PHPMyWind后台管理界面的SQL注入漏洞

简要描述： 后台管理界面因为过滤不严格导致SQL注入漏洞，可以使权限较低的管理员取得较高权限，以及获取并修改超级管理员的用户名密码。 详细说明： 存在问题的代码，adminsave.php 59-101行，SQL语句中的$id存在注入 else if$action == 'update' //创始人账号不允许更改状态 if$id == 1 and $checkadmin != 'true' or $levelname != '1' ShowMsg'抱歉，不能更改创始账号状态！','-1'; exit; //只有超级管理员才有权修改超级管理员 if$cfgadminlevel 1 and...

Ubuntu 12.04 LTS : linux-lts-quantal vulnerability (USN-2269-1)

Andy Lutomirski discovered a flaw with the Linux kernel's ptrace syscall on x8664 processors. An attacker could exploit this flaw to cause a denial of service System Crash or potential gain administrative privileges. Note that Tenable Network Security has extracted the preceding description block...

Digital Scribe 1.4 Login SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14843/info Digital Scribe is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation cou...

Oracle Database Server <= 10.1.0.2 - Buffer Overflow Exploit

No description provided by source. / Advanced SQL Injection in Oracle databases Exploit for the buffer overflow vulnerability in procedure MDSYS.MD2.SDOCODESIZE of Oracle Database Server version 10.1.0.2 under Windows 2000 Server SP4. Fixes available at http://metalink.oracle.com. The exploit...

CuteNews 1.4.6 editnews Module doeditnews Action Admin Moderation Bypass

No description provided by source. source: http://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that...

Cobbler 2.4.x - 2.6.x 本地文件包含

Cobbler是一个自动化管理和系统安装工具，安装过程中会配置授权和身份验证。 该软件并不对普通用户开放，而触发漏洞需要管理员。 并且，触发漏洞需要管理员主动添加如'/etc/passwd'的文件项目，然后进行项目查看才能读取任意文件。 0 2.4.x - 2.6.x 更新到最新版本...

PHPOK CSRF获取管理员权限

简要描述： PHPOK CSRF获取管理员权限 详细说明： PHPOK CSRF获取管理员权限 漏洞证明： 测试环境（PHPOK）： 添加用户： 抓包抓到如下内容： None 打开POC页面前： 打开后： 为此添加管理员成功。。。 理论上是通杀所有版本的。。。...

Project description is persistent XSS vector for project admins

This issue is a clone of another one that was fixed in OD but left unfixed in BTF as "admin xss". It has been pointed out by several customers that this exploit requires only project admin level of privilege. The following project description: code alert1 code Pops up in the view project page, th...

CVE-2013-3929

Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...

UBUNTU-CVE-2013-6382

Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging the CAPSYSADMIN capability for a 1 XFSIOCATTRLISTBYHANDLE or 2 XFSIOCATTRLISTBYHANDLE32...

JEECMS 逻辑和跨站再来四五发

简要描述： 再折磨最后一次，JEECMS中最郁闷的就是展现层用的freemarker，就算传了jsp也没法解析。JEEBBS和JEECMS的前台功能还算简单，偷个cookie跑台没法穿越改xml或者读tom猫密码或者系统配置不存在敏感信息还是不是那么容易拿到webshell的。刚又看了下能够读写配置的地方已经加上了StartWith判断了。如果能把逻辑漏洞和跨站什么的都解决了就完美了。 详细说明： 1、邮箱的两处没有验证xss 一处是注册，之前JEEBBS已经提过了，一处是修改密码那里。 直接用官方的demo站演示： 2、个人资料全部xss 依旧用demo站演示...

C.P.Sub 4.5 - Authentication Bypass

C.P.Sub 4.5 - Authentication Bypass !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: ...

C.P.Sub 4.5 - Authentication Bypass

!/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: = v4.5 Tested on: Windows 7 Improper...

C.P.Sub 4.5 Privilege Escalation Exploit

C.P.Sub versions 4.5 and below allows for administrative access escalation by the simple tweak of a user-supplied parameter. !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage:...

Foreman: app/controllers/users_controller.rb arbitrary admin user creation due to mass assignment

The create method in app/controllers/userscontroller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by 1 changing the admin flag or 2 assigning an arbitrary role...

espcms后台getshell-3，并可利用csrf交互强制管理员getshell

简要描述： 详细说明： 后台修改模板处未过滤，可在模板中插入php代码（此处方便演示，使用了phpinfo 本来，一个后台getshell的危害应该属于较低的，因为需要管理员权限。但是，espcms后台操作无token，通过csrf的交互，就可以强迫管理员干很多事。修改模板为shell的包如下： 无token，所以可以通过一个自动提交表单给管理员点击，然后就会自动getshell了。（此处主要是后台getshell，csrf就不再说了，详细的POC可以查看我以前提交的一些漏洞） 漏洞证明：...

WordPress Plugin User Role Editor 3.12 - Cross-Site Request Forgery

WordPress Plugin User Role Editor 3.12 - Cross-Site Request Forgery Exploit Title: WP User Role Editor CSRF Date: 19/5/13 Exploit Author: Henry Hoggard Author Website: http://henryhoggard.co.uk Vendor Homepage:https://wordpress.org/support/plugin/user-role-editor Software...

ecshop最新2.7.3后台可注射提权

简要描述： ecshop最新2.7.3后台低权限用户登录以后可进行注射提权 详细说明： 问题出在admin/shopinfo.php的108行 if $REQUEST'act' == 'edit' / 权限判断 / adminpriv'shopinfomanage'; / 取得文章数据 / $sql = "SELECT articleid, title, content FROM ".$ecs-table'article'."WHERE articleid =".$REQUEST'id'; $article = $db-GetRow$sql; id没有过滤直接进行查询，构造语句...

Simple Machine Forum 2.0.x 2.0.4 - File Disclosure Directory Traversal

Simple Machine Forum 2.0.x 2.0.4 - File Disclosure Directory Traversal Exploit Title: SMF /index.php?action=admin;area=logs;sa=errorlog;file=BASE64 ENCODED FILE PATH;line=LINE NUMBER Example : /srv/www/smf/Settings.php : L3Nydi93d3cvc21mL1NldHRpbmdzLnBocA= /etc/passwd : L2V0Yy9wYXNzd2Q= SMF...

CVE-2011-4961

SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDITPERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups...