CVE-2011-5077

Unrestricted file upload vulnerability in attachement.php in HDWiki 5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in image directory...

CVE-2011-5076

SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php. NOTE: some of these details are obtained from third party information...

Unrestricted file upload

Unrestricted file upload vulnerability in attachement.php in HDWiki 5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in image directory...

CVE-2011-5076

The CVE-2011-5076 entry describes an SQL injection in HDWiki’s model/comment.class.php for HDWiki 5.0/5.1 (and possibly other versions), exploitable via PATH_INFO to index.php, allowing remote execution of arbitrary SQL commands. Root cause: unsafe SQL construction in the affected file. Documents...

CVE-2011-5077

Vulnerability : HDWiki 5.0 contains an unrestricted file upload in attachement.php that lets remote attackers execute arbitrary code by uploading a file with an executable extension and retrieving it from the image directory. Root cause : improper validation/handling of uploaded files enabling ar...

CVE-2011-5076

SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php. NOTE: some of these details are obtained from third party information...

Hudong HDWiki 5.1 URI SQL注入漏洞

hdwiki是互动百科开发的一款免费建站，自助建站程序 HDWIKI V5.0 基本上没有对输入的变量进行过滤,存在多个sql注入漏洞，如发表评论的地方存在代码注入问题 另外HDwiki中某些上传功能存在安全漏洞，通过一些数据即可绕过上传限制，最终获得shell 0 HDWiki 5.1 厂商解决方案 目前没有详细解决方案提供： http://kaiyuan.hudong.com/ POST /hdwiki/index.php?attachment-uploadimg HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg,...

HDWIKI tasteless 0day-vulnerability warning-the black bar safety net

Author: thanks Blog: http://hi.baidu.com/thanks4sec Release date: 2011-10-10 HDWIKI official website: http://kaiyuan.hudong.com/ Affected versions: HDWIKI all ----------------------------------- Looking for a long did not find echo, but tasteless so made a Have thought better of using the method...

HDwiki文件上传导致远程代码执行漏洞

简要描述： 互动维客开源系统（HDwiki）作为中国第一家拥有自主知识产权的中文维基（Wiki）系统，由互动在线（北京）科技有限公司于2006 年11月28日正式推出，力争为给国内外众多的维基（Wiki）爱好者提供一个免费、易用、功能强大的维基（Wiki）建站系统。HDwiki的推出，填补了中文维基（Wiki）建站系统的空白 但是HDwiki中某些上传功能存在安全漏洞，通过一些数据即可绕过上传限制，最终控制远程站点 详细说明： lib/file.class.php中 function uploadfile$attachment,$target,$maxsize=1024,$isimage...

HDWiKi V 5.0 local include vulnerability 0Day-vulnerability warning-the black bar safety net

Release date: 2011-01. 2 3 Publishing author: HYrz Affected versions: HDWiKi V 5.0 Official website: http://kaiyuan.hudong.com Vulnerability type: a file that contains Vulnerability description: From the source code see there is indeed a problem,we just Upload a picture of the Trojan can be norma...

HDWiKi V 5.0 local contains 0Day-vulnerability warning-the black bar safety net

| 漏洞 文件 :\install\install.php Key code: ? php errorreportingEERROR | EWARNING | EPARSE; define'INHDWIKI', TRUE; define'HDWIKIROOT', '../'; $langname=$COOKIE'langname';/langname without any filter,direct from the Cookies deposited in langname/ ifisset$REQUEST'lang' / Detect whether the variable is...

HDWiki Encyclopedia program background Getshell vulnerabilities-vulnerability warning-the black bar safety net

HDWiki using the template mechanism, the template is compiled will be saved to the data/view directory for php files, after the show template and the include it, Cause you can get a webshell Vulnerability code in lib/template. class. php file: function display$file//show the template by...

HDWiki-V4. 0. 5 proof 0day cross site vulnerability-vulnerability warning-the black bar safety net

Effects: the HDWiki-V4. 0. 5 Degree of harm: high-risk Vulnerability description: Ann-day lab Safety research and Emergency Response Center of Antiy CERT by penetration testing found the HDWiki-V4. 0. 5 This version in the Create and edit entries, for inside the HTML element does not have very go...

Quick search hdwiki a code execution vulnerability-vulnerability warning-the black bar safety net

By q1ur3n http://www.wolvez.org/ 2008-11-14 Talk about the process now,of course,such a hole is very low, is purely for everyone's entertainment.: Installed hdwiki after I registered for a named testtest to the user, and then cmd next cd to hdwiki directory, execute findstr /s /i /n "testtest"...