618 matches found
Discuz!NT 2.x - 3.5.2 SQL注入
简要描述： Discuz!NT 是康盛创想Comsenz旗下的一款功能强大的基于 ASP.NET 平台的社区软件。 详细说明： ajaxtopicinfo.ascx用户控件 poster SQL注入漏洞 漏洞证明： 文件 admin/UserControls/ ajaxtopicinfo.ascx 中 转到函数 GetCondition WebsiteManage.cs //62 行 if posterlist != "" string poster = posterlist.Split','; condition += " AND poster in "; string...
Discuz! X2 Beta 存储型XSS
简要描述： Discuz! X2 Beta 存储型XSS 详细说明： Discuz! X2 Beta 【家园】相册描述 存储型XSS漏洞。 漏洞证明：...
Discuz! 6.0 存储型XSS
简要描述： Discuz! 6.0 存储型XSS 详细说明： Discuz! 6.0 【店铺介绍】存在XSS漏洞 不知道如何访问店铺（没找到这功能！？），所以不知道这个XSS是只跨自己还是跨任何访问店铺的人。 因为这个地方的xss（alert（/Liscker/;）跟去年发的那个【个性签名】 的xss一样，所以个人极度认为这个也是只能跨自己的，只能结合其它漏洞一起来用了。 漏洞证明：...
DZ-X1. 5 Forum latest backstage get WebShell-vulnerability warning-the black bar safety net
Discuz! X is Kang Sheng Chong want Comsenz launch of a community-based professional jianzhan platform, Forum, BBS, the personal space of SNS, the portal（Portal）, group Group, application of open platform the Open Platform for full integration in one, help website realize one-stop service. Look...
DISCUZ X1. 5 vulnerability-vulnerability warning-the black bar safety net
DISCUZ X1. 5 local file inclusion vulnerability Affected versions: DISCUZ X1. 5 other version unknown Vulnerability type: local file inclusion vulnerability Vulnerability analysis: DISCUZX1. 5 local file inclusion, of course, is conditional, is to use a file as a cache. configglobal.php...
discuz x1.5 discuz 7.2 后台getshell 0day通杀版
简要描述： xml过滤不严导致漏洞产生 详细说明： 方法为： 后台：插件--添加插件--请选择导入方式:上传本帖附件中的XML文件 并同时勾选上 允许导入不同版本 Discuz! 的插件易产生错误!! 然后确认 不懂的可以看演示动画。。 shell地址就为：data/plugindata/shell.lang.php discuz x1.5 shell地址就为：data/plugin/data/shell.lang.php discuz 7.2 漏洞证明：...
Discuz! 2 0 1 1 All version background get Webshell 0day-vulnerability warning-the black bar safety net
From Discuz! Ancient 6. 0 version, the vulnerabilities are present in the extensions, use differently, the following start. A Discuz! 6.0 and Discuz! 7.0 Since you want the background to take the Shell, the file is written to Must-see. /include/cache.func.php ! To turn on,find the calling functio...
Discuz X Series Xss vulnerability small collection-vulnerability warning-the black bar safety net
/ Title:Discuz X Series Xssvulnerability small collection Author:sogili@0xsec From:0xsec.org Website:0xsec.org & amp; sogili.com / Discuz X version series smallXssthe vulnerability of the collection. Relates to the Discuz x1. 0 & x1. 5 version. Plus QQ bookmarkXssone. sogili whine when you Tinker...
Discuz entertainment Hall plug-in V1. 0 injection vulnerability and fix-vulnerability warning-the black bar safety net
| Author:0x0F From:0xsec.org Vulnerability Details: sid variable without filtration generated SQL injection. Exploits:http://site/plugin. php? id=huxhall:huxhall&sid=1 You know. KeyWords:inurl:huxhall:huxhall Related companies:Le tour network HappyYux.com Repair Methods:filtration Has a patch:No...
discuz 7.2 code execution vulnerability using the method of two-vulnerability and early warning-the black bar safety net
Use the exp while only the machine testing, and other purposes at your own risk! The first method: First register a user and then put form method="post" action=" http://www.xxx.com/bbs/misc.php" enctype="multipart/form-data" Post ID, specify the presence of a post:input type="text" name="tid"...
Discuz!官方漫游论坛搜索跨站漏洞
简要描述： 过滤转义......可盗COOKIE；挂马，等等。 详细说明： 过滤转义......可盗COOKIE；挂马，等等。 漏洞证明： http://search.discuz.net/f/search?q=%5C%5C&sId=1000&ts=1295648016&mySign=3492ca46&qs=client@￥@"@&menu=1&isAdv=&menu=1&rfh=1&searchLevel=3&author=&threadScope=all&timeLength=0&orderField=default...
Discuz Xss 0day exploit method-vulnerability warning-the black bar safety net
Made it last year using discuz tastelessxssone of the ideas and specific code. discuz x Series on all of the following version of the personal information provided in the personal signature of a presence of a persistent type byXSSvulnerability: for example, in the Modify personal signature, and...
discuz登陆页存在跨站弱点
简要描述： 版本。7.2.7.1都可以X。。只是试了几个站。 其他版本没测试。 详细说明： 文件出在faq.php。。faq.php?action="alert'XSS'search& 提交到本页面。然后登陆 。。跨站形成。 漏洞证明： 测试站点：...
Discuz x 1.5 小松鼠(Discuz! X1.5 xss)
简要描述： 开发人员疏忽. 详细说明： 在发帖时输入imgjavascript:alert/sogili//img 漏洞证明： 自己去看咯...
Discuz non-founder administrator code execution-vulnerability warning-the black bar safety net
| by:alibaba global.func.php function sendpm$toid, $subject, $message, $fromid = " 0 2 if$fromid === " 0 3 requireonce DISCUZROOT.'./ ucclient/client.php'; 0 4 $fromid = $discuzuid; 0 5 0 6 if$fromid 0 7 ucpmsend$fromid, $toid, $subject, $message; 0 8 else 0 9 global $promptkeys; 1 0...
Discuz 7.2 存储型XSS
简要描述： Discuz 7.2 存储型XSS，可编写蠕虫传播。 详细说明： discuz 7.2 个人空间发表博客，默认管理员可编辑源码，但管理员可在后台设置权限允许普通用户编辑。 该处存在XSS弱点，可编写蠕虫进行传播。每个用户的表单hash值可在html获得，不需要考虑salt，获得cookie即可。 漏洞证明： discuz 7.2 进行表单提交时每个用户的表单hash值不一样，但是固定的，该值可在访问用户的html中获得。如图： 然后将hash代入组包，编写蠕虫即可。 var...
Discuz! 7.2 the following versions and various uc products api interface to Get webshell vulnerability-vulnerability warning-the black bar safety net
For dz, we are more concerned about is to get the shell, but the dz stuff want to take the shell too hard too difficult, on an article at the end of the bedding the next, so this article is also not on the horse after cannon....this vulnerability has been in the discuz! x1 version quietly give up...
Discuz! 7.1 & 7.2 back office remote code execution vulnerabilities and fixes-vulnerability warning-the black bar safety net
Beginning with the reception code is executed together with the see, this clear the code execution, see the estimates also a lot of good adhere to for so long has no one posted this half a year also used a lot of times, but...but eventually someone couldn't resist to publish, you know, published ...