Discuz! NT3. 0 background to get shell-vulnerability warning-the black bar safety net

Author: icysun Himself not to engage in a good long time to figure out how to get the shell Into the back we can know that the website path, this is important Direct export word Select from table1 into outfile 'c:\test.txt' this is no good, don't know where I wrong, or is simply not on. So we can...

Discuz! "$referer"输出值跨站漏洞

在Discuz! 任意版本中存在以下页面： /templates/default/attachpay.htm /templates/default/ecrate.htm /templates/default/register.htm 这些页面都包含$referer输出代码： input type="hidden" name="referer" value="$referer" / 当$referer 中含有恶意代码时，这些页面及被其嵌套的php页面会产生跨站漏洞。 Discuz! 7.X Discuz! 6.X Discuz! 5.X Discuz!NT 3.X...

Discuz! 所有版本永久型跨站漏洞

Discuz! 个人中心里的“个人签名”没有对恶意代码进行检测，在 Discuz! 及 img 代码禁用的情况下仍可写入恶意代码，Discuz! 会保存并执行该代码，形成永久型跨站。 该漏洞可能导致蠕虫病毒的传播。 Disczu! = 7.2 Discuz!所有版本 官方暂无补丁，请网站管理员等待官方更新。 临时解决办法： 1、修改 memcp.php 代码，过滤个人签名字符。 2、禁止用户使用个人签名。 /textareascriptalert/Liscker/;/scripttextarea...

There is a Permanent-type Cross-Site Vulnerability in “Personal Signature” in all version of Discuz!. It can be written by the worm!

There is a Permanent-type Cross-Site Vulnerability in “Personal Signature” in all version of Discuz!. It can be written by the worm! Discuz! do not filter the Malicious code when user enter their personal signature, attacker can enter the xss code, Discuz! will save and run it! It maybe lead the...

"$referer" export lead to the cross-site flaws in all versions of Discuz!

hi; All versions of Discuz! have the cross-site vulnerabilities because of the export value of "$referer". Like: Discuz! 7.X Discuz! 6.X Discuz! 5.X Discuz!NT 3.X and so on. There are some htm pages in all versions of Discuz!, that are: /templates/default/attachpay.htm /templates/default/ecrate.h...

Discuz!NT 3.1用户空间跨站漏洞

北洋贱队（http://bbs.seceye.org） Discuz!NT 是康盛创想北京科技有限公司旗下的一款功能强大的基于 ASP.net 平台的社区软件。基于先进的 .Net Framework，默认支持 SQLServer数据库，可扩展支持Access、MySQL等多种数据库，支持IIS5、IIS6、IIS7，安全高效、稳定易用，充分发挥 ASP.net 特性，支持自由选择切换皮肤，支持多种其它论坛的数据转换。 Discuz!NT 3.1 等待官方补丁 1.论坛用户空间日志发表评论，插入跨站语句即可：...

Discuz! v7. 2 injection vulnerability analysis and exploit-vulnerability warning-the black bar safety net

Vulnerability analysis: 文件 ./manyou/sources/notice.php The relevant code: if$option == 'del' $appid = intval$GET'appid'; $db-query"DELETE FROM $tablepremyinvite WHERE appid='$appid' AND touid='$discuzuid'"; showmessage'manyou:done', 'userapp. php? script=notice&action=invite'; elseif$option ==...

Discuz! NT 3.1.0 more than the presence of cross-site vulnerability-vulnerability warning-the black bar safety net

1. In the Quick Search area of the“plates”of the search submitted to the cross site testing statement"iframe+Src=http://hi. baidu. com/5 4 2 7 5 1 8, The Get the address: http://localhost/bbs/forumsearch.aspx?q=%22%3E%3Ciframe%20src%3Dhttp%3A//hi.baidu.com/5427518%3E 2. In the forum sections...

Discuz 6.0 viewthread.php 跨站漏洞

demo: http://bbs.51testing.com/viewthread.php?tid=%22%3E%3E%3Cscript%3Ealert%28insafe--SecEyE%29%3C/script%3E%3Cmarquee%3E%3Ch1%3EINSAFE%20By%20SECEYE%3C/h1%3E%3C/marquee%3E 不解释，COPY的朋友请留个北洋贱队的url就可以了 Discuz 6.0 升级到最新版本...

Discuz! 6.0论坛uid参数远程跨站脚本漏洞

BUGTRAQ ID: 38484 Discuz!是一款华人地区非常流行的Web论坛程序。 Discuz!论坛没有正确的过滤提交给eccredit.php页面的uid参数，远程攻击者可以通过向论坛提交恶意参数请求执行跨站脚本攻击，导致在用户浏览器会话中注入并执行任意HTML和脚本代码。 Comsenz Discuz! 6.0 厂商补丁： Comsenz ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.comsenz.com/index.php...

Discuz!NT 3.1.0 多处存在跨站漏洞

北洋贱队（http://bbs.seceye.org）首发 1.在快速搜索区域的“板块”搜索提交跨站测试语句"iframe+Src=http://www.gohack.org， 获得地址：http://localhost/bbs/forumsearch.aspx?q=%22%3E%3Ciframe%20src%3Dhttp%3A//www.gohack.org%3E 2.在论坛板块版面出随意选择一种浏览方式，然后修改或添加加入跨站语句，获得地址：...

BBSXP 2008 Cross Site Scripting Vulnerability

Exploit for unknown platform in category web applications ============================================= BBSXP 2008 Cross Site Scripting Vulnerability ============================================= BBSXP is prone to an cross-site scripting vulnerability because the application fails to properly...

BBSXP 2008 Cross Site Scripting

first, my name is liscker, not lis + cker. Im chinese. thank you. BBSXP is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

Discuz! 6.0 - uid Cross-Site Scripting

Discuz! 6.0 - uid Cross-Site Scripting source: https://www.securityfocus.com/bid/38484/info Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

[xss] i found a Cross Site Scripting Vulnerability about Discuz! 'uid' Parameter

i'm sorry, i just write some real sites to confirm the truth of my found, now , i remove it. and thanks for you. Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitra...

Discuz! 6.0 - 'uid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/38484/info Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

Discuz! 7.0-7.2 the background settings. inc. php to write shell vulnerability-vulnerability warning-the black bar safety net

Impact version Discuz! 7.0-7.2 Vulnerability details: if$operation == 'uc' && iswriteable'./ config.inc.php' && $isfounder $ucdbpassnew = $settingsnew'uc''dbpass' == '' ? UCDBPW : $settingsnew'uc''dbpass'; if$settingsnew'uc''connect' $ucdblink = @mysqlconnect$settingsnew'uc''dbhost',...

Discuz!7.0-7.2后台settings.inc.php中写shell漏洞

漏洞详情： if$operation == 'uc' && iswriteable'./config.inc.php' && $isfounder $ucdbpassnew = $settingsnew'uc''dbpass' == '' ? UCDBPW : $settingsnew'uc''dbpass'; if$settingsnew'uc''connect' $ucdblink = @mysqlconnect$settingsnew'uc''dbhost', $settingsnew'uc''dbuser', $ucdbpassnew, 1; if!$ucdblink...

Discuz plug-in the virtual stock market of blind Injection Vul exploit-vulnerability warning-the black bar safety net

Vulnerability discovery from a station of the penetration, due to its discuz version 7. 0, so I can only put the eye is focused on the installation of third-party plug-ins. After a simple test, it is found that the virtual stock market of the presence of injection vulnerabilities:...

Discuz! 'tid' Parameter Cross Site Scripting Vulnerability

Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the...