Alerts from SecurityFocus Newsletter #375

Summarized by Daniel Convissor

PHP 5.2 was released this week. It includes many security fixes and nice new features.

APPLICATIONS USING PHP

• Modx CMS Thumbnail.PHP Remote File Include Vulnerability
• Simplog BlogID Parameter Multiple SQL Injection Vulnerabilities
• PostNuke PNUser.PHP Local File Include Vulnerability
• Arkoon SSL360 Unspecified Cross-Site Scripting Vulnerability
• Gepi Savebackup.PHP Remote File Include Vulnerability
• Article System Volume.PHP Remote File Include Vulnerability
• FreeWebShop Index.PHP Directory Traversal Vulnerability
• Webdrivers Simple Forum Message_details.PHP SQL Injection Vulnerability
• Ultimate PHP Board Header_simple.PHP Remote File Include Vulnerability
• DeltaScripts PHP Classifieds Detail.PHP SQL Injection Vulnerability
• MX Smartor Album Module Album.PHP Remote File Include Vulnerability
• Xoops NewList.PHP Cross-Site Scripting Vulnerability
• Article Script RSS.PHP SQL Injection Vulnerability
• @cid Stats Install.PHP3 Remote File Include Vulnerability
• Docmint Required.php Remote File Include Vulnerability
• FreeWebShop Index.PHP SQL Injection Vulnerability
• SazCart CART.PHP Remote File Include Vulnerability
• PHPDynaSite Multiple Remote File Include Vulnerabilities
• Drake CMS XHTML.PHP Remote File Include Vulnerability
• e107 GSitemap.PHP Local File Include Vulnerability
• MDPro PNSVLang Parameter Local File Include Vulnerability
• PHPKit Popup.PHP SQL Injection Vulnerability
• IF-CMS Index.PHP Cross-Site Scripting Vulnerability
• PHP HTMLEntities HTMLSpecialChars Buffer Overflow Vulnerabilities
• Kayako SupportSuite Index.PHP Cross-Site Scripting Vulnerability
• IPManager Index.PHP Cross-Site Scripting Vulnerability
• IPrimal Forums Index.PHP Authentication Bypass Vulnerability
• GreenBeast CMS Up_Loader.PHP Arbitrary File Upload Vulnerability
• Hyper NIKKI System Unspecified Cross-Site Scripting Vulnerability
• NewP News Publishing System Class.Database.PHP Remote File Include Vulnerability
• Advanced GuestBook Admin.PHP Remote File Include Vulnerability
• Simplog Multiple HTML Injection Vulnerabilities
• Simplog Archive.PHP PID Parameter Cross-Site Scripting Vulnerability
• Admin.Tool CMS Multiple Cross-Site Scripting Vulnerabilities
• iWare Professional Remote Code Execution Vulnerability
• Xenis.creator CMS Multiple Input Validation Vulnerabilities
• OpenSolution Quick.Cms.Lite Local File Include Vulnerability
• EggBlog Multiple HTML Injection Vulnerabilities
• Cyberfolio Multiple Remote File Include Vulnerabilities
• AIOCP Multiple Input Validation Vulnerabilities
• Mobile Multiple Cross-Site Scripting Vulnerabilities