tccms v8 注入一枚

简要描述： 过滤不严。 详细说明： 在app/controller/picture.class.php 中 public $objName = 'picture'; public function all $Obj = M$this-objName; $categoryObj = M"category"; $Obj-pageSize = 20; $where = "1=1"; $key = $POST'key'; $cid = $GET'cid'; if $key != "" $where .= " and id = '" . $key . "' or title like...

BIWEB门户版Getwebshell漏洞

简要描述： 厂商来不来？ 详细说明： wap/detail.php（还有好几处，修复时请留意） if !empty$GET'mod' $strModuleID = strval$GET'mod'; //此处未过滤 includeonce'../'.$strModuleID.'/config/var.inc.php'; //包含需截断 $objWebInit-setDBG$arrGPdoDB; $objWebInit-db; $arrLink = 'mod=' . $strModuleID; else includeonce'include/title.php';...

ThinkSNS getshell一枚

简要描述： ThinkSNS某处处理不当导致get shell 详细说明： \apps\public\Lib\Action\CommentAction.class.php reply函数 public function reply $var = $GET; $var'initNums' = model'Xdata'-getConfig'weibonums', 'feed'; $var'commentInfo' = model'Comment'-getCommentInfo$var'commentid', false; $var'canrepost' =...

$_GET not cleaned when parsed from REQUEST_URI

When none of the default methods of determining the request URI have succeeded, the framework will fallback to parsing the raw request URI as passed by the webserver. If this URI has a query string, it will be parsed and $GET will be updated. In this process, the $GET variables are not cleaned,...

TP-LINK TD-W8151N Cross Site Request Forgery

Exploit for hardware platform in category web applications ===================================================================== Vulnerable Software/Or Device: TP-LINK TD-W8151N 150Mbps Wireless N ADSL+2 modem Router Vendor: http://www.tp-linkru.com/ Vuln: CROSS SITE REQUEST FORGERY CSRF How it...

Pussytorrents.org Cross Site Scripting

+-------------------------------------------------------------------------+ Exploit Title : Pussytorrents.org - Website XSS Cross Site Scripting Author : Atmon3r Date : 02/03/2012 Editor : Pussytorrents.org Perso : More p0rn please ! Xss type : $GET...

Pragyan CMS v 3.0 Remote File Disclosure

Exploit for php platform in category web applications Title Pragyan CMS v 3.0 = Remote File Disclosure Author Or4nG.M4n Download http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2 vuln download.lib.php line 16 vuln index.php line 234 $GET'fileget' exploit...

Pragyan CMS 3.0 - Remote File Disclosure

Pragyan CMS 3.0 - Remote File Disclosure Title Pragyan CMS v 3.0 = Remote File Disclosure Author Or4nG.M4n Download http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2 vuln download.lib.php line 16 vuln index.php line 234 $GET'fileget' exploit...

Netvidade engine 1.0 - Multiple Vulnerabilities

!/usr/bin/perl -w use strict; use LWP::UserAgent; use Getopt::Long; use MIME::Base64; '/ -.- ----------------------oOO------OOo---------------------- | | | / / / / | | / / / / / / / / / / / | | // // / / / // / // / // | | ///,// /./,/, // | | Security Research Division // 2o1o |...

DELTAScripts PHPLinks SQL Injection

/ Name : DELTAScripts PHPLinks Vuln : SQL Injection Author : Hamza 'MizoZ' N. Email : mizozxatgmaildotcom WebSite : www.greymen.org Greetz : Zuka, all friends & arab hackers / Vulnerability is in the $GET'catid' HOST/PATH/index.php?catid=8+union+all+select+1,2,3,4,5,6--...

DELTAScripts PHPLinks (catid) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================= DELTAScripts PHPLinks catid SQL Injection Vulnerability ========================================================= / Name : DELTAScripts PHPLinks Vuln : SQL Injection Author : Hamza...

DELTAScripts PHPLinks - 'catid' SQL Injection

/ Name : DELTAScripts PHPLinks Vuln : SQL Injection Author : Hamza 'MizoZ' N. Email : mizozxatgmaildotcom WebSite : www.greymen.org Greetz : Zuka, all friends & arab hackers / Vulnerability is in the $GET'catid' http://server/PATH/index.php?catid=8+union+all+select+1,2,3,4,5,6--...

phpBazar 2.1.1fix - cid SQL Injection

phpBazar 2.1.1fix - cid SQL Injection / Author : MizoZ from MA Group : EvilWay, evilwayatmaildotcom Email : mizozxatgmaildotcom Greetz : Zuka, Dyle !! MABROOK L3IIIIIIIIIID / The vulnerability is in the $GET'catid' , exploit :...

phpBazar <= 2.1.1fix (cid) SQL Injection

Exploit for unknown platform in category web applications ======================================== phpBazar = 2.1.1fix cid SQL Injection ======================================== The vulnerability is in the $GET'catid' , exploit :...

Sql injection

directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated $GET"s" variable from being unset. NOTE: it could be argued that this...

CVE-2009-3064

Directory traversal vulnerability in debugger/debugphp.php in Ve-EDIT 0.1.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the GETfilename parameter...

TinyWebGallery 1.7.6 Local File Inclusion

?php / ----------------------------------------------------------- TinyWebGallery = 1.7.6 LFI / Remote Code Execution Exploit ----------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....: http://www.tinywebgallery.com/ details..: this...

Cross site request forgery (csrf)

LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the administrator password via the setup "do" action to LightNEasy.php, which is cleared from $GET but later accessed using $REQUEST...

phpTest 0.6.3 (picture.php image_id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ======================================================================= phpTest 0.6.3 picture.php imageid Remote SQL Injection Vulnerability ======================================================================= Name : phpTest 0.6.3...

phpMyAdmin: SQL injection vulnerability

Background phpMyAdmin is a free web-based database administration tool. Description Richard Cunningham reported that phpMyAdmin uses the $REQUEST variable of $GET and $POST as a source for its parameters. Impact An attacker could entice a user to visit a malicious web application that sets an...