Bo-Blog 2.1.1 Cross Site Scripting / SQL Injection

Exploit Title : Bo-Blog 2.1.1 Multiple Vulnerabilites Exploit Author : Ashiyane Digital Security Team Official site : http://www.bo-blog.com/ Tested on: Windows,Linux /////////////////////////////////////////////// Google Dork : intext:"Powered by Bo-Blog 2.1.1"...

Bo-Blog 2.1.1 - Cross-Site Scripting SQL Injection

Bo-Blog 2.1.1 - Cross-Site Scripting SQL Injection source: https://www.securityfocus.com/bid/61880/info Bo-Blog is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to...

Bo-Blog 2.1.1 - Cross-Site Scripting / SQL Injection

source: https://www.securityfocus.com/bid/61880/info Bo-Blog is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary code in the context of the browser,...

Qi Bo cms back-end database tool at the filter is not strictly the actuator can be written in a word-vulnerability and early warning-the black bar safety net

If your account password is leaked then you're in danger. in the background can directly get a webshell The background for the convenience of webmasters to have a database tool where the implementation Select '%execute request"value"%' into outfile 'F:/wwwroot/shiyanshi/cache/1.asp'; Just write t...

Qi Bo CMS background get shell-vulnerability warning-the black bar safety net

Brief description: Background get the shell Detailed description: ! ! ! ! Vulnerability to prove: ! Repair solutions: You know...

Qi Bo CMS know that the system injection vulnerability-vulnerability warning-the black bar safety net

php168 know the system injection vulnerability Ps:inadvertently come I'm finishing up the three keywords inurl:zhidao Powered by qibosoft inurl:w8 Powered by qibosoft inurl:ask Powered by qibosoft...

bo-blog xss vulnerability-vulnerability warning-the black bar safety net

Bo-Blog is an domestic excellent open source blogging, wordpress and other blog Bo-Blog the advantage of easy to use, convenient, efficiency is high. If wordpress is the professional blogging program so Bo-blog is a civilian blog. Bo-blog The advantages and disadvantages are obvious, the...

Bo-Blog tag.php跨站漏洞

tag.php中的mode变量过滤不严，导致xss存在 攻击者可窃取用户cookie或者构造CSRF。 0 Bo-Blog 2.1.1 inc/modtag.php里的第61行 acceptrequest'mode'; 之后，加上 $mode = intval$mode;...

Qi Bo cms website system is improperly configured to cause the arbitrary user login vulnerability-vulnerability warning-the black bar safety net

Vulnerability type: unauthorized access/permissions bypass Brief description: Qi Bo cms whole Station system of the original PHP168 configured improperly cause any user login, such as the cms administrator. Detailed description: Or due to UCCENTER the problem, before it is too UCKEY variable is...

Will Bo CMS(JumboTCMS)_V6 code audit summary-vulnerability warning-the black bar safety net

Author: Seay Blog: http://seay.sinaapp.com/ I learn software testing Professional, the most recent school to prepare for this aspect of the course, so want to find a set ASP. NET open source CMS play, Baidu the next, saw the Bo CMS, popularity is also quite high, went to the official website to...

US-based website covering China's Bo Xilai scandal hacked

US-based website covering China's Bo Xilai scandal hacked A US-based website that has reported extensively on the Bo Xilai scandal in Chongqing says it has been crippled by a concerted hacker attack. The site was rendered inaccessible for much of Thursday, depriving readers of coverage of the...

Will Bo CMS Powered by JumbotCms vulnerability-vulnerability warning-the black bar safety net

Due to the working relationship between the detection of a station when found his URL more special with a cmsfile directory; swept under the directory find a fck because the version is relatively low, you can traverse the directory Baidu it is not human hair, it made it relatively lower...

Bo-Blog 2.1.0 go.php 文件包含漏洞

No description provided by source...

An anti-injection of a noob error-thousand Bo enterprise program-vulnerability warning-the black bar safety net

Thousand Bo enterprise Station program, anti-injected into the statement where there is a little error! Detail: If EnableStopInjection = True Then If Request. QueryString "" Then Call StopInjectionRequest. QueryString If Request. Cookies "" Then Call StopInjectionRequest. Cookies If Request...

Bo-Blog 2.1.0 remote code execution exploit

No description provided by source...

Thousand Bo cms map leads to the background and editor storm drain-vulnerability warning-the black bar safety net

Brief description: Three Ming network Technology Co., Ltd. do full is thousands of Bo CMS open source, AdminSiteMap. asp files are not filtered background address and lead to vulnerabilities Detailed description: The site is thousands of Bo CMS open source, because there is no set AdminSiteMap. a...

Bo-Blog v1.4 单用户版分类列表文件读取漏洞

Bo-Blog 是一款基於PHP的、以MySQL為資料庫支持的免費blog程式 在文件“blog.php”中，功能“分类列表”。 参数“cat=”没有经过任何处理，直接使用“$allfiles=@file"$dirblog/$cat.php";”读文件。 导致如果提交文件名，那么就会直接读取该文件处理输出。 if $job=="showcat" //列出某个分类下所有entries if !fileexists"$dirblog/$cat.php" wronginfo"没有找到这个分类。"; unset $allfiles;...

Thousand Bo enterprise website management system(NWEB System)background holding shell-vulnerability warning-the black bar safety net

Management log in:/system/adminlogin. asp 'Management account: admin 'Key code: admin888 ' 'Site data:/Database/NwebCnSite. mdb conventional content database '/Database/BakNwebCnSite. mdb backup the content database '/Database/NwebCnStat. mdb conventional flow database '/Database/BakNwebCnStat. m...

Qi Bo CMS whole Station system V7. 0 0day latest vulnerability-vulnerability warning-the black bar safety net

The first environment is IIS6. 0. Vulnerability test: http://www.xxx.com/ewebeditor/ckfinder/ckfinder.html?Type=Images&CKEditor=content1&CKEditorFuncNum=1&langCode=zh-cn Registered user, to the Management Center, published articles, CKFINDER upload your know how! After uploading the path is:...

Bo-blog v2.1.1 注入漏洞

inc/modmain.php //漏洞文件： case 'category': if !$job $job='default'; else $job=basename$job; $ifannouncement="none"; acceptrequest'mode'; if $mode==1 || $mode==2 //.......................... elseif !empty$mode && !isnumeric$mode || $mode2 getHttp404$lnc313; //...................... if isnumeric$item...