CVE-2014-6230

WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header...

UFONet - DDoS attacks via Web Abuse (XSS/CSRF)

UFONet - is a tool designed to launch DDoS attacks against a target, using 'Open Redirect' vectors on third party web applications, like botnet. See this links for more info: - CWE-601:Open Redirect - OWASP:URL Redirector Abuse Main features: --version show program's version number and exit -v,...

WordPress WP-Ban 1.62 Bypass Vulnerability

WordPress WP-Ban plugin version 1.62 suffers from a bypass vulnerability when a properly minted X-Forwarded-For header is used. Details ================ Software: WP-Ban Version: 1.62 Homepage: http://wordpress.org/plugins/wp-ban/ Advisory report:...

WordPress WP-Ban 1.62 Bypass

Details ================ Software: WP-Ban Version: 1.62 Homepage: http://wordpress.org/plugins/wp-ban/ Advisory report: https://security.dxw.com/advisories/vulnerability-in-wp-ban-allows-visitors-to-bypass-the-ip-blacklist-in-some-configurations/ CVE: CVE-2014-6230 CVSS: 5 Medium;...

pageadmin注入漏洞

简要描述： rt 详细说明： 管理员登陆处。 获得管理员登陆ip并记录，获得ip方式有问题。 x-forwarded-for注入。 http://bbs.pageadmin.net/showtopic-28377.aspx 20140415 本机测试，X-FORWARDED-FOR:8.8.8.8','20140721'; select from pamember where @@version0 -- 。 官网,demo改了登陆url. /e/master/login.aspx 看ilspy里面的PageAdmin...

kppw威客系统SQL注入一枚

简要描述： rt 详细说明： 注册处。 function checkall$regusername, $regemail, $regcode global $lang,$K; $res1 = $this-checkip ; if$K'do' $url = 'index.php?do='.$K'do'; else $url = 'index.php?do=register'; $res1 === true or $result = $res1; $res2 = $this-checkusername $regusername ; $res2 === true or $result =...

FusionPHP Fusion News 3.3/3.6 X-ForwordedFor PHP Script Code Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13661/info FusionPHP Fusion News is prone to a remote PHP code injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. This may facilitate unauthorized access. ...

Admbook <= 1.2.2 (X-Forwarded-For) Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl -w use IO::Socket; print \r\n; print | Admbook =1.2.2 X-Forwarded-For cmmnds xctn xploit |\r\n; print | By rgod rgodATautisticiDOTorg |\r\n; print | site: http://retrogod.altervista.org |\r\n; print | |\r\n; print | Sun-Tzu: \Rouse him, and learn...

Jojo CMS X-Forwarded-For header SQL injection vulnerability-vulnerability warning-the black bar safety net

Affected system: Jojo CMS Jojo CMS 1.2.2 Description: -------------------------------------------------------------------------------- BUGTRAQ ID: 5 9 9 3 4 CVECAN ID: CVE-2 0 1 3-3 0 8 1 Jojo CMS is SEO-friendly, scalable, PHP-based CMS. Jojo CMS 1.2.2 previous version, the...

Sql injection

SQL injection vulnerability in the checkEmailFormat function in plugins/jojocore/classes/Jojo.php in Jojo before 1.2.2 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header to /articles/test/...

TRSWCM 后台权限绕过以及GETSHELL漏洞

简要描述： TRS WCM大于v6版本中存在此漏洞，v5.X版本不存在。无需登录。 详细说明： 注：该漏洞目前影响大量站点，担心厂商忽略导致漏洞细节提前曝光，请管理员同学转至cncert国家互联网应急中心进行处理，多谢。 在/WEB-INF/web.xml中代码如下： govcontroller com.trs.webframework.controler.servlet.NoLoginServiceControler AllowIP 127.0.0.1 CurrUser admin RedirectURI /center.do govcontroller /govcenter.do...

CmsEasy最新版本无限制SQL注射

简要描述： 版本号：CmsEasy 55020140420UTF8，SQL注射，程序员过于追求完美时，会忽略那些值得珍惜的人或事，比如女朋友（会有么?），比如这一处代码... 详细说明： /lib/default/useract.php 326行左右，及/lib/tool/frontclass.php 541行左右，有对ip是否正确的判断： if!pregmatch'/^0-9|1-90-9|10-92|20-40-9|250-5.30-9|1-90-9|10-92|20-40-9|250-5$/',...

YouYax论坛SQL注入漏洞

简要描述： 代码审计之SQL注入，针对这个严谨的厂商，有注入绝不能忍啊，必须是高啊。而且其他都做了addsalsh ，这个是漏的 详细说明： 问题出在register.php文件中 先说fuzz时候是怎么发现的 注册用户的时候发现在第二次注册会给出提醒 alert'注册失败，该IP地址已经使用超过了1次†'; 于是想着用XFF能不能绕过，果断添加X-Forwarded-For字段，就绕过了 然后在X-Forwarded-For这里，修改ip地址为1.1.1.1' and 1=1等等， 测试均成功，由此判断这里肯定是个注入，只不过是个盲注，在外面测试不太方便就没跑库 于是去看源码 关键代码...

IRCCloud: Host Header Injection - irccloud.com

Host Header Injection Attack - irccloud.com An attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. This header specifi...

PHPEMS (在线考试系统) 注入 第一枚。

简要描述： 过滤不严。 详细说明： public function getClientIp if!isset$this-e'ip' if getenv"HTTPCLIENTIP" && strcasecmpgetenv"HTTPCLIENTIP", "unknown" $ip = getenv"HTTPCLIENTIP"; else if getenv"HTTPXFORWARDEDFOR" && strcasecmpgetenv"HTTPXFORWARDEDFOR", "unknown" $ip = getenv"HTTPXFORWARDEDFOR"; else if...

方维团购getshell和注射

简要描述： 。。。 详细说明： saveavatar.php: $REQUEST'm'="UcModify"; $REQUEST'a'="saveavatar"; include ROOTPATH."app/source/index.php"; //进去看看 app/source/index.php: ....沈略....... $ma = strtolower$REQUEST'm'.''.$REQUEST'a'; switch$ma case 'ucmodifysaveavatar': require...

phpwind官网SQL注入一枚

简要描述： X-forwarded-for注入 详细说明： X-forwarded-for注入 漏洞证明： phpwind v9.0软件下载处X-forwarded-for注入 http://nt.phpwind.com/tj.php?id=915&verify=d7798b1c15fa25ac6a47afeb20107654&sign=pw9utfzip&type=click...

程氏舞曲CMS最新php版本高危SQL注入漏洞

简要描述： 注入毫无限制！ 详细说明： 昨天刚下载的源码（应该最新的吧...） bug文件位置：https://images.seebug.org/upload/app/models/csdjskins.php第3466行 function GetIP //定义了一个获取ip地址的函数 if getenv"HTTPCLIENTIP" && strcasecmpgetenv"HTTPCLIENTIP", "unknown" //换取ip地址，如果存在，则使用clientip。 $ip = getenv"HTTPCLIENTIP"; else if...

CVE-2014-1401

Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 search parameter to mod/content/content.php or 2 CLIENTIP, 3 XFORWARDEDFOR, 4 XFORWARDED, 5 FORWARDEDFOR, or 6 FORWARDED HTTP header to index.php...

ecshop可绕过ip安全校验

简要描述： 伪造ip，绕过与ip相关的任何限制 详细说明： / 获得用户的真实IP地址 @access public @return string / function realip static $realip = NULL; if $realip !== NULL return $realip; if isset$SERVER if isset$SERVER'HTTPXFORWARDEDFOR' $arr = explode',', $SERVER'HTTPXFORWARDEDFOR'; / 取X-Forwarded-For中第一个非unknown的有效IP字符串 / foreach...