Sql injection

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

CVE-2020-19821

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

CVE-2020-19821

DOYO CMS (DOYOCMS) 2.3 contains a SQL injection in admin.php reachable via the orders[] parameter, allowing attackers to execute arbitrary SQL commands. Root cause: improper handling/sanitization of the orders[] input leads to injection. Affected component: DOYOCMS 2.3; entry describes high-sever...

CVE-2019-9551

DOYO (doyocms) 2.3 to 2015-05-06 contains a stored XSS in the admin.php backend. Affected component: admin.php; vulnerability type: cross-site scripting. Impact and exploit details are not elaborated beyond injection of arbitrary script/HTML. No patch/version remediation information is provided i...

SQL Injection Vulnerability in World Parameters under doyocms source/ajax.php File

DOYO universal station-building system using PHP and MYSQL development, is a free open source CMS station-building, enterprise station-building system , can be widely used for personal, business, government, institutions and many other website construction. doyocms system source/ajax.php file und...

SQL injection vulnerability in fields parameter under source/ajax.php file of doyocms system

DOYO universal station-building system using PHP and MYSQL development, is a free open source CMS station-building, enterprise station-building system , can be widely used for personal, business, government, institutions and many other website construction. doyocms system source/ajax.php file und...

SQL injection vulnerability in the molds parameter under the source/ajax.php file of doyocms system

DOYO universal station-building system using PHP and MYSQL development, is a free open source CMS station-building, enterprise station-building system , can be widely used for personal, business, government, institutions and many other website construction. doyocms system source/ajax.php file und...

doyoCMS注入漏洞1处

简要描述： doyoCMS注入漏洞1处 详细说明： 注入漏洞一枚： 存在注入的代码位置/source/pay.php 具体代码： function order if$this-syArgs'oid'||$this-syArgs'orderid',1!='' if$this-syArgs'oid'$r=array'id'=$this-syArgs'oid',1;else$r=array'orderid'=$this-syArgs'orderid',1; $order=$this-c-find$r;...

doyo建站程序平行权限问题2处

简要描述： doyo建站程序平行权限问题2处 详细说明： 小伙伴和我看了下doyoCMS的逻辑，交wooyun小伙伴们看看是不是个漏洞 首先出现问题的地方是这段代码 代码位置：/source/member.php function mydel//多处逻辑越权操作 $molds=$this-syArgs'molds',1; $id=$this-syArgs'id'; switch $molds case 'comment': if!syDB'comment'-deletearray'cid'=$id,'user'=$this-my'user' message"删除失败,请重新提交";...

DOYOcms local file inclusion vulnerability-vulnerability warning-the black bar safety net

It is this set of CMS, this is very simple to. ! DOYOcms local file inclusion vulnerability Here's the$handlecontroller = syClass$controller, null, $GLOBALS'GDY'"controllerpath".'/'.$ controller.". php"; Next look down ! DOYOcms local file inclusion vulnerability ! DOYOcms local file inclusion...