84 matches found
CVE-2017-9091
/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...
CVE-2017-9091: Improper Input Validation
/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...
PHP study notes and security vulnerabilities-vulnerability warning-the black bar safety net
System variables $POST // get the post data is a dictionary $GET // get get data, is a dictionary The error control operator PHP supports one error control operator:@the. When it is placed in a PHP expression, the expression may produce any error information is ignored. Variable default value Whe...
Mastery oa 2015 \inc\common.inc.php approve_finish function injection vulnerability
Recently made public measured when encountered on a system, The 2015 version of the latest update date: 2016-07-22 Injection the analysis \inc\common.inc.php ? php function SecureRequest&$var if isarray$var foreach $var as $k = $v $var$k = securerequest$v; else if 0 strlen$var &&...
Product Catalog 8 1.2 - Unauthenticated SQL Injection
$POST ‘selectedCategory’ is not escaped. UpdateCategoryList is accessible for any user. PoC...
HackerOne: Possible CSRF during external programs
Hello, at first i want to say that my report is the same of this report 148517 i see you accept it as a valid one so i reported this HackerOne allow users to Made external programs pages for programs the request i test will be The original Request POST /externalprograms HTTP/1.1 Host: hackerone.c...
Invision Power Board <= 2.3.5 - Remote SQL Injection Exploit
No description provided by source. ?php errorreportingEALL; /////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////// // IPB = 2.3.5 sql injection exploit // Version 1.0 // written by Janek Vind waraxe // Estoni...
IPB 3.0.1 - SQL Injection exploit
No description provided by source. ?php errorreportingEALL; /////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////// // IPB 3.0.1 sql injection exploit // Version 1.0 // written by Cryptovirus //...
Easytalk sql注入一枚
简要描述： 过滤不严。 详细说明： 在voteaction.class.php中 public function sendvote $vid=intval$POST'vid'; $votedata=$POST'votedata'; $isret=intval$POST'isret'; $isnone=intval$POST'isnone'; if $vid if isarray$votedata $vmodel=D'Votes'; $vopt=D'Voteoptions'; $vuser=D'Voteusers'; $myvote=$vuser-where"voteid='$vid' A...
shopex注册用户任意定义预存款余额或积分
简要描述： shopex在注册用户时存在验证不严，导致注册时可以随意定义预存款余额或积分等字段的内容 详细说明： 在文件\core\shop\controller\ctl.passport.php if !$info = $account-create$POST,$message $this-splash'failed','back',$message,'','',$POST'fromminipassport'; 用户注册的变量都保存在$POST中，继续看根目录文件index.php filterData$POST; require...
CKEditor 4.0.1 多个安全漏洞
CKEditor是一款在线文字编辑器 CKEditor存在多个安全漏洞，允许攻击者利用漏洞进行跨站请求伪造，跨站脚本攻击及获取路径信息 0 CKEditor 4.0.1 厂商解决方案 目前没有详细解决方案提供： http://ckeditor.com/ =========================================== Vulnerable Software: ckeditor 4.0.1 standard Download:...
PHPList 2.10.9 'Sajax.php' PHP代码注入漏洞
phplist是一个开源的newsletter管理软件，用PHP开发。 PHPList 'Sajax.php'不正确处理用户提交的数据，远程攻击者可以利用漏洞提交恶意代码，并以WEB权限执行。 0 PHPList 2.10.9 厂商解决方案 phplist ----- 目前没有详细解决方案提供： http://www.phplist.com/ --------------------------------------- This PoC was written for educational purpose. Use it at your own risk. Author will b...
Wordpress Plugin Email Before Download <=3.16 Blind SQL Inyection
Exploit for php platform in category web applications Wordpress Plugin: Email Before Download escape before using it. On line 120 File: /email-before-download/email-before-download.php we can see that: ===================================================================================== 120:...
Support Incident Tracker <= 3.65 (translate.php) Remote Code Execution Vulnerability
Support Incident Tracker = 3.65 translate.php Remote Code Execution Vulnerability author...............: Egidio Romano aka EgiX mail.................: n0b0d13satgmaildotcom software link........: http://sitracker.org/ affected versions....: from 3.45 to 3.65 - vulnerable code in /translate.php 23...
ilchClan 1.0.5 - 'regist.php' SQL Injection
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- / \ \ \ \ | | | / / / // |/ | ' \ \ \ // / | | | | | | / / / |||| || \ \ Security Flaw in ilch clan 1.0.5 a,b,c,d,e,f! in regist.php /...
IPB <= 2.3.5 Improved SQL Injection Exploit
Exploit for php platform in category web applications =========================================== IPB Attention!\n"; echo "br...
IPB <= 3.0.1 SQL Injection Exploit
Exploit for php platform in category web applications ================================== IPB Attention!\n"; echo "\n"; echo "Error!\n"; echo "This exploit is meant to be used as php CLI script!\n"; echo "Mo...
TinyWebGallery 1.7.6 Local File Inclusion
?php / ----------------------------------------------------------- TinyWebGallery = 1.7.6 LFI / Remote Code Execution Exploit ----------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....: http://www.tinywebgallery.com/ details..: this...
Invision Power Board <= 2.3.5 Remote SQL Injection Exploit
Exploit for unknown platform in category web applications ========================================================== Invision Power Board = 2.3.5 Remote SQL Injection Exploit ========================================================== ?php errorreportingEALL;...
phpMyAdmin: SQL injection vulnerability
Background phpMyAdmin is a free web-based database administration tool. Description Richard Cunningham reported that phpMyAdmin uses the $REQUEST variable of $GET and $POST as a source for its parameters. Impact An attacker could entice a user to visit a malicious web application that sets an...