Discuz! X2 SQL注射漏洞

简要描述： Discuz! X2 SQL注射漏洞，支持Union 详细说明： 文件：source\module\forum\forumattachment.php if!defined'INDISCUZ' exit'Access Denied'; define'NOROBOT', TRUE; @list$G'gpaid', $G'gpk', $G'gpt', $G'gpuid', $G'gptableid' = explode'|', base64decode$G'gpaid'; if!empty$G'gpfindpost' && $attach =...

Discuz!多个版本存储型跨站脚本漏洞

No description provided by source...

Discuz! NT 2. x - 3.5.2 SQL injection(0day)-vulnerability warning-the black bar safety net

Vulnerability type: SQL injection Vulnerability description: Discuz! NT is the Kang Sheng Chong thinkComsenzits a powerful based on ASP.NET platform community software. Vulnerability analysis: ajaxtopicinfo. ascx user control poster SQL injectionvulnerability Combined with ajax. aspx call any use...

Discuz! Multi-version storage type XSS script vulnerability (0day)-vulnerability warning-the black bar safety net

2 0 0 9 annual accident test found thisXSSvulnerability, as is the storage type, I think everyone should know its hazards. Separated by so many years of DZ and constantly updated version,but this vulnerability still exists, today released! Keep nothing with Chairman Mao, Oh. Here I would like to...

Discuz!多版本 存储型XSS脚本漏洞

简要描述： 2009年一次偶然间测试发现的此XSS漏洞，因为是存储型的，我想大家应该知道它的危害吧。相隔这么多年DZ不断的更新版本，但此漏洞依然存在,今天就发布出来吧！留着也没什么用会长毛的，呵呵。 在此我要感谢一下我的好朋友Jackal在09年的时候一起帮我测试漏洞的。 当时我们一起测试的是DZ6.0-DZ7.2，不知道是不是通杀啊。哈哈！没有一个一个去测试。有条件的去测试一下吧。 详细说明： 发贴进入源码模式，写入如下的exp emailurlimghttp://qhkest.com onmouseover=alert/DZ-xss-0day/; /img /url/email...

Discuz! X1. 5 0day exploit method-vulnerability warning-the black bar safety net

Has been Discuz it! x1. 5 the site is difficult to invasion to take the shell for the novice to 0day is probably out today. Teach everyone to use, on the map: ! ! this step requires time and the like. See the following figures found? ! Get to the chopper is connected. ! I believe we will. Just fo...

Discuz! 7.0-7. 2 and Phpwind7. 5 Background tasteless vulnerability-vulnerability warning-the black bar safety net

A lot of people there, spread out, and then sent to. Now the loophole if the initiative is published, is definitely“no. do not publish”, otherwise is definitely hiding unless someone else posted. DZ tasteless that need the Creator's permission, the Creator of the password is generally more...

discuz! X1.5 Get Shell 0day

简要描述： 可以自由写入一句话木马 详细说明： 以下为漏洞的EXP ?php printr' +---------------------------------------------------------------------------+ Discuz! X1-1.5 notifycredit.php Blind SQL injection exploit by toby57 2010.11.05 mail: admin at bkey org team: http://www.bkey.org 说明:alibaba把后续getshell代码添加了下去...

Discuz X1-x1. 5 Blind SQL injection Getshell Xday-vulnerability warning-the black bar safety net

? php printr' +---------------------------------------------------------------------------+ Discuz! X1-1.5 notifycredit.php Blind SQL injection exploit by toby57 2010.11.05 mail: toby57 at 1 6 3 dot com team: http://www.wolvez.org...

Discuz! X1-1.5 notify_credit.php Blind SQL injection exploit

No description provided by source. ?php printr' +---------------------------------------------------------------------------+ Discuz! X1-1.5 notifycredit.php Blind SQL injection exploit by toby57 2010.11.05 mail: toby57 at 163 dot com team: http://www.wolvez.org...

Discuz! 1.5 跨站脚本攻击

简要描述： UC登陆页面存在跨站漏洞 详细说明： http://www.eisdl.com/bbs/ucserver/admin.php?m=user&a=login&iframe=&sid='%22%3E%3Ciframe%20src=http://www.pker.in%3E 漏洞证明： http://www.eisdl.com/bbs/ucserver/admin.php?m=user&a=login&iframe=&sid='%22%3E%3Ciframe%20src=http://www.pker.in%3E...

Discuz! NT 3.1.0 后台拿webshell

简要描述： 通过后台写入执行代码，直接拿到webshell，从而掌握服务器权限。 详细说明： 1、访问http://127.0.0.1/admin/global/globaltemplatesedit.aspx?path=../tools/&filename=rss.aspx&templateid=1&templatename=Default，写入aspx木马。 2、写入aspx木马后，访问http://127.0.0.1/tools/rss.aspx就可以了。 漏洞证明：...

Discuz! NT 3.1.0 后台拿webshell

简要描述： 通过后台写入aspx木马，直接拿到webshell，然后获取整个服务器权限。 详细说明： 1、访问http://127.0.0.1/admin/global/globaltemplatesedit.aspx?path=../tools/&filename=rss.aspx&templateid=1&templatename=Default，写入aspx木马。 2、写入aspx木马后，访问http://127.0.0.1/tools/rss.aspx就可以了。 漏洞证明：...

Discuz!NT 2.*-3.5.2 SQL注入漏洞

Discuz!NT 是康盛创想Comsenz旗下的一款功能强大的基于 ASP.NET 平台的社区软件。ajaxtopicinfo.ascx用户控件 poster SQL注入漏洞。结合ajax.aspx调用任意用户控件漏洞 admin/UserControls/ ajaxtopicinfo.ascx 函数 GetCondition WebsiteManage.cs //62 行 if posterlist != "" string poster = posterlist.Split','; condition += " AND poster in "; string tempposerli...

Discuz!NT 2.x - 3.5.2 SQL注入

简要描述： Discuz!NT 是康盛创想Comsenz旗下的一款功能强大的基于 ASP.NET 平台的社区软件。 详细说明： ajaxtopicinfo.ascx用户控件 poster SQL注入漏洞 漏洞证明： 文件 admin/UserControls/ ajaxtopicinfo.ascx 中 转到函数 GetCondition WebsiteManage.cs //62 行 if posterlist != "" string poster = posterlist.Split','; condition += " AND poster in "; string...

Discuz! NT 2.* -3.5.2 SQL injection vulnerability 0day-vulnerability warning-the black bar safety net

| Vulnerability description: Discuz! NT is the Kang Sheng Chong thinkComsenzits a powerful based on ASP.NET platform community software. ajaxtopicinfo. ascx user control poster SQL injectionvulnerabilities. Combined with ajax. aspx call any user control vulnerability Vulnerability file:...

Discuz! X2 Beta 存储型XSS

简要描述： Discuz! X2 Beta 存储型XSS 详细说明： Discuz! X2 Beta 【家园】相册描述 存储型XSS漏洞。 漏洞证明：...

Discuz! 6.0 存储型XSS

简要描述： Discuz! 6.0 存储型XSS 详细说明： Discuz! 6.0 【店铺介绍】存在XSS漏洞 不知道如何访问店铺（没找到这功能！？），所以不知道这个XSS是只跨自己还是跨任何访问店铺的人。 因为这个地方的xss（alert（/Liscker/;）跟去年发的那个【个性签名】 的xss一样，所以个人极度认为这个也是只能跨自己的，只能结合其它漏洞一起来用了。 漏洞证明：...

DZ-X1. 5 Forum latest backstage get WebShell-vulnerability warning-the black bar safety net

Discuz! X is Kang Sheng Chong want Comsenz launch of a community-based professional jianzhan platform, Forum, BBS, the personal space of SNS, the portal（Portal）, group Group, application of open platform the Open Platform for full integration in one, help website realize one-stop service. Look...

DISCUZ X1. 5 vulnerability-vulnerability warning-the black bar safety net

DISCUZ X1. 5 local file inclusion vulnerability Affected versions: DISCUZ X1. 5 other version unknown Vulnerability type: local file inclusion vulnerability Vulnerability analysis: DISCUZX1. 5 local file inclusion, of course, is conditional, is to use a file as a cache. configglobal.php...