SDCMS 最新门户版 V3.0 储存型xss一枚 可盲打后台

简要描述： 严谨的说 是编辑器xss储存型漏洞 详细说明： 虚拟主机搭建测试： 需要条件： 开启会员注册默认开启 开启投稿功能（默认开启） 下载地址： http://www.sdcms.cn/product/portal.html 默认 开启会员注册 无需审核 原本想在demo上测试的 但是他开启审核了 ---------------------------------------- 注册个会员 找到在线投稿 选择文章模型 远程上传地址处 插入： " 提交 img...

LebiShop系统sql注入四（四处注入）

简要描述： LebiShop商城系统最新版SQL注入 四处 demo站点测试成功 详细说明： 注入一 二 主要漏洞代码一样 http://demo.lebi.cn/onlinepay/95epay/PayNotify.aspx http://demo.lebi.cn/onlinepay/95epay/PayResult.aspx 共同源码如下 protected void PageLoadobject sender, EventArgs e this.MerNo = HttpContext.Current.Request.Params"MerNo".ToString; this.Bill...

某信息发布系统SQL注入(demo复现)

简要描述： 某信息发布系统SQL注入demo复现 详细说明： 某信息发布系统SQL注入demo复现 漏洞证明： 注入在这个地方： 抓包看看： POST /index.php HTTP/1.1 Host: pmbdemo.youyax.com Proxy-Connection: keep-alive Content-Length: 21 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Origin:...

Akeneo PIM Cross Site Scripting

Affected software: Akeneo Online Demo Type of vulnerability: stored xss URL: http://www.akeneo.com/demo/ Discovered by: Provensec Website: http://www.provensec.com Description:Akeneo is an open source Product Information Management PIM system designed for retailers looking for efficient answers t...

Collabtive 2.0 Cross Site Scripting

Affected software: collabtive Type of vulnerability: stored xss URL: http://www.collabtive.o-dyn.de/ Discovered by: Provensec Website: http://www.provensec.com Description: collabtive stored xss version:2.0 Proof of concept goto Collabtive add new project with xss payload and save it javascript...

ESPCMS最新版后台登入绕过DEMO测试

简要描述： 漏网之鱼，同样是加解密函数，但又与以前不同。 详细说明： 看看加解密函数 function eccode$string, $operation = 'DECODE', $key = '@LFK24s224%@safS3s%1f%', $mcrype = true $result = null; if $operation == 'ENCODE' if extensionloaded'mcrypt' && $mcrype $result = $this-encryptCookie$string, $key; else for $i = 0; $i...

SEO Toaster E-Commerce 2.2.0 Cross Site Scripting

Affected software: http://demo.seotoaster.com Type of vulnerability: clickjacking Version: E-Commerce 2.2.0 URL: http://www.seotoaster.com/ Discovered by: Provensec Website: http://www.provensec.com Description:Free SEO Software & CMS: All in One Proof of concept seo toaster search filed was vuln...

Ilch CMS Cross Site Request Forgery

Affected software: Ilch cms Type of vulnerability: csrf URL: http://www.ilch.de/ Discovered by: Provensec Website: http://www.provensec.com Description: Ilch cms profile field csrf Proof of concept http://demo.opensourcecms.com/ilch/admin.php?profilefields online demo Above field was vulnerable t...

齐博CMS博客系统注入（可更新数据库,demo测试）

简要描述： 不知道 详细说明： 漏洞文件 ../blog/template/space/file/viewmusic.php function getviewmusic global $db,$uid,$pre,$id,$timestamp,$BM; $db-query"UPDATE $BMmusicsong SET hits=hits+1,lastview='$timestamp' WHERE id='$id'"; $rsdb=$db-getone"SELECT FROM $BMmusicsong WHERE id='$id'"; $rsdbposttime=date"Y-m-d...

Cookie hijacking: Internet Explorer UXSS (CVE-2015-0072)

Cookie hijacking: Internet Explorer UXSS CVE-2015-0072 Host below files on webserver attacker.com and share the exploit link with victims, exploit.php --- exploit link Share with victim redirect.php --- Script to redirect on target page target page should not contain X-Frame-Options or it will fa...

phpmps逻辑漏洞+存储xss demo测试成功

简要描述： demo站点测试成功 详细说明： 先注册一个账号 然后登陆 然后我们看到个人中心那 点击发布也是发布不了的 我们可以访问 http://www.phpmps.com/demo/postcom.php post提交 act=postok&catid=1&comname=a&areaid=1&phone=12&qq=12&[email protected] 就发布黄页成功了 本来发布不了的现在就可以绕过，发布成功了 这里存在逻辑漏洞 发布成功后 我们看下企业黄页这里 然后点击编辑 联系地址加入 alert/xss/ 点击确认后 https://...

Iconium Nexus Theme - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title:Iconium Nexus Theme - SQL İnjection vulnerability Google Dork: intext:Powered by İconium Mühendislik Date: 03.02.2015 Exploit Author: Herdem Vendor Homepage: http://iconiummuhendislik.com Version: All Versions Tested on: Windows ...

Iconium Ekonomik Theme - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Iconium Ekonomik Theme - Multiple Vulnerabilites Google Dork: intext:Powered by İconium Mühendislik Date: 03.02.2015 Exploit Author: Herdem Vendor Homepage: http://iconiummuhendislik.com Software Link:...

某OA办公系统储存型XSS#2

简要描述： 某OA办公系统储存型XSSdemo演示 详细说明： 漏洞证明： 官方站：http://www.oa8000.com/online.htm 官方演示站：http://demo.oa8000.com/OAapp/WebObjects/OAapp.woa 普通用户登录，工作中心--任务管理--新建任务 在任务标题处写入XSS代码/" 查看我们发布的信息，直接查看任务即可，不用查看具体信息。...

华天动力储存XSS10处打包（6处绕过长度限制），非self-xss（demo演示）

简要描述： 缺个移动硬盘存片子 详细说明： demo演示，涉及大量政府，医院，房产，电视台等网站：http://www.oa8000.com/solution.htm 首先还是来到官网，看到demo演示地址：http://demo.oa8000.com 然后先用官方提供的普通用户登录 存在XSS的地方在：客户管理----联系人管理----我的联系人----新建 img src="https://images.se...

Wordpress Video Gallery Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugins - Wordpress Video Gallery Arbitrary File Download Vulnerability Date: 17/01/2015 Exploit Author: X-Line Empire North From Tetouan Vendor Homepage: Dork : www.hdflvplayer.net Software Link:...

ManageEngine Firewall Analyzer 8.0 - Directory Traversal/XSS Vulnerabilities

Exploit for hardware platform in category web applications ...:::::ManageEngine Firewall Analyzer Directory Traversal/XSS Vulnerabilities::::.... Sobhan System Network & Security Group sobhansys ------------------------------------------------------- Date: 2015-01-28 Exploit Author: AmirHadi...

New CMS 2.1 Local File Inclusion

=============================================== + TITLE : NEW CMS Local File Inclusion Vulnerability /proc/self/environ + VENDOR : http://new-cms.org/index.php?lng=it&mod=download&pg=indice + VERSION : 2.1 or Later + AUTHOR : R3vanBastard + TESTED ON : Windows + DORK : "New CMS"...

LebiShop商城系统最新版任意用户登陆

简要描述： LebiShop商城系统最新版任意用户登陆 详细说明： LebiShop商城系统最新版Powered by LebiShop V3.1.01，存在任意用户登陆 官方demo测试 http://plus.demo.lebi.cn/——可注册普通用户和商家用户 http://demo.lebi.cn/——可注册普通用户 我们使用http://plus.demo.lebi.cn/进行测试 首先我们注册一个普通用户222222，并登陆 注意这里的COOKIE中user的值，id=37，这里是用户222222的用户userid...

OpenSchool Community Edition 2.2 XSS / Access Bypass Vulnerabilities

Exploit for php platform in category web applications Exploit Title: OpenSchool Community Edition version 2.2 Multiple Vulnerabilities Exploit Author: Mahendra Vendor Homepage: www.open-school.org Software Link: http://sourceforge.net/projects/fiyo-cms/ Full version demo:...