3986 matches found
云人才系统SQL注入，绕过WAF
简要描述： 云人才系统SQL注入，绕过WAF 详细说明： 云人才系统SQL注入，绕过了360的WAF 首先需要注册一个普通用户 比如官方演示站点： 然后来到 http://www.hr135.com/member/index.php?M=index&C=info 可以看到有某数字的WAF： 于是我们发现代码如下： function infoaction if$POST"submitBtn" $POST=$this-posttrim$POST; if$POST"name"=="" $this-obj-ACTmsg"index.php?C=info","��������Ϊ�գ�";...
Crime24 Stealer Panel 1.0 - Multiple Vulnerabilities
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= | \ | | | \ | | | |/ | / | | | | |/ / \ | | | |/ | ' \ | || | | | \ \ || | Twitter @TheHackersBay Pentester / Underground hacker Exploit Title: Crime24 Stealer Panel &in=1&search=Search Example: http://i.imgur.com/zyIr5xv.png...
Jigowatt PHP Event Calendar "year" SQL注入漏洞
Jigowatt PHP Event Calendar是一款日历WEB应用程序。 Jigowatt PHP Event Calendar calendar/dayview.php不正确过滤"year"参数数据，允许远程攻击者利用漏洞提交特制的SQL查询，操作或获取数据库数据。 0 Jigowatt PHP Event Calendar 2.x 目前没有详细解决方案： http://codecanyon.net/item/php-event-calendar/47723...
CVE-2014-1986
The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access restrictions and read database information via a crafted application...
Jigowatt PHP Event Calendar - 'day_view.php' SQL Injection
source: https://www.securityfocus.com/bid/66923/info Jigowatt PHP Event Calendar is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, acces...
MobFox mAdserve SQL注入漏洞
Bugtraq ID:66661 MobFox mAdserve是一款基于WEB的广告服务应用。 MobFox mAdserve存在一个SQL注入漏洞，允许远程攻击者利用漏洞提交特制的SQL查询，操作或获取数据库数据。 0 MobFox mAdserve 2.0 目前没有详细解决方案： http://www.madserve.org/...
Procentia IntelliPen 1.1.12.1520 - 'data.aspx' Blind SQL Injection
CVE: CVE-2014-2043 Vendor: Procentia Product: IntelliPen Affected version: 1.1.12.1520 Fixed version: 1.1.18.1658 Reported by: Jerzy Kramarz Details: SQL injection has been found and confirmed within the software as an authenticated user. A successful attack could allow an authenticated attacker ...
Multiple Vulnerabilities in Eventum
High-Tech Bridge Security Research Lab discovered vulnerability in Eventum, which can be exploited to reinstall and compromise vulnerable application. 1 Incorrect Default Permissions in Eventum: CVE-2014-1631 The vulnerability exists due to incorrect default permission set for installation script...
Etoshop B2B Vertical Marketplace Creator - Multiple SQL Injections
source: https://www.securityfocus.com/bid/64332/info B2B Vertical Marketplace Creator is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit these issues by manipulating the SQL quer...
Dynamic Biz Website Builder (QuickWeb) 1.0 - '/apps/news-events/newdetail.asp?id' SQL Injection
source: https://www.securityfocus.com/bid/64371/info EtoShop Dynamic Biz Website Builder QuickWeb is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit these issues by manipulating...
Eclipse.org SQL Injection
Vulnerability: Eclipse.org Error Based SQL Injection Authors: Shahmeer Amir And Rafay Baloch Company: RHA INFOSEC Website: http://services.rafayhackingarticles.net Url...
Project'Or RIA 3.4.0 SQL Injection
============================================= INTERNET SECURITY AUDITORS ALERT 2013-017 - Original release date: July 26th, 2013 - Last revised: July 26th, 2013 - Discovered by: Vicente Aguilera Diaz - Severity: 6.8/10 CVSSv2 Base Scored - CVE-ID: CVE-2013-6164...
EMC Atmos weak default installation
Default database access with no password is allowed...
Cacti < 0.8.8b Command and SQL Injections
Binary data 8004.prm...
Joomla! Component redSHOP 1.2 - SQL Injection
-------------------------------------------- Joomla! redSHOP component v1.2 SQL Injection -------------------------------------------- == Description == - Product: Joomla! redSHOP component - Product link: http://redcomponent.com/redcomponent/redshop - Vendor: redcomponent - Affected versions:...
Oracle Linux 5 / 6 : perl-DBD-Pg (ELSA-2012-1116)
The remote Oracle Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-1116 advisory. 2.15.1-4 - Resolves: rhbz841131 CVE-2012-1151 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...
Elemata CMS SQLi Vulnerability
Elemata CMS is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2013-3927
Unspecified vulnerability in the client library in Siemens COMOS 9.2 before 9.2.0.6.10 and 10.0 before 10.0.3.0.4 allows local users to obtain unintended write access to the database by leveraging read access...
Design/Logic Flaw
Unspecified vulnerability in the client library in Siemens COMOS 9.2 before 9.2.0.6.10 and 10.0 before 10.0.3.0.4 allows local users to obtain unintended write access to the database by leveraging read access...
CVE-2013-3927
Unspecified vulnerability in the client library in Siemens COMOS 9.2 before 9.2.0.6.10 and 10.0 before 10.0.3.0.4 allows local users to obtain unintended write access to the database by leveraging read access...