Zorlu

**Name of the Vulnerable Software and Affected Versions** Mini-stream RM-MP3 Converter version 3.1.2.1.2010.03.30 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service via a long string in a WAX file. **Recommendations** For Mini-stream RM-MP3 Converter version 3.1.2.1.2010.03.30, consider avoiding the use of long strings in WAX files until a patch is available. As a temporary workaround, restrict the processing of WAX files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** RobotStats version 1.0 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `robot` parameter in the `admin/robots.php` endpoint, specifically targeting the `formulaireRobot` function in `admin/robots.lib.php`. **Recommendations** For RobotStats version 1.0, consider restricting access to the `admin/robots.php` endpoint until a patch is available. As a temporary workaround, avoid using the `robot` parameter in the affected endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** RobotStats version 1.0 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the `nom` or `user agent` parameters to the "admin/robots.php" endpoint. **Recommendations** For RobotStats version 1.0, as a temporary workaround, consider restricting access to the "admin/robots.php" endpoint until a patch is available. Avoid using the `nom` and `user agent` parameters in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Php Scriptlerim Who's Who script (affected versions not specified) **Description** The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators. The attack can be performed by sending a request to various API endpoints, including "filepath/yonetim/plugin/adminsave.php" to add an admin account, "ayarsave.php", "uyesave.php", "slaytadd.php", or "slaytsave.php" for unspecified impact. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** xWeblog version 2.2 **Description** A SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the `tarih` parameter in the `arsiv.asp` file. **Recommendations** For xWeblog version 2.2, consider restricting access to the `arsiv.asp` file until a patch is available, and avoid using the `tarih` parameter in this file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Winn ASP Guestbook version 1.01 Beta **Description** The issue allows remote attackers to download a database due to insufficient access control. Sensitive information is stored under the web root, making it accessible via a direct request for data/guestbook.mdb. **Recommendations** For version 1.01 Beta, consider restricting access to the data/guestbook.mdb file to prevent unauthorized downloads until a proper fix is applied. As a temporary workaround, moving sensitive data outside of the web root or implementing proper access controls can help mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** PaymentProcessorScript.net PPScript (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `cid` parameter in the "shop.htm" endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Logoshows BBS version 2.0 **Description** The issue allows remote attackers to bypass authentication and gain administrative access. This is achieved by setting the `pb username` (also known as `pb%5Fusername`) and `level` cookies. **Recommendations** For Logoshows BBS version 2.0, as a temporary workaround, consider restricting access to the `globepersonnel login.asp` page until a patch is available. Avoid using the `pb username` and `level` cookies in the affected login process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Logoshows BBS version 2.0 **Description** The issue allows remote attackers to download a database due to insufficient access control. Sensitive information is stored under the web root, enabling attackers to access the database via a direct request for database/globepersonnel.mdb. **Recommendations** For version 2.0, restrict access to the database file database/globepersonnel.mdb to prevent unauthorized downloads. Consider implementing proper access controls to sensitive information stored under the web root.

**Name of the Vulnerable Software and Affected Versions** Chipmunk Topsites (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `username` parameter in the authenticate.php file, which is related to login.php. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kalptaru Infotech Ltd. Star Articles version 6.0 **Description** The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile photo, then accessing it via a direct request to the file in authorphoto/. This is due to an unrestricted file upload vulnerability in user.modify.profile.php. **Recommendations** For Kalptaru Infotech Ltd. Star Articles version 6.0, restrict the types of files that can be uploaded as profile photos to prevent the execution of arbitrary code. As a temporary workaround, consider disabling the file upload feature in user.modify.profile.php until a proper fix is implemented.

**Name of the Vulnerable Software and Affected Versions** Pie Web Meshler RSS module version 0.1 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `lib` parameter when `register globals` is enabled. This is due to a PHP remote file inclusion vulnerability in the `lib/action/rss.php` file of the RSS module. **Recommendations** For RSS module version 0.1, consider disabling the `register globals` setting to prevent exploitation until a patch is available. Restrict access to the `lib/action/rss.php` file to minimize the risk of arbitrary PHP code execution. Avoid using the `lib` parameter in the affected module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Chipmunk Topsites (affected versions not specified) **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `start` parameter in the "index.php" file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Esqlanelapse versions 2.6.1 through 2.6.2 **Description** The issue allows remote attackers to bypass authentication and gain privileges. This is achieved by modifying specific cookies, namely `enombre` and `euri`. **Recommendations** For versions 2.6.1 and 2.6.2, consider restricting access to sensitive areas of the application until a fix is available, and avoid using modified `enombre` and `euri` cookies to prevent privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: X7 Chat version 2.0.5 Description: A SQL injection issue in the login page allows remote attackers to execute arbitrary SQL commands via the `password` field. Recommendations: For X7 Chat version 2.0.5, update the software to a version that fixes this issue, or as a temporary workaround, consider restricting access to the login page to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: ScriptsFeed Realtor Classifieds System (affected versions not specified) Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in `re images/`. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ScriptsFeed Recipes Listing Portal (affected versions not specified) Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a recipe photo. This is done by accessing the uploaded file via a direct request to the file in the pictures/ directory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ScriptsFeed Auto Classifieds (affected versions not specified) Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo. This is done by accessing the uploaded file via a direct request to the file in the cars images/ directory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: AlstraSoft SendIt Pro (affected versions not specified) Description: The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the `submit file.php` script, and then accessing it via a direct request to the file in the `send/files/` directory. Recommendations: For all affected versions, consider restricting access to the `submit file.php` script and the `send/files/` directory to prevent unauthorized file uploads and execution. As a temporary workaround, consider disabling the file upload functionality in `submit file.php` until a proper fix is applied.

Name of the Vulnerable Software and Affected Versions: PHPStore Complete Classifieds (affected versions not specified) Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo, then accessing it via a direct request to the file in "classifieds1/yellow images/". Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.