Knight CMS Talent System Arbitrary File Deletion Vulnerability

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS Talent System v3.7 exists arbitrary file deletion vulnerability, due to the variable $filename does not perform effective filtering, attackers can exploit the vulnerability to traverse the deletion of arbitrar...

Knight CMS Talent System SQL Injection Vulnerability

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS Talent System v3.7 exists SQL injection vulnerability, due to the variable $id filtering was omitted to cause injection, attackers use the vulnerability to obtain sensitive information...

骑士CMS SQL注入前台GETSHELL

No description provided by source...

骑士CMS某接口1处SQL盲注#1(官网demo测试)

简要描述： 骑士CMS某接口1处SQL盲注官网demo测试 详细说明： 手机客户端接口存在SQL注入，SELECT注入无关键字过滤,理论上可以获取任意数据。 ： http://demo.74cms.com/android/resume.php 代码： 15 if !empty$aset'displayorder' 16 17 $arr=explode'',$aset'displayorder'; 18 $arr1=pregmatch'/asc|desc/',$arr1?$arr1:"desc"; 19 if $arr0=="rtime" 20 21 $orderbysql=" ORDER...

骑士CMS某新功能4处SQL注入

简要描述： 骑士CMS官网某新功能4处SQL盲注，官网测试。 详细说明： 官网培训信息搜索和猎头工作搜索等4处SQL盲注。 0x01: 当前位置：首页 教育培训 课程列表 搜索课程 http://demo.74cms.com/train/train-curriculum-list.php?district=&category=&sdistrict=&classtype=&start=&refre=&sort=hot%3Edesc&key= 参数sort存在SQL注入,desc后面的字符串全部带入SQL：...

骑士CMS某新功能SQL注入

简要描述： 骑士CMS某新功能SQL注入 详细说明： http://demo.74cms.com/ 培训中心SQL注入。所以先注册一个培训中心的账号，然后去发不新课程， 课程名用：cname'/, 其他的随便填写。 然后使用用户的身份登录其申请课程： 随便填写： 提交即返回错误： 我们把其他说明改为： /,3,1, 200, concatuser,0x0a,version , 1, 1413525884 然后提交即成功。 这个时候用培训中心的账号，查看课程申请：...

Knight CMS SQL injection vulnerability-vulnerability warning-the black bar safety net

Knight CMS personnel system, ajaxoutput. php page parameter filter is not strict thereSQL injectionvulnerabilities. Vulnerability file: ajaxoutput.php $categoryid=trim$GET'categoryid'; if $categoryid+00 && intval$categoryid==$categoryid //only if the judge did not perform EXP: the...