Arbitrary User Registration Vulnerability in Secure Browser of Qihoo 360 Technology Co.

360 Safe Browser has the leading malicious URL database in China, and adopts the cloud checking engine, which can automatically block the malicious URLs such as horse mounting, fraud, Internet banking imitation, etc. The unique "quarantine mode" allows users to visit the Trojan website without...

cmseasy 最新版补丁绕过sql注入（绕过360waf）

简要描述： 继续绕啊绕啊 详细说明： 首先还是老地方：archiveact.php611行） function respondaction includeonce ROOT . '/lib/plugins/pay/' . front::$get'code' . '.php'; $payclassname = front::$get'code'; $payobj = new $payclassname; $uri = $SERVER"REQUESTURI"; $uriget = strstr$uri, '?'; $uriget = strreplace'?', '', $uriget;...

PHPYUN multiple SQL injection and rapid positioning disregard 3 6 0 defense-a vulnerability warning-the black bar safety net

Other local estimates are little friends are digging done, we see not often is attention of place In the QQ log in here qqconnect. class. php file We take a look qq landing, will bind the qq of the relevant information: code area function qqbindaction if$GET'usertype'=='1' || $GET'usertype'=='2' ...

360 Cloud Service Detection

Binary data 8415.prm...

cmseasy 框架注入可通过swf文件进行xss 跨后台也可绕过360直接xss

简要描述： cmseasy 框架注入 可通过swf文件进行xss 跨后台 也可绕过360 直接xss 详细说明： 直接进入注册页面，然后发送数据包 url: http://192.168.10.70/CmsEasy5.5UTF-820140818/uploads/index.php?case=user&act=register postdata:...

php云人才系统多处Xss漏洞（绕过360防护）

简要描述： php云人才系统多处Xss漏洞（绕过360），可影响后台及其他用户。 360防护挂掉了，这该怎么办。。 详细说明： 虽然php云人才系统里加入360防注入脚本，对于一般的xss都可以过滤 但是我意外的发现了一种绕过方法，从而对多处产生xss影响 先说下绕过方法 肯定是过不了的，但是就可以了 至于这个%20加哪就随意了，总之就是不要使句子完整出现，这样可以绕过360，然后是数据提交后，会变回，从而绕过。 可以利用的xss地方很多 凡是有编辑器，源码模式下直接插入就行 以官网demo为例子，除了上述地方可以插入xss代码外，在http://www.hr135.com/friend...

Maccms V8 储存型xss（绕过360防护）

简要描述： rt 详细说明： 自带的360防护脚本对于xss过滤太弱， 留言处没有 对html代码进行实体转义，造成xss。 如，提交 "onerror="eval'\141\154\145\162\164\50\61\51'" 后台查看留言即可触发 加载远程js可偷cookie 漏洞证明：...

Phpyun注入一枚绕过360注射附exp

简要描述： 可以引入单引号, 但是在这里也不需要引入单引号。 虽然有360 但是还是能注入出密码。 写了个小脚本来跑。（代码很渣 速度很慢 但是还是能跑完整） - - 特么的完全不会写, 太渣了。 详细说明： 在model/register.class.php中。 function ajaxregaction $post = arraykeys$POST; $keyname = $post0; if$keyname=="username" $username=@iconv"utf-8","gbk",$POST'username';...

phpyun绕过360艰难的SQL注射

简要描述： 想在PHP云里进行一次SQL注射，真的是好难。 详细说明： 我首先发现了一个SQL注射，这个过程也不轻松。 在phpyun/model/class/action.class.php中 function getadminusershell if$SESSION'auid' && $SESSION'ashell' $row=$this-admingetusershell$SESSION'auid',$SESSION'ashell'; if!$row$this-logout;echo "无权操作！";die; if$GET'm'=="" || $GET'm'=="index" ||...

Qihoo 360 Security Guard breg device drivers Privilege Escalation Vulnerability

No description provided by source. / Software Link: http://sd.360.cn/sddownload1.html?src=360home Version: 6.1.5.1009 Tested on: Windows xp Vendor : Qihoo 360 Affected Software : 360 Security Guard 6.1.5.1009 Description: Qihoo 360 Security Guard is very famous in China. Some vulnerabilities have...

苹果CMS绕过检测SQL注入，第四发（绕过360防护）

简要描述： 原来我之前说的那些都成废话了，厂商没有看懂，囧～，看回复把过错归结于360safe3.php，不再发了，总结下原因。 详细说明： index.php: $m = be'get','m'; ifstrpos$m,'.' $m = substr$m,0,strpos$m,'.'; $par = explode'-',$m; $parlen = count$par; $ac = $par0; ifempty$ac $ac='vod'; $method='index'; $colnum = array"id","pg","yaer","typeid","classid";...

Ubisoft Rayman Legends 1.2.103716 - Remote Stack Buffer Overflow (PoC)

!/usr/bin/perl Ubisoft Rayman Legends v1.2.103716 Remote Stack Buffer Overflow Vulnerability Vendor: Ubisoft Entertainment S.A. Product web page: http://www.ubi.com Affected version: 1.2.103716, 1.1.100477 and 1.0.95278 Summary: Rayman Legends is a 2013 platform game developed by Ubisoft...

Ubisoft Rayman Legends 1.2.103716 Buffer Overflow

!/usr/bin/perl Ubisoft Rayman Legends v1.2.103716 Remote Stack Buffer Overflow Vulnerability Vendor: Ubisoft Entertainment S.A. Product web page: http://www.ubi.com Affected version: 1.2.103716, 1.1.100477 and 1.0.95278 Summary: Rayman Legends is a 2013 platform game developed by Ubisoft...

Maccms V8 后台Getshell #2（绕过过滤）

简要描述： 现在 V8版本 基本全部文件都有zend加密了。 而且还有360safe3.php保护 刚开始以为没搞头的，结果有个妹子发来微信。 妹子：在干嘛？ 我：挖洞 妹子：一个人挖？ 我：对啊！ 妹子：我过去陪你一起挖吧！ 我马上关机。擦，想跟老子抢乌云币？果断一个人作死开挖 详细说明： 注意下，这里@农村教师 WooYun: 苹果CMS全版本getshell打包第一弹 之前提交过类似的后台getshell，但是修补了。。。 不废话，直接可耻的绕过它 1. 目录浏览 maccms后台有个接口，但是限制了，只能访问目录template里的文件...

Shellcodeexec execution shellcode-exploit warning-the black bar safety net

shellcodeexec.x32.exe a Can on windows execute shellcode tools, the use of this feature, you can also use it to execute contained malicious code shellcode, so as to achieve the invasion's purpose. shellcodeexec. x32. exe this tool can to https://github. com/inquisb/shellcodeexec. This website...

3 6 0 safety guard is closed vulnerability analysis-vulnerability warning-the black bar safety net

3 6 0 safety guard is closed the vulnerability analysis and testing environment for 3 6 0 security guards 9. 0, the latest version of Security Defender has to fix this vulnerability Phenomenon A Trojan can shut down 3 6 0 security guards, through reverse analysis found that the Trojan horse just...

CVE-2014-2536

Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On MCSSO before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator passwo...

CVE-2014-2536

CVE-2014-2536 affects McAfee Cloud Identity Manager 3.0/3.1/3.5.1, McAfee Cloud Single Sign On (MCSSO) before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1/2.5. The vulnerability is a directory traversal that allows remote authenticated users to read an unspecified file containing a hash o...

Then talk about DNS hijacking and other malicious acts-vulnerability warning-the black bar safety net

The past two years2012-2013, the 3 6 0 navigationhttp://hao.360.cncome into contact with a large number of hijacking cases. First by hijacking the effect and purpose is divided into the following 2 categories: jump hijack that user access 3 6 0 navigation, is forced to jump to other...

MacCMS 全版本通杀SQL注射（包括最新7.x）

简要描述： 之前我发了个6.x的注射，没人认领，因此这次想找cncert了 本次针对官网最新7.7版本的maccms测试，和之前的6.x注射有一些差异（重构了代码，而且用了360给的防护脚本） 结合之前无人认领的旧版注射，可以达到全版本注射 危害不言而喻了吧 详细说明： /user/index.php line:615 function tg //推广功能，吐槽一下之前6.x版本用的英文popularize，这就变拼音了 global $db; $userid = be"get","uid"; $userid=chkSql$userid,true; //完全不可控 if...