ABH WORLD SQL Injection

========================================================= + Title :- ABH WORLD CMS - SQL Injection Vulnerability + Date :- 19 - June - 2015 + Vendor Homepage: :- https://abhworld.com/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google...

KesionIMALL 注册处存在cookie 注入

简要描述： 之前就更新过有关官方的补丁，加上了关键字的拦截 但是拦截的方法是有误的， 还有好多地方没有做到对应的出来 案例是本地搭建的demo 注入点:用户注册地方 http://127.0.0.1:8010/regok.aspx 详细说明： 漏洞证明：...

Mapbox: Stored Cross-Site Scripting in Map Share Page

Hi Team Mapbox Security This is Copy From message email ‫[email protected]‬ intro. I'm Hussain Adnan Researcher Security, Iam Have Found Vulnerability Bug in form project profile Map Type Vulnerability : Cross-Site Scripting Stored - Reflected Affected Domain : Affected Domain : mapbox.com -...

YXcms 建站系统 逻辑错误 0元购物

简要描述： 逻辑错误，导致可以0元购物 详细说明： 使用官方demo站点做演示 http://demo.yxcms.net/ 实例如： 实例： http://www.lesuzhou.com/index.php http://www.k3led.cn/led/index.php http://qy002.demo.jz004.com/index.php http://www.sscproxy.com/index.php http://www.cctv1949.com/index.php 等 宝马x1 90...

SolarWinds Network Performance Monitor Open Redirect

Affected software: SolarWinds Network Performance Monitor Type of vulnerability:url redirection URL:http://www.solarwinds.com/ Discovered by: provensec Website: provensec.com version:N/A Proof of concept http://oriondemo.solarwinds.com/Orion/Login.aspx?ReturnUrl=//google.com...

WordPress Plugin N-Media Website Contact Form with File Upload 1.5 - Local File Inclusion

Exploit Title: website contact form with file upload 1.5 Exploit Local File Inclusion Google Dork: inurl:"/plugins//website-contact-form-with-file-upload/" Date: 07.05.2015 Exploit Author: T3N38R15 Software Link: https://wordpress.org/plugins/website-contact-form-with-file-upload/ Version: 1.5...

BigAce CMS 3.0 Cross Site Scripting

Affected software: bigace cmc Type of vulnerability:cross site scripting URL:http://demo.bigace.de/ Discovered by: provensec Website: provensec.com version: 3.0 Proof of concept http://site/xsspayload demo:http://demo.bigace.de/%22%3E%3Cimg%20src=d%20onclick=confirm%281%29;%3E...

WordPress 4.2 - Persistent Cross-Site Scripting

WordPress 4.2 - Persistent Cross-Site Scripting Source: http://klikki.fi/adv/wordpress2.html Overview Current versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed. If...

WordPress 4.2 - Stored XSS Vulnerability

Exploit for php platform in category web applications Overview Current versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed. If triggered by a logged-in administrator, unde...

ourphp逻辑漏洞刷钱

简要描述： 如题 详细说明： 这是demo地址http://demo.ourphp.net 注册个小号上去随便买一件商品 以这件为例 http://demo.ourphp.net/?cn-shoppingcart.html-&ourphpcms=shopping 然后去结算。 结算的时候抓包，将ourphpopcms本来是699的，后面那个改成-100 然后最后结算就-100了 漏洞证明： 以上...

Netgear WNR2000v4 Abuse / XSS / Command Injection Vulnerabilities

Netgear WNR2000v4 suffers from code execution, missing abuse control, and cross site scripting vulnerabilities. I'm releasing a few vulnerabilities for the WNR2000v4 Netgear router. Netgear is currently working these issues. Quick Fix --------- If you own a WNR2000v4, set a strong password and se...

RSA Conference Chris Hoff Reuben Paul Keynote

SAN FRANCISCO – When it comes to the future development of secure software, there’s really only one “next generation” that matters. That’s why today when the covers were pulled back on a seven-foot-tall server rack wheeled out on stage during Chris Hoff’s RSA Conference keynote, those in the...

Netgear WNR2000v4 Abuse / XSS / Command Injection

I'm releasing a few vulnerabilities for the WNR2000v4 Netgear router. Netgear is currently working these issues. Quick Fix --------- If you own a WNR2000v4, set a strong password and set security questions to jibberish. Timeline -------- FEB2015 - "MW" Volunteers to be victim to router pwning...

MediaSuite CMS - Artibary File Disclosure Exploit

Exploit for php platform in category web applications . | | / | | \ \ | | \ / | |\ / / /\ \ / \ | / ^ / / || / / / / /\ /\ \ \ \ | / \ / http://twitter.com/h4SEC / \ | \ \ Proof Video: https://www.youtube.com/watch?v=7yxbfD1YK8Y / // / \ / My + Author : KnocKout E-Mail : email protected...

Hippo CMS 7.9.7 Enterprise Edition CRLF Injection

Affected software: hippo cms Type of vulnerability:crlf URL:https://cms.demo.onehippo.com Discovered by: provensec Website: provensec.com version: CMS 7.9.7 Enterprise Edition Proof of concept payload : advanced%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-...

通达oa2013集团版注入

简要描述： 通达 详细说明： 官网demo登录: http://www.day900.com/ cw 登陆有点鸡肋 注入点+payload: http://www.day900.com/general/budget/budgetprocess/budgetyeardepts.php?DEPTID=1&DEPTIDPRIV=0&DEPTIDS=1 and select 1 from select count,concatselect concathost,user,password from mysql.user limit 0,1,floorrand02x from...

bloofoxCMS 0.5.0 Cross Site Scripting

Affected software: bloofox cms Type of vulnerability:xss URL:bloofox.com Discovered by: provensec Website: provensec.com version: 0.5.0 Proof of concept http://demo.bloofox.com/admin/index.php?mode=content&page=media&action=edit&file=%22%3E%3Cimg%20src=d%20onerror=confirm1;%3E&type=1%27...

JEECMS储存xss盲打后台#6（demo演示）

简要描述： xss 详细说明： WooYun: JEECMS储存xss盲打后台5 接着来 稳定压倒一切! Jeecms是基于java技术研发的站群管理系统，稳定、安全、高效、跨平台、无限扩展是jeecms 的优点，系统支持mysql、oracle、sqlserver、db2等主流数据库。 轻松建设大规模网站群，从jeecms开始 官网：http://www.jeecms.com/ demo地址：http://www.jeecms.com/demo.jhtml 这套cms有3种类别的，这里演示第三种商场系统...

Joomla! Component com_gallery_wd - SQL Injection

Joomla! Component comgallerywd - SQL Injection Exploit Title: Joomla Gallery WD - SQL Injection Vulnerability Google Dork: inurl:option=comgallerywd Date: 29.03.2015 Exploit Author: CrashBandicot @DosPerl Vendor HomePage: http://web-dorado.com/ Source Component :...

CMS Builder 2.07 SQL Injection

Affected software: CMS Builder v2.07 Type of vulnerability: sql injection URL: http://demo2.interactivetools.com/cmsbuilder2/bottom.php Discovered by: Provensec Website: http://www.provensec.com versionv2.07 Proof of concept...