Open-Xchange Server and Open-Xchange AppSuite Front End Cross-Site Scripting Vulnerabilities

Open-Xchange Server is a semi-open source project mainly used for developing collaboration software; OX AppSuite is a set of Web cloud desktop environment. A cross-site scripting vulnerability exists in the dialogs for printing content in the Front End of Open-Xchange Server and OX AppSuite, whic...

Server: PHP arbitrary class instantiation in "files_external"

A user may instantiate arbitrary ownCloud classes due to a lack of a proper check of the mount point options provided by a user via the web front end. These may include constructor arguments and could potentially lead to a remote code execution. For more information please consult the official...

SOL17309 - Linux kernel vulnerability CVE-2015-5366

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can...

phpcms投票功能前台代码执行

No description provided by source...

Discuz 前台回帖 存储型 DOM XSS

产生原因： JS原生取ELEMENT中HTML内容的方法，会将服务端转义过的单双引号实体编码进行反转。 代码分析： 这里有payload: align="onmouseover="alert1, 那么就从payload开始往回看漏洞是怎么产生的 align="onmouseover="alert1 回帖之后payload显示如上述所示, 跟进 管理员/版主 编辑帖子时的操作 var editorid = 'e'; var textobj = $editorid + 'textarea'; 这里得到textobj = 'etextarea' /static/js/common.js...

WordPress Front End Repository Manager Plugin <= 1.1 - Arbitrary File Upload

Because of this vulnerability, users can upload malicious executable scripts. Solution Update the plugin...

WordPress Albo Pretorio Online 3.2 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Albo Pretorio Online 3.2 Multiple Vulnerabilities Google Dork: inurl:/?action=visatto Date: 09/06/2015 Exploit Author: Alessandro Cingolani Vendor Homepage: http://plugin.sisviluppo.info/ Software Link:...

Mao10cms最新版前台注入(有条件限制)

简要描述： Mao10cms最新版前台注入 详细说明： Mao10cms用户量不小，2015-06-25更新的V3.5.2，今天来学习一下吧 这个注入问题出现在模板文件中，有多个地方引用这个模板，这里说3个漏洞，是这个问题文件中存在多个注入点引用这个出问题的文件。 问题文件在/theme/default/article/single.php,看代码 ;" " 无关代码 看到文件...

Mao10cms最新版前台注入2枚打包

简要描述： Mao10cms最新版前台注入2枚打包，可出任意数据 详细说明： Mao10cms用户量不小，2015-06-25更新的V3.5.2，今天来学习一下吧 两个注入点，分别存在在于application/common/common/function.php/mctitle方法和application/common/common/function.php/mcseo中。注入产生的原因都是id没有过滤，这两个注入点前台可直接注入出数据。这里以application/common/common/function.php/mctitle为例进行说明。...

Wordpress Front-end Editor File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Wordpress Front-end Editor File Upload', 'Description' = %q The Wordpress Front-end Editor plugin contains an authenticated file...

WordPress Work The Flow 2.5.2 Shell Upload

Exploit Title : Wordpress Work the flow file upload 2.5.2 Shell Upload Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/work-the-flow-file-upload.2.5.2.zip Date : 2015-03-14 Tested on : Linux BackBox 4.0 / curl 7.35.0 Description: Work the Flow...

WordPress Plugin Work The Flow File Upload 2.5.2 - Arbitrary File Upload

WordPress Plugin Work The Flow File Upload 2.5.2 - Arbitrary File Upload Exploit Title : Wordpress Work the flow file upload 2.5.2 Shell Upload Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/work-the-flow-file-upload.2.5.2.zip Date : 2015-03-...

代码审计之PHPEMS前台四处注入&lt;官网demo演示&gt;

简要描述： 代码审计之PHPEMS前台四处注入 详细说明： 官网：http://phpems.net 官方演示站：http://phpems.net/2014 分析过程如下图： 漏洞证明： 证明： 需要清空cookie，代码条件 1、http://phpems.net/2014//index.php?exam-api-login GET /2014//index.php?exam-api-login HTTP/1.1 Host: phpems.net User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:36.0 Gecko/20100101...

phpems前台某4处getshell漏洞

简要描述： phpems前台某4处getshell漏洞 详细说明： 2.phpems前台某4处getshell漏洞 存在漏洞的代码在/app/document/api.php的upload,uploadfile,swupload,swfuploadvideo这四个函数上，因为这四个函数都是处理上传文件的，而且处理方式都一模一样，所以均存在任意文件上传漏洞 首先这四个函数通过注册用户登录，调整URL参数均可以访问到 接下来我以 public function swfuploadvideo $path = 'files/attach/images/content/'.date'Ymd'.'/...

FengCms1.30注入(前台)

简要描述： http://www.fengcms.com/ 最新版本1.30 详细说明： app\model\messageModel.php public function save$array if$SESSION'authnum'!=$array'vcode'||$SESSION'authnum'=="" return array'status' = 'c';exit; unset$array'vcode'; $re=D$this-dname-insert$array; if$re $SESSION'authnum'=""; return array'status' =...

phpyun v3.2 (20141222) 前台注入 #5

简要描述： 目测最后一发。 详细说明： 在member/model/blacklist.class.php中 function saveaction ifisarray$POST'buid'&&$POST'buid' $company=$this-obj-DBselectall"company","uid in".@implode',',$POST'buid'."","uid,name";//直接整合成字符串后 带入查询 没有经过自带的pylode处理 或者 intval 和单引号 导致了注入 foreach$company as $val...

PHPCMS Arbitrary Code Execution Vulnerability

PHPCMS is an open source content management system. An arbitrary code execution vulnerability exists in the front-end of PHPCMS, which allows attackers to exploit this vulnerability to execute arbitrary code...

Live Forms <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting (XSS)

Form input fields on the blog front end are not properly sanitised. The unsanitised user input will be displayed in "WordPress Admin Form entries". Screenshots: http://imgur.com/Oflsb3n http://imgur.com/jHaZR5O...

CmsEasy最新版5.5 存储型XSS导致GetShell

简要描述： n处XSS，我不信都插完打不到cookie，get不了shell -.- 详细说明： 第一处（只代码审计第一处，后面几处类似。都是没有过滤）： function loginfalse cookie::set'loginfalse',int cookie::get'loginfalse'+1,time+3600; event::log'loginfalse','失败 user='.front::post'username'; front::flashlang'登陆失败！'."".lang'backuppage'."";...

HackerOne: Breaking Bugs as team member

It is possible to break a bug page front-end as a team member. This is how it's done: 1. Go to a bug. 2. Select "Change State" - "Triaged". 3. Enter a random comment. 4. Intercept the POST request, change "message" to "message". The status change will be saved but the message will be null and not...