100 matches found
CVE-2018-10266
BEESCMS 4.0 is affected by a CSRF flaw that allows an attacker to add an administrator account via the admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user URI. The root cause is cross-site request forgery, enabling privilege elevation by creating a new admin account without authentication....
PT-2018-9796
Name of the Vulnerable Software and Affected Versions: BEESCMS version 4.0 Description: The issue allows for the addition of an administrator account without proper validation, potentially leading to unauthorized access. This is achieved through the "admin/admin admin.php?nav=list admin user&admi...
CVE-2018-10266: Cross-Site Request Forgery (CSRF)
BEESCMS 4.0 has a CSRF vulnerability to add an administrator account via the admin/adminadmin.php?nav=listadminuser&adminpnav=user URI...
BEESCMS V4.0_R_20160525全局变量覆盖导致前台getshell
...
Multiple Vulnerabilities in BEESCMS Version 4.0_R_20160525
BEESCMS is an enterprise website management system based on PHP+Mysql architecture. BEESCMS V4.0R20160525 version exists in the foreground global variable coverage, background login authentication bypass, background any file read, background any file modification vulnerability, attackers can use...
Arbitrary File Editing Vulnerability in BEESCMS Version v4.0
BEESCMS is an enterprise website management system based on PHP+Mysql architecture. BEESCMS v4.0 version of the existence of arbitrary file editing vulnerability, the vulnerability stems from the file path to modify the file and the content of the file to be written into the file are not filtered...
beescms 一处逻辑错误
No description provided by source...
beescms SQL注入漏洞
No description provided by source...
beescms4.0 一处任意文件上传漏洞#3
No description provided by source...
beescms4. 0 an arbitrary file upload vulnerability
No description provided by source...
beescms4.0两处 sql注入漏洞
No description provided by source...
Stored XSS Vulnerability in BEESCMS Enterprise Website Management System admin_book.php Backend
BEESCMS is an enterprise website management system. A stored XSS vulnerability exists in the 'adminbook.php' backend of BEESCMS. An attacker can exploit this vulnerability to implant cross-site script files and obtain sensitive information such as user cookies...
BEESCMS admin/admin_pic.php has an arbitrary file upload vulnerability
BEESCMS is a content management system. A file upload vulnerability exists in the BEESCMS admin/adminpic.php page, which allows attackers to exploit the vulnerability by modifying the filename suffix to php to upload webshell files...
BeesCMS _V4.0_R_20160525 SQL注射(突破全局防护)
后台登录处验证码设计缺陷漏洞 首先是后台登录页面/admin/login.php验证码形同虚设，一次验证后在不刷新的情况下可以多次提交请求。这就为这里的注入提供了前提条件。 SQL Injection 在admin/login.php中，登录处的核心代码是： php //判断登录 elseif$action=='cklogin' global $submit,$user,$password,$sys,$code; $submit=$POST'submit'; $user=flhtmlflvalue$POST'user';...
BEESCMS V4.0的文件member.php存在多处注入漏洞
No description provided by source...
Beescms V4.0 在文件mx_form.php处存在后台登陆绕过漏洞
No description provided by source...
BEESCMS 3.4 /admin.php 登录绕过漏洞
No description provided by source...
BEESCMS 3.3 /order_save.php SQL注入漏洞
No description provided by source...