41 matches found
PT-2019-14752
Name of the Vulnerable Software and Affected Versions pfSense version 2.4.4-p3 Description The issue allows for CSRF, potentially enabling the execution of OS commands. This is demonstrated through the txtCommand or txtRecallBuffer field in the diag command.php file. The csrf callback function is...
PT-2019-13047
Name of the Vulnerable Software and Affected Versions pfSense versions 2.4.4-p2 through 2.4.4-p3 Description The issue allows an attacker to leverage XSS to upload arbitrary executable code to a server if an authenticated administrator can be tricked into clicking on a button on a phishing page...
Zemra Botnet CnC Web Panel Remote Code Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Zemra Botnet CnC Web Panel Remote Code Execution', 'Description' = %q This module exploits the CnC web panel of Zemra Botnet which...
D-Link DIR600 /command.php 命令执行漏洞
No description provided by source...
espcms最新版本CSRF直接getshell
简要描述： espcms 最新版本csrf 直接getshell 详细说明： 这里我们首先看看，存在的代码问题 management.php:lines:711-741: function onsetsave $dbtable = dbprefix . 'config'; $commandfile = adminROOT . 'datacache/command.php'; if !$this-fun-filemode$commandfile exit'false'; $oldishtml = $this-CON'ishtml'; $sql = 'SELECT FROM '...
SiteBar <= 3.3.8 command.php Modify User Action uid Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/26126/info SiteBar is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input. These issues include: - A local file-include vulnerability - Multiple...
espcms Command Execution Vulnerability可getshell（鸡肋）
简要描述： RT 详细说明： 在后台getshell，略鸡肋 在/datacache/command.php文件 $CONFIG=Array //ICP备案 'icpbeian'='', //网站状态 'isclose'=0, //管理员Email 'adminemail'='[email protected]', //网站网址 'domain'='http://localhost/espcms/', //日志记录 'islog'=1, ………… 后台修改网站系统设置后可将代码写入command.php中 访问command.php并传参...
D-Link Devices Unauthenticated Remote Command Execution
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'D-Link Devices Unauthenticated Remote...
Debian Security Advisory DSA 1423-1 (sitebar)
The remote host is missing an update to sitebar announced via advisory DSA 1423-1. OpenVAS Vulnerability Test $Id: deb14231.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1423-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...
Open redirect
Open redirect vulnerability in command.php in SiteBar 3.3.8 allows remote attackers to redirect users to arbitrary web sites via a URL in the forward parameter in a Log In action...
CVE-2007-5695
Open redirect vulnerability in command.php in SiteBar 3.3.8 allows remote attackers to redirect users to arbitrary web sites via a URL in the forward parameter in a Log In action...
CVE-2007-5695
CVE-2007-5695 is a real issue in SiteBar 3.3.x where an error in command.php allows remote attackers to redirect users to arbitrary websites via the forward parameter in a Log In action. Public sources (Debian, Gentoo GLSA, and OpenVAS) corroborate a family of related sitebar vulnerabilities, wit...
CVE-2007-5692
Multiple cross-site scripting XSS vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web script or HTML via 1 the lang parameter to integrator.php; 2 the token parameter in a New Password action, 3 the nidacl parameter in a Folder Properties action, or 4 the uid parameter...
CVE-2007-5695: Improper Link Resolution Before File Access
Open redirect vulnerability in command.php in SiteBar 3.3.8 allows remote attackers to redirect users to arbitrary web sites via a URL in the forward parameter in a Log In action...
CVE-2007-5692: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web script or HTML via 1 the lang parameter to integrator.php; 2 the token parameter in a New Password action, 3 the nidacl parameter in a Folder Properties action, or 4 the uid parameter...
SiteBar 3.3.8 - command.php?Modify User Action uid Cross-Site Scripting
SiteBar 3.3.8 - command.php?Modify User Action uid Cross-Site Scripting source: https://www.securityfocus.com/bid/26126/info SiteBar is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input. These issues include: - A local file-include...
BCWB 0.99 - 'ROOT_PATH' Remote File Inclusion
Title : Bcwb 0.99rootpathRemote File Include Vulnerability Author : ajann Greetz : shadow and Suskun for host : Exploit; File startup.inc.php /File Code,1 startup.inc.php Error: .. .... // Debug services include$rootpath.'include/startup/debug.inc.php';...
Digital WebShop 1.128 - Multiple Remote File Inclusions
Title : Digital WebShop = v1.128 Multiple Remote File Include Vulnerabilities Author : ajann Script Page : http://digitalwebshop.dyndns.org Exploit; Files rechnung.php prepend.php /Files Code,1 prepend.php Error: // include Werzeuge .. .... requireonce$PHPLIB"libdir" . "phpDB-mysql.lib"; / Mysql...
