Arbitrary file deletion

Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...

WordPress Active Directory Integration plugin <=1.1.8 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Lenon Leite in WordPress Active Directory Integration plugin versions = 1.1.8. The plugin is vulnerable due to unescaped $GET‘userid’. Solution 11/20/2017 - we were unable to find a patched version of this plugin...

Link-Library <= 5.9.13.26 – Authenticated SQL Injection

Type user access: admin user. $GET‘linkid’ is not escaped. PoC http://localhost:8080/wp-admin/admin.php?page=link-library=1=1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,CONCATuserlogin,char58,userpass,17,18,19,20,21,22,23,24,25,26+FROM+wpusers+WHERE+ID=1...

Pluck CMS 4.7.4 Cross Site Request Forgery

============================================== Exploit Title : pluck-cms vulnerability CSRF Reported Date : 8 - 10 - 2017 Exploit Author : Ashiyane Digital Security Team CWE: CSRF - 352 Tested On : kali Linux Vendor Homepage : https://www.pluck-cms.org/ Software Link :...

SQL Injection

Subrion is vulnerable to SQL Injection attacks. The library does not have any checking for user input through the $GET parameter in /front/search.php, allowing a malicious user to inject and execute arbitrary SQL...

Sql injection

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $GET array...

CVE-2017-11418

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlelist.php via $GET'cat', $GET'user', $GET'level', and $GET'iSortCol'.$i...

CVE-2017-11417

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlestatus.php via $GET'id'...

Sql injection

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/controller/commentstatus.php via $GET'id'...

CVE-2017-11413

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/commentstatus.php via $GET'id'...

CVE-2017-11418

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlelist.php via $GET'cat', $GET'user', $GET'level', and $GET'iSortCol'.$i...

CVE-2017-11417

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlestatus.php via $GET'id'...

CVE-2017-11412

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/controller/commentstatus.php via $GET'id'...

CVE-2017-11413

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/commentstatus.php via $GET'id'...

PHP study notes and security vulnerabilities-vulnerability warning-the black bar safety net

System variables $POST // get the post data is a dictionary $GET // get get data, is a dictionary The error control operator PHP supports one error control operator:@the. When it is placed in a PHP expression, the expression may produce any error information is ignored. Variable default value Whe...

Mastery oa 2015 \inc\common.inc.php approve_finish function injection vulnerability

Recently made public measured when encountered on a system, The 2015 version of the latest update date: 2016-07-22 Injection the analysis \inc\common.inc.php ? php function SecureRequest&$var if isarray$var foreach $var as $k = $v $var$k = securerequest$v; else if 0 strlen$var &&...

mao10cms文件包含漏洞（有条件）

简要描述： mao10cms有条件的文件包含漏洞 详细说明： 1.mao10cms采用了mysqli的数据库操作方式，而且所有的数据库操作都是参数绑定的，蛋疼。只有来看一个有条件的文件包含漏洞了。漏洞文件index.php $act; else : require "gdb.php"; endif; 2.这里的$GET'm'直接传入了require，二没有经过过滤，那么就可以考虑截断的文件包含。两种方式，一种是%00，一种是超长文件。两种都有条件，大家懂得。这里以%00为例，注册一个用户，上传一张图片马 然后下面可以获取到图片的路径，直接进行包含...

SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-014/...

ROCBOSS 1.1 /module/user.module.class.php SQL注入漏洞

漏洞文件： \module\user.module.class.php 第11行代码： $userInfo=Common::getMemberInfo$this-db,isnumeric$userId ? 'uid' : 'nickname', $userId; 这一行代码进行了数据库查询，关键之处在$userId这个变量上 向上回溯到第10行代码： $userId=isset$GET'id' && trim$GET'id' != '' ? $GET'id' : $this-loginInfo'uid'; 当$GET‘id’被赋值的时候这个参数就能控制了，而且没有进行过滤。...

phpBazar <= 2.1.1fix (cid) SQL Injection

No description provided by source. / Author : MizoZ from MA Group : EvilWay, evilwayatmaildotcom Email : mizozxatgmaildotcom Greetz : Zuka, Dyle !! MABROOK L3IIIIIIIIIID / The vulnerability is in the $GET'catid' , exploit :...