PT-2017-3601

Name of the Vulnerable Software and Affected Versions: ClipBucket versions prior to 4.0.0 Release 4902 Description: The issue is related to the lack of proper neutralization of special elements used in OS commands. This allows an attacker to inject any OS commands via shell metacharacters in the...

PHPAPP网站应用系统SQL注入1

简要描述： PHPAPP 全球领先的网站应用系统。 PHPAPP 全球网站应用的开创者,独创系统核心长期提供丰富网站应用程序,专为站长企业打造盈利应用。 详细说明： 第一个漏洞： PHPAPP网站应用系统官方最新版SQL注入 程序官网：http://www.phpapp.cn/index.html 在文件/api/chinabank/receive.php中： SetPayMoney$void,$vamount,'ChinaBank'; else $pay-PayError; else $pay-PayError; ? 从上面看出：...

phpcms v9 latest burst pipe processing password vulnerability-vulnerability warning-the black bar safety net

Vulnerability causes is not to say, 文件在phpcms/api.php interested basin friends can go dig a dig phpcms the 洞子 it. The main use of the process: The first step: to register a user http://www.wooyun.in/index.php?m=member&c=index&a=register&siteid=1 Second step: access the api file, broke the table...

ECShop 2.7.2 API 盲注漏洞

简要描述： 该漏洞已经过本人测试存在。在服务器关闭魔法引号的情况下可以盲注，不受ECShop内核过滤影响。这次不坑爹了 问题文件在/api/client/api.php 利用方法为POST 详细说明： /api/client/api.php 第7行 dispatch$POST; /api/client/includes/libapi.php 6 -10 行 $funcarr = array'GetDomain', 'UserLogin', 'AddCategory', 'AddBrand', 'AddGoods', 'GetCategory', 'GetBrand', 'GetGoods...

Fedora 10 : drupal-6.14-1.fc10 (2009-9751)

Fixes SA-CORE-2009-008 http://drupal.org/node/579482 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script. Multiple vulnerabilities and weaknesses were discovered in Drupal...