Alerts from SecurityFocus Newsletter #354

Summarized by Daniel Convissor

Someone has been spending a lot of time finding regarding file inclusion attacks...

APPLICATIONS USING PHP

• Squirrelmail Redirect.PHP Local File Include Vulnerability
• PhpBB BBRSS.PHP Remote File Include Vulnerability
• Horde Application Framework Multiple Cross-Site Scripting Vulnerabilities
• Woltlab Burning Board Multiple SQL Injection Vulnerabilities
• BoastMachine Vote.PHP Remote File Include Vulnerability
• Somery Team.PHP Remote File Include Vulnerability
• aWebNews Visview.PHP Remote File Include Vulnerability
• Myscrapbook Singlepage.PHP HTML Injection Vulnerability
• ISPConfig Multiple Remote File Include Vulnerabilities
• PhpBlueDragon CMS Template.PHP Remote File Include Vulnerability
• Content-Builder Multiple Remote File Include Vulnerabilities
• DoubleSpeak Multiple Remote File Include Vulnerabilities
• CEScripts Multiple Scripts Cross-Site Scripting Vulnerabilities
• RahnemaCo Page.PHP Remote File Include Vulnerability
• Confixx FTP_index.PHP Cross-Site Scripting Vulnerability
• Wheatblog View_Links.PHP Remote File Include Vulnerability
• Hinton Design PHPHG Guestbook Signed.PHP Remote File Include Vulnerability
• TikiWiki Multiple Input Validation Vulnerabilities
• 35mmslidegallery Multiple Cross-Site Scripting Vulnerabilities
• G-Shout Shoutbox.PHP Remote File Include Vulnerability
• PHPSimpleChoose Multiple HTML Injection Vulnerabilities
• Simpnews Wap_short_news.PHP Remote File Include Vulnerability
• iFusion iFlance Multiple Input Validation Vulnerabilities

RELATED STUFF

• MySQL Server Str_To_Date Remote Denial Of Service Vulnerability
  Fixed in versions 4.1.18, 5.0.19, and 5.1.6.
• Sendmail Malformed MIME Message Denial Of Service Vulnerability