Simple e-document 1.31登录绕过漏洞

No description provided by source. 1 Sql Injection on username field PoC: username=-4731' OR 2708=2708 Burp output POST /simpleedocumentv131/login.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux i686; rv:22.0 Gecko/20100101 Firefox/22.0 Iceweasel/22.0 Accept:...

Easy POS System SQL注入漏洞

No description provided by source. 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You might use ‘sqlmap -l’ to load it though. PoC: POST /login.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux i686; rv:22.0...

Easy POS System - 'login.php' SQL Injection

Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You...

Easy POS System - SQL Injection Vulnerability

Exploit for php platform in category web applications + Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on...

Easy POS System - login.php SQL Injection

Easy POS System - login.php SQL Injection + Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST reques...

Simple E-document 1.31 - Authentication Bypass

Exploit: Simple e-document v1.31 Login Bypass + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777sec + version: Simple e-document v1.31 + Vendor Homepage: http://sourceforge.net/projects/simplee-doc/files/ 1 Sql Injection on username field PoC: username=-4731' OR 2708=2708 Burp...

信游科技页游平台后台管理验证码设计错误可致暴力破解

简要描述： 信游科技页游平台后台管理验证码设计错误可致暴力破解，验证码形同虚设啊。看厂商会发礼物。^^ 嘻嘻 详细说明： 信游科技页游平台后台管理验证码设计错误可致暴力破解，验证码形同虚设啊。 http://ht.52xinyou.cn/xykj/login.aspx burp下，验证码怎么写在cookie里了啊。反正只要登录不成功，验证码是不会变的。 然后就可以burp设置payload开始暴力破解了。只是演示，字典随便设的。 可以看到成功的payload，长度是不同的，而且response是200OK 漏洞证明： 信游科技页游平台后台管理验证码设计错误可致暴力破解，验证码形同虚设啊。...

yxcms任意文件删除 导致的重新安装漏洞

简要描述： yxcms任意文件删除 导致的重新安装漏洞 详细说明： yxcms任意文件删除 导致的重新安装漏洞 protected/apps/members/contoller/newscontroller.php if empty$FILES'picture''name' === false $tfile=date"Ymd"; $imgupload= $this-upload$this-uploadpath.$tfile.'/',config'imgupSize','jpg,bmp,gif,png'; $imgupload-saveRule='thumb'.time;...

UChome 注入漏洞2

简要描述： UChome 注入漏洞2 需要GPC=OFF和之前那个差不多 详细说明： cpblog.php ifsubmitcheck'blogsubmit' ifempty$blog'blogid' $blog = array; else if!checkperm'allowblog' ckspacelog; showmessage'noauthoritytoaddlog'; //验证码 ifcheckperm'seccode' && !ckseccode$POST'seccode' showmessage'incorrectcode';...

Bypassing the latest version of the site Safety Dog 3. 1 upload-vulnerability warning-the black bar safety net

Test environment: windows 2 0 0 3 + iis 6.0 Test steps: 1. Site Safety Dog Defense state open ! 1 2. Burp intercept POST package after the modifications ! 2 3. Yes, you read that right, that is | 1 | 08sec. php spaces ---|--- ! 3! 4...

Bypass the site's security and Dog 3. 1 upload-vulnerability warning-the black bar safety net

This method is only tested in V3. 1 0 5 8 3 7 or less than V3. 1 0 5 8 3 7 the latest version V3. 1 0 6 1 0 3 ps: this method has been submitted to the security Dog security Emergency Response Center Bypass the site's security Dog V3. 1 0 6 1 0 3 way later will continue to publish out, please pay...

NGS00500 Technical Advisory: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE

======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren [email protected] Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better WP Security Plugin Version...

[CookieCatcher] Session Hijacking Tool

CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used without proper...

mooSocial 1.3 - Multiple Vulnerabilities

mooSocial 1.3 - Multiple Vulnerabilities Exploit Title: mooSocial 1.3 - Multiple Vulnerabilites Official site: http://www.moosocial.com Risk Level: High Exploit Author: Esac Homepage author : www.iss4m.ma Last Checked: 22/08/2013 +----------+ | OVERVIEW | +----------+ mooSocial is a social...

mooSocial 1.3 Cross Site Scripting / Local File Inclusion Vulnerability

mooSocial version 1.3 suffers from cross site scripting and local file inclusion vulnerabilities. Exploit Title: mooSocial 1.3 - Multiple Vulnerabilites Official site: http://www.moosocial.com Risk Level: High Demo : http://demo.moosocial.com Exploit Author: Esac Homepage author : www.iss4m.ma La...

[The Burp SessionAuth] Extension for Detection of Possible Privilege escalation vulnerabilities

Normally a web application should identify a logged in user by data which is stored on the server side in some kind of session storage. However, in web application audits someone can often observe that internal user identifiers are transmitted in HTTP requests as parameters or cookies. Applicatio...

[Samurai Web Testing Framework v2.1] Live linux environment that has been pre-configured to function as a web pen-testing environment

The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites. In developing this environment, we have based our tool...

WordPress Plugin Better WP Security 3.4.83.4.93.4.103.5.23.5.3 - Persistent Cross-Site Scripting

WordPress Plugin Better WP Security 3.4.83.4.93.4.103.5.23.5.3 - Persistent Cross-Site Scripting ======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren Vendor: Bit51 Vendor...

WordPress Plugin Better WP Security 3.4.8/3.4.9/3.4.10/3.5.2/3.5.3 - Persistent Cross-Site Scripting

======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better WP Security Plugin Version 3.4.8/3.4.9/3.4.10/3.5.2/3.5.3 Risk...

通达OA微讯功能持久性XSS漏洞

简要描述： 通达oa的微讯功能，可以时时发送信息给在线的用户不在线的用户当登录时即可收到，信息中可以插入脚本代码，当发送信息给指定的用户时，对方会立刻接收到信息，可能造成cookie被盗，以及执行某些操作，如自动发布分享，添加日志，删除日志等操作。 详细说明： 测试的版本是office anywhere 2011 漏洞证明： 微讯发送后的效果，发现并没有弹出对画框。 通过burp suite看是某些符号在输入的时候被转译了 尝试把被转译后的符号修改回来后再次发送 修改数据包后再次发送的效果图如下：...