Alerts from SecurityFocus Newsletter #318

Summarized by Daniel Convissor

PHP

• PHP Open_BaseDir Security Restriction Bypass Vulnerability
  This bug (http://bugs.php.net/32937) was fixed in CVS on 2005-09-27 (http://cvs.php.net/php-src/main/fopen_wrappers.c).

APPLICATIONS USING PHP

• AlstraSoft E-Friends Remote File Include Vulnerability
• UNU Networks MailGust User_email.PHP SQL Injection Vulnerability
• SEO-Board Admin.PHP SQL Injection Vulnerability
• CMS Made Simple Index.PHP Cross-Site Scripting Vulnerability
• Riverdark RSS Syndicator Module RSS.PHP Multiple Cross-Site Scripting Vulnerabilities
• LucidCMS Index.PHP Cross-Site Scripting Vulnerability
• CJ LinkOut Top.PHP Cross-Site Scripting Vulnerability
• CJ Tag Board Multiple Cross-Site Scripting Vulnerabilities
• CJ Web2Mail Multiple Cross-Site Scripting Vulnerabilities
• PostNuke PN_BBCode Local File Include Vulnerability
• CubeCart Multiple Cross-Site Scripting Vulnerabilities
• PHP-Fusion Messages.PHP SQL Injection Vulnerability
• SquirrelMail Address Add Plugin Add.PHP Cross-Site Scripting Vulnerability
• EasyGuppy Printfaq.PHP Directory Traversal Vulnerability
• MediaWiki Multiple Cross-Site Scripting Vulnerabilities
• PHP-Fusion Multiple SQL Injection Vulnerabilities