用友某系统任意文件删除漏洞

简要描述： 用友FE协同办公系统某处验证不严，导致任意文件删除漏洞 详细说明： 漏洞影响版本V5.5.2 漏洞文件：/sys/filesetup/deletefolder.jsp?path= 漏洞参数：path /sys/filesetup/deletefolder.jsp源代码如下： --------------------------------------------- alert"删除成功！"; var reloadSrc=parent.westFrame; reloadSrc.location.href=reloadSrc.location.href;...

用友FE办公平台通用SQL注入（2个）

简要描述： 用友FE办公平台通用SQL注入（2个） 详细说明： SQL注入1 漏洞文件及参数 /witapprovemanage/report/depReimburse.jsp?depid=1 漏洞证明： sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" --dbs...

用友协作办公平台通用多处SQL注入

简要描述： RT 详细说明： 开发公司：用友软件 程序名称：FE协作办公平台 漏洞类型：SQL注入（GET） 漏洞文件：assetsGroupReport目录下多文件存在注入 /assetsGroupReport/vendorContacts.jsp?unitCode=11&cVenCode=22&startDate=2012-01-01&endDate=2012-02-01...

用友某系统存在通用SQL注入

简要描述： 用友某系统存在通用SQL注入 详细说明： 用友FE协作办公平台最新版 漏洞url: /security/roleadduser.jsp?dept=1&roleid=2&searchValue=3 部分代码 其中searchValue存在注入。 证明： http://oa.jiada.cc:9090/security/roleadduser.jsp?dept=1&roleid=2&searchValue=3 http://oa.shunhengli.com:9090/security/rolead...

用友某办公自动化平台漏洞之2-任意文件下载

简要描述： 程序未对下载目录做限制导致任意文件下载 详细说明： FE协作办公平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下 直接传递文件的路径即可下载任意文件 http://218.249.130.74/download.fe?filePath=e:/OA/Media/TemplateOfTaohong//../../../OA/database/feapp5.mdf 漏洞证明： FE协作办公平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下...

Heap overflow

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA...

Heap overflow

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA...

Sql injection

SQL injection vulnerability in the FE user statistic festat extension before 0.2.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2010-4952

The CVE-2010-4952 issue affects the TYPO3 FE user statistics extension festat, vulnerable in versions before 0.2.4 due to an SQL injection flaw that allows remote attackers to execute arbitrary SQL via unspecified vectors. The vulnerability can impact confidentiality, integrity, and availability ...

GalleryPal FE 1.5 - Authentication Bypass

GalleryPal FE 1.5 - Authentication Bypass ------------------------------------------------------------ GalleryPal FE v1.5Auth Bypass TYPE:Remote SQL Injection Vulnerability ---------------------------------------------------------- author: R3d-D3v!L Date: 15.11.2008 Home: www.ahacker.net contact:...

GalleryPal FE 1.5 - Authentication Bypass

------------------------------------------------------------ GalleryPal FE v1.5Auth Bypass TYPE:Remote SQL Injection Vulnerability ---------------------------------------------------------- author: R3d-D3v!L Date: 15.11.2008 Home: www.ahacker.net contact: N/A...

GalleryPal FE v1.5(Auth Bypass)

Exploit for unknown platform in category web applications =============================== GalleryPal FE v1.5Auth Bypass =============================== ALERT FR0M THE DARKNESS BY 7h3 REd-D3v!L Exploit: username : admin password : X' or ' 1=1-- demo: server/GalleryPalFEDemo/login.asp 0day.today...

CVE-2009-2365

SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

SQL injection vulnerability in login.asp in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5 allows remote attackers to execute arbitrary SQL commands via the 1 password parameter in 1.1 and 2 ppassword parameter in 1.5. NOTE: some of these details are obtained from third party information...

CVE-2009-2365

SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-2365

CVE-2009-2365 describes a SQL injection vulnerability in the login.asp page of DataCheck Solutions GalleryPal FE 1.5. The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors. The impact is partial confidentiality, integrity, and availability as per the NVD desc...

CVE-2009-2366

CVE-2009-2366 describes an SQL injection in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5. The vulnerability stems from unsafely handling user-supplied credentials in login.asp, specifically the (1) password parameter for ForumPal FE 1.1 and (2) p_password for ForumPal 1.5, allowing remote...

Buffer overflow

Off-by-one error in the eventwallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to cause a denial of service crash via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow...

Icarus 2.0 - '.pgn' Local Stack Overflow (SEH)

usage: exploit.py print "" print " Icarus 2.0 Local Stack Overflow Exploit\n" print " Download: http://www.randomsoftware.com/pub/icarus.exe" print " Author : His0k4" print " Tested on: Windows XP Pro SP2 Fr\n" print " Greetings to:" print " All friends & muslims HaCkersdz\n" print " Tip of the...