The vulnerability of the Synergia operating system, related to errors in access control policies of SELinux, allows a perpetrator to gain access to view and copy files from the admin directory.

The vulnerability of the Synergia operating system is related to errors in access control policies set by SELinux. Exploiting this vulnerability could allow an attacker to gain read access to files located in the directory belonging to highly privileged users...

CVE-2020-22428

SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting XSS via a directory name entered by an admin containing a JavaScript payload...

SQL Injection Vulnerability in yycms Movie & TV System V2.3 Admin Catalog yy***_km***.php

yycms is a movie and television system. yycms film and television system V2.3 version admin directory yykm.php SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

SQL Injection Vulnerability in yycms Movie & TV System V2.3 Admin Catalog yy***_km***.php

yycms is a movie and television system. yycms film and television system V2.3 version admin directory yykm.php SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

SQL Injection Vulnerability in yycms Movie & TV System V2.3 Admin Directory yy***_li***_ed***.php File

yycms is a movie and television system. yycms film and television system V2.3 version admin directory yylied.php file SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

SQL Injection Vulnerability in yycms Movie & TV System V2.3 Admin Catalog yy***_ed***.php

yycms is a movie and television system. yycms film and television system V2.3 version admin directory yyed.php SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

SQL Injection Vulnerability in yycms Movie & TV System V2.3 Admin Catalog yy***_lm***_ad***.php

yycms is a movie and television system. yycms film and television system V2.3 version admin directory yylmad.php SQL injection vulnerability, an attacker can use the vulnerability to obtain sensitive database information...

Directory traversal

admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory...

Publisure Improper Access Control Vulnerability

Publisure is an integrated multi-channel communications platform for outbound communications. An improper access control vulnerability exists in the servletcontroller in the secure portal of Publisure 2.1.2, which can be exploited by an attacker to bypass authentication and execute queries agains...

CVE-2019-14253

An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and perform a query on PHP forms within the /AdminDir folder that should be restricted...

Design/Logic Flaw

If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory as recommended in the "Post-installation and upgrade tasks" section of the MantisBT Admin Guide, and the MySQL client has a localinfile setting enabled in php.ini...

CVE-2017-12419

CVE-2017-12419 affects MantisBT up to version 2.5.2 installed on MySQL/MariaDB. If the admin leaves the admin directory in place and the MySQL client has local_infile enabled (via php.ini mysqli.allow_local_infile or client config), an attacker can leverage MySQL facial connect-file-read to remot...

PHPMyFAQ 1.5.1 Password.PHP SQL Injection Vulnerabililty

No description provided by source. source: http://www.securityfocus.com/bid/14927/info phpMyFAQ is affected by an SQL injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input before using it in a SQL query. This vulnerability could permit remo...

Qualiteam X-Cart 3.x Multiple Remote Information Disclosure Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/9563/info X-Cart has been reported to be prone to an issue that may allow remote attackers to view any web server readable files on the affected system. The issue is caused by a failure of the application to sanitize valu...

multi-lingual e-commerce system 0.2 - Multiple Vulnerabilities

No description provided by source. Salvatore drosophila Fresta + Application: Multi-lingual E-Commerce System + Version: 0.2 + Website: http://sourceforge.net/projects/mlecsphp/ + Bugs: A Local File Inclusion B Information Disclosure C Arbitrary File Upload + Exploitation: Remote + Date: 19 Apr...

Cosmoshop pwd.cgi htaccess Creation

Author: l0om http://l0om.org Date: 10.03.2014 Overview: Cosmoshop is installed with a lot of admin scripts which should be only accessible as the logged-in admin. The script "pwd.cgi" is not protected and will create a .htaccess file for the admin-directory with any content. This may lead to...

Thinksaas v2.1 2枚注入。

简要描述： 依旧过滤不严。 详细说明： 这次写两个把。。 - - 这两个同一文件的 哈哈。 依旧是越权。 \app\group\action\admin\group.php 无需管理 只需要一个前台注册账户就能访问。 真正的管理后台在\app\system\action\ 但是为毛这admin目录下的文件都能做很多事? 注入第一枚。 case "adddo": $userid = intval$POST'userid'; $strUser = $db-oncefetchassoc"select from ".dbprefix."userinfo where...

phpshe 本地文件包含导致越权触发多个漏洞

简要描述： phpshe 本地文件包含导致越权触发多个漏洞 详细说明： index.php $cachead = cache::get'ad'; $cachelink = cache::get'link'; $cachepage = cache::get'page'; $webqq = $cachesetting'webqq''settingvalue' ? explode',', $cachesetting'webqq''settingvalue' : array; $cartnum = pelogin'user' ? $db-penum'cart',...

Search for a cms with php through the kill-vulnerability warning-the black bar safety net

Author: z2681 From: 90sec Vulnerability files to the admin directory adminloginstate.php Look at the code ifempty$COOKIE'SAdminID' echo "scriptwindow. location='adminlogin.php'/script"; exit; elseif$COOKIE'SLogin'!= md5$COOKIE'SAdminID'.$ COOKIE'SAdminUserName'.$ COOKIE'SAdminPassWord'.$...

Traq 'authenticate()'函数远程代码执行漏洞

Bugtraq ID: 50961 Traq是一款基于PHP/MySQL的项目管理软件 定义在/admincp/common.php中的authenticate函数存在错误： 27. function authenticate 28. 29. global $user; 30. 31. if!$user-group'isadmin' 32. header"Location: login.php"; 33...