ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities

Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 27/09/2014 1 and 2, 09/11/2014 3 and 4 / Last updated:...

[The ManageOwnage Series, part V]: RCE / file upload / arbitrary file deletion in OpManager, Social IT and IT360

Hi, This is the fifth part of the ManageOwnage series. For previous parts, see: http://seclists.org/fulldisclosure/2014/Aug/55 http://seclists.org/fulldisclosure/2014/Aug/75 http://seclists.org/fulldisclosure/2014/Aug/88 http://seclists.org/fulldisclosure/2014/Sep/1 This time we have a file uploa...

Pimcore CMS 1.4.9 <2.1.0 - Multiple Vulnerabilities

Vulnerabilities in Pimcore 1.4.9 to 2.1.0 inclusive Discovered by Pedro Ribeiro [email protected] of Agile Information Security ==================================================================== Disclosure: 14/04/2014 / Last updated: 12/10/2014 Vulnerability: Remote code execution in Pimcore CMS...

Pimcore CMS 1.4.9 2.1.0 - Multiple Vulnerabilities

Pimcore CMS 1.4.9 2.1.0 - Multiple Vulnerabilities Vulnerabilities in Pimcore 1.4.9 to 2.1.0 inclusive Discovered by Pedro Ribeiro [email protected] of Agile Information Security ==================================================================== Disclosure: 14/04/2014 / Last updated: 12/10/2014...

YXcms最新版任意文件删除漏洞

简要描述： YXcms最新版可以删除任意文件 详细说明： 问题文件： \YXcms1.2.4\protected\apps\member\controller\inforController.php public function index if!$this-isPost $auth=$this-auth; $id=$auth'id'; $info=model'members'-find"id='$id'"; $this-info=$info; $this-path=ROOT.'https://images.seebug.org/upload/member/image/';...

FRHRCMS V3.0 /person/person_certificate.php 任意文件删除漏洞

No description provided by source...

YXCMS最新版绕过补丁继续任意文件删除

简要描述： YXCMS最新版绕过补丁继续任意文件删除 详细说明： 最早Matt牛在2013-12-30发的一个漏洞： WooYun: yxcms任意文件删除 导致的重新安装漏洞 厂商在2014-01-13发布了升级包，修改这个漏洞 但是处理的不严格，可以绕过，继续进行任意文件删除 看代码protected/apps/members/contoller/newscontroller.php if empty$FILES'picture''name' === false $tfile=date"Ymd"; $imgupload=...

CmsEasy multiple arbitrary file deletion to Getshell-a vulnerability warning-the black bar safety net

CmsEasy multiple arbitrary file deletion can directly delete the waf, the Getshell so Easy! Detailed description: CmsEasy in the background permission to verify the presence of defects, resulting in the landing of the bypass, and override the operation of the background. 1, in the background logi...

ManageEngine OpManager / Social IT Arbitrary File Upload Exploit

Exploit for java platform in category remote exploits Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro email protected, Agile Information Security ========================================================================== Background on the...

ManageEngine Code Execution / File Deletion

Hi, This is the fifth part of the ManageOwnage series. For previous parts, see: http://seclists.org/fulldisclosure/2014/Aug/55 http://seclists.org/fulldisclosure/2014/Aug/75 http://seclists.org/fulldisclosure/2014/Aug/88 http://seclists.org/fulldisclosure/2014/Sep/1 This time we have a file uploa...

WordPress Plugin Category and Page Icons Multiple Vulnerabilities

WordPress Plugin 'Category and Page Icons' have suffers from multiple vulnerabilities File Deletion/File Upload. Exploit Title : WordPress Plugin 'Category and Page Icons' Multiple Vulnerabilities Exploit Author : NULLPointer Date : 2014-09-29 Download Link :...

YXCMS1.2.6版本1处任意文件删除+6处越权操作

简要描述： YXCMS1.2.6版本1处任意文件删除+6处越权操作 详细说明： 经过简单的审计发现YXcms一处任意文件删除漏洞（不是wooyun上已经提交过的）和多处越权操作（只举出一例作为证明） 1. 任意文件删除漏洞 出这个漏洞的代码位于/protected/apps/member/controller/newsController.php的 delcover函数中： public function delcover //文件保存目录 $id=in$POST'id'; $pic=in$POST'pic'; $data'picture'= $this-nopic;...

Glype Proxy 1.4.9 Cookie Jar Path Traversal / Code Execution / Filter Bypass

A path traversal vulnerability has been identified in the Glype web-based proxy that allows an attacker to run arbitrary PHP code on the server or to remove critical files from the filesystem. Version 1.4.9 is affected. Glype Proxy version 1.4.9 suffers from a local address filer bypass...

Wordpress Theme Strange File Upload / File Deletion

Exploit for php platform in category web applications Exploit Title : Wordpress Theme Strange File Upload / File Deletion Exploit Author : NULLPointer Contact : https://www.facebook.com/xenith.gianni Date : 21/09/2014 Github Mirror :...

Wordpress Plugin FormCraft Premium Arbitrary File Deletion

The FormCraft v2.0.5 is a feature rich WordPress plug-in that provides you the perfect platform for creating the multiple forms with so many specific fields that supports retina graphics. It incorporates tons of styling options, Form validation, GUI form builder, custom widgets; support multiple...

FormCraft <= 2.0.5 - Arbitrary File Deletion

Successfully tested with v2.0.2...

U-mail一处SQL注入+任意文件删除

简要描述： U-mail一处SQL注入+任意文件删除 详细说明： oletterpaper.php 1.sql注入： if ACTION == "letterpaper-set" $url = makelink "option", "view", "letterpaper" ; $lpid = gss $POST'id' ; .... if $lpid $lpinfo = $Widget-getoneletterpaper "id=".$lpid, "", 0 ; 没啥好分析的，直接上exp...

Details Disclosed on Patched Webmin Vulnerability

The University of Texas information security office yesterday disclosed the details on a critical vulnerability in Webmin that was patched in May, days after it was reported. The bug in the UNIX remote management tool provided remote root access to a host server. Authenticated users would then be...

YiDacms最新版漏洞大礼包

简要描述： YiDacms最新版漏洞大礼包 详细说明： 易达CMS 企业建站系统 当前最新版本是：YidaCms X3.2（20140718）版 这里我们主要看看后台比较严重的漏洞 关于xss和sql注入我们就不多讲了，后台的SQL注入很多都没有用全局过滤，导致sql注入 首先来看看第一处目录遍历，任意文件读取，拿shell： 文件/Yidacms/admin/adminfso.asp： ElseIf action = "Edit" then '读取文件 Dim FileAll FilePath = TrimRequest.Form"ThisDir" FileName =...

ThinkSAAS 2.2 GET型CSRF到Getshell

简要描述： 后台Getshell本想在XSS漏洞里一起提交的。。。结果我给忘了。 不过后来发现这个洞是Get型的CSRF，利用方便，老少咸宜，在社区CMS中可以说威力无限呀。 详细说明： /app/system/action/plugin.php 83行： case "delete": $apps = $GET'apps'; $pname = $GET'pname'; delDir'plugins/'.$apps.'/'.$pname; qiMsg'删除成功！'; break; 获得了GET到的值以后拼接成路径以后传入delDir函数。delDir函数： / 删除文件夹和文件夹下所有的文...