BlueCMS v1.6 sp1 $_SERVER注射漏洞

BlueCMS是一个地方分类信息门户专用CMS系统。 程序在使用getip函数获取客户端ip时没有严格过滤数据，导致sql注射漏洞。 //comment.php $sql = "INSERT INTO ".table'comment'." comid, postid, userid, type, mood, content, pubdate, ip, ischeckVALUES '', '$id', '$userid', '$type', '$mood', '$content', '$timestamp', '".getip."', '$ischeck'"; // 注意getip...

BlueCMS v1.6 sp1 ad_js.php SQL注入漏洞

缺陷文件：adjs.php 漏洞成因： 12: $adid = !empty$GET'adid' ? trim$GET'adid' : ''; //根目录下其他文件都做了很好的过滤，对数字型变量几乎都用了intval做限制，唯独漏了这个文件，居然只是用了trim去除头尾空格。。 19: $ad = $db-getone"SELECT FROM ".table'ad'." WHERE adid =".$adid; //直接代入查询 BlueCMS v1.6 sp1 SEBUG临时解决办法： $adid = !empty$GET'adid' ? intval$GET'adid' : '';...

bluecms v1.0 图片上传绕过漏洞

BlueCMS地方分类信息门户专用CMS系统 include/upload.class.php发现，只是检测了文件头，没有检测后缀. ...... class upload private $allowimagetype = array'image/jpg', 'image/gif', 'image/png', 'image/pjpeg'; ...... function imgupload$file, $dir = '', $imgname = '' ifempty$dir $dir = BLUEROOT.DATA.UPLOAD.date"Ym"."/"; else $dir =...

bluecms 0day-vulnerability warning-the black bar safety net

Author: st0p Reprint please indicate the source: http://www.st0p.org Alas, the group where a friend made a CMS, that user information modification section there may be injected, that together with the analysis, the local after installation found, can not use the magicquotesgpc = off in the case,...