Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none...

Design/Logic Flaw

dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none...

Multiple Design Logic Vulnerabilities in BageCMS Content Management System Backend

BageCMS is a multi-functional open source web content management system based on php5+mysql5 development. Two design logic vulnerabilities exist in the BageCms 3.1.3 backend, allowing attackers to exploit the vulnerabilities to gain server privileges...

Tencent QQ group system has design logic loopholes

Tencent QQ is an Internet-based instant messaging IM software. There is a design logic vulnerability in the Tencent QQ group system that allows an attacker to modify form information to lower the QQ group level...

Design Logic Vulnerabilities in Tianchu Information Technology Limited's Construction CMS System

Tianchu Information Technology Co., Ltd. is a technical company dedicated to website construction and operation, educational software development and e-commerce platform operation. A design logic vulnerability exists in Tianchu Information Technology Limited's construction CMS system, allowing...

Baidu Browser Has Design Logic Vulnerabilities

Baidu Browser is a simple, lightweight and intelligent browser that understands you. Relying on Baidu's powerful search platform, it integrates the advantages of Baidu's business system to bring users a more convenient way to browse and a more comfortable Baidu Internet experience on the basis of...

EduWind在线教育建站系统 MeController.php 逻辑漏洞可导致上传shell

No description provided by source...

Mao10CMS user_register.php 添加超级管理员逻辑漏洞

No description provided by source...

Automotive service O2O was raging, the product safety who to pay attention-vulnerability warning-the black bar safety net

Off to 2 0 1 5 years 4 months, our country motor vehicle retains the quantity has reached 2. 6 4 million vehicles, in the face of nearly a trillion level of automotive after-market, all kinds of automotive service O2O platform competing to rise, 2 0 1 4 years O2O automotive after-market field...

ThinkPHP设计缺陷导致逻辑漏洞造成密码找回绕过等问题

简要描述： 在不正确使用 ThinkPHP 时，可能会造成参数处理流程导致的逻辑漏洞。 详细说明： ThinkPHP 处理传入的参数的时候，如果直接带入一个数组，接着数组带入 SQL 语句，会产生之前 phithon 大牛爆的 0day： WooYun: ThinkPHP框架架构上存在SQL注入 利用方式很简单： data0=exp&data1=SQLI 然而，thinkphp 支持的不仅仅是 exp，像 like、in，都会支持。 也就是说，我们可以在很多地方精心构造一个参数，导致造成逻辑漏洞。比如找回密码、权限验证等。 我们传入： data0=like&data1=x%25...

74CMS一逻辑漏洞导致两处二次注入

简要描述： 74CMS一逻辑漏洞导致两处二次注入 详细说明： 1.首先还是注册一个企业用户，在注册的过程中用burp抓包，修改里面的username字段 username=1′,1,1001,1,user,1,1,1,1,1,1,1 — a 2.74cms本来是不允许注册带有特殊字符的用户名的，但是使用这样的方法可以绕过过滤，我们来看一下数据库。 3.我们再来看哪里对该用户进行了二次数据库操作。找了很久，看到了对很多操作都提供了日志记录的功能。writememberslog函数 function...

ourphp逻辑漏洞刷钱

简要描述： 如题 详细说明： 这是demo地址http://demo.ourphp.net 注册个小号上去随便买一件商品 以这件为例 http://demo.ourphp.net/?cn-shoppingcart.html-&ourphpcms=shopping 然后去结算。 结算的时候抓包，将ourphpopcms本来是699的，后面那个改成-100 然后最后结算就-100了 漏洞证明： 以上...

ALi CTF 2 0 1 5 write up-vulnerability warning-the black bar safety net

0x00 Cake Cake is a title of Android Title, The specific process is an input a string and then initialize a length of 1 by 6 Array, then the string with this array of xor. So we just need to xor it ok. Just look at the code in reverse, the key is there are two Key looking for ok direct codes a= 0...

Design/Logic Flaw

futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors...

phpmps逻辑漏洞+存储xss demo测试成功

简要描述： demo站点测试成功 详细说明： 先注册一个账号 然后登陆 然后我们看到个人中心那 点击发布也是发布不了的 我们可以访问 http://www.phpmps.com/demo/postcom.php post提交 act=postok&catid=1&comname=a&areaid=1&phone=12&qq=12&[email protected] 就发布黄页成功了 本来发布不了的现在就可以绕过，发布成功了 这里存在逻辑漏洞 发布成功后 我们看下企业黄页这里 然后点击编辑 联系地址加入 alert/xss/ 点击确认后 https://...

Design/Logic Flaw

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via a crafted Type42 font...

ecshop一处验证码绕过逻辑漏洞

简要描述： 一处逻辑漏洞导致绕过 详细说明： 虽然验证码进行了加密，但是逻辑上还有点问题 问题出在 ..\includes\clscaptcha.php 通过验证函数可以看到直接返回，并没有对验证失败进行处理 function checkword$word $recorded = isset$SESSION$this-sessionword ? base64decode$SESSION$this-sessionword : ''; $given = $this-encryptswordstrtoupper$word; //MD5加密处理 return pregmatch"/$given/...

Design/Logic Flaw

Requests aka python-requests before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request...

acidcat cms 3.4.1 - Multiple Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: Acidcat CMS Multiple Vulnerabilities. Vendor: www.acidcat.com Vulnerable Version: 3.4.1 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/36 1. Description: Acidcat...