaround, consider implementing additional validation for the `goto` parameter to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Maian Search version 1.1 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `keywords` parameter in a search action, specifically targeting the search.php file. Recommendations: For Maian Search version 1.1, consider restricting access to the search.php file or the search action until a patch is available. As a temporary workaround, avoid using the `keywords` parameter in the search action to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: LifeType version 1.2.8 Description: A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `newBlogUserName` parameter in an "addBlogUser" action. Recommendations: For LifeType version 1.2.8, avoid using the `newBlogUserName` parameter in the affected admin.php file until a fix is available. Consider restricting access to the admin.php file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Maian Weblog version 4.0 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through several parameters, including the `keywords` parameter to "admin/index.php" in a blogs search action, the `msg charset` and `msg header9` parameters to "admin/inc/header.php", and the `keywords` parameter to "index.php" in a search action. Recommendations: For Maian Weblog version 4.0, consider restricting access to the affected parameters, such as `keywords`, `msg charset`, and `msg header9`, until a patch is available. As a temporary workaround, avoid using these parameters in the specified API endpoints, such as "admin/index.php" and "index.php", to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Maian Recipe version 1.2 Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via various parameters, specifically the `header`, `header2`, `header3`, `header4`, `header5`, `header6`, `header7`, `header8`, and `header9` parameters in the admin/inc/header.php file. Recommendations: For Maian Recipe version 1.2, as a temporary workaround, consider restricting access to the admin/inc/header.php file until a patch is available. Avoid using the `header`, `header2`, `header3`, `header4`, `header5`, `header6`, `header7`, `header8`, and `header9` parameters in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Maian Uploader version 4.0 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through several parameters, including the `keywords` parameter to "upload/admin/index.php" in a search action, the `msg charset` and `msg header9` parameters to "admin/inc/header.php", and the `keywords` parameter to "index.php" in a search action. Recommendations: For Maian Uploader version 4.0, update the software to a version that addresses these XSS vulnerabilities, ensuring that the `keywords`, `msg charset`, and `msg header9` parameters are properly sanitized to prevent arbitrary web script or HTML injection. As a temporary workaround, consider restricting access to the affected "upload/admin/index.php", "admin/inc/header.php", and "index.php" endpoints until a patch is available.

Name of the Vulnerable Software and Affected Versions: Maian Music version 1.1 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `album` parameter in an `album` action within the `index.php` file. Recommendations: For Maian Music version 1.1, consider restricting access to the `album` parameter in the `index.php` file until a patch is available. As a temporary workaround, avoid using the `album` parameter in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Maian Music version 1.1 Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited via the `keywords` parameter in a search action to "index.php" and the `msg script` parameter to "admin/inc/footer.php". Recommendations: For Maian Music version 1.1, consider disabling the search function and restricting access to "admin/inc/footer.php" until a patch is available. Avoid using the `keywords` and `msg script` parameters in the affected API endpoints until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Maian Gallery version 2.0 Description: A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `keywords` parameter in a search action. This occurs in the admin/index.php file. Recommendations: For Maian Gallery version 2.0, consider restricting access to the search action in admin/index.php to minimize the risk of exploitation, and avoid using the `keywords` parameter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.