Shopify: create staff member without owner access

Hi as you mentioned in 56726 "Only the the store owner is allowed to create new staff members" admins can't create new staff members! but with this vulnerability admins can use api to create user! steps: - get access token for one full access admin you can send request to xauth or sniff it from...

Zaption: CSV Excel Macro Injection in Export Response

Scenario: An attacker creates a response like =AND21 in a tour that allows open response or discussion. Then when a user who created this tour clicks analytic and clicks to export responses as csv, he will see TRUE instead of =AND12 Meaning that cell is now active, and an attacker could make a...

FineCMS高级版前台getshell(demo成功)

简要描述： demo也shell了哦 详细说明： 看到\member\api\uc.php define'DISCUZROOT', dirnamedirnamedirnameFILE.'/member/ucenter/'; include DISCUZROOT.'api/uc.php'; 就是包含了uc的那个插件。但是这个功能只有高级版才有，免费版没有 然后uckey都是默认的 8808cer8o1UJsEpt2G2Jn0uhEn/YgEva589Mfo0 然后就可以直接getshell了 附上脚本 ! /usr/bin/env python coding=utf-8 import...

QiboCMS /member/special.php SQL注入

No description provided by source...

DedeCMS V5.7 SP1 /member/mtypes.php SQL注入漏洞

No description provided by source...

XerCMS 20150528 /XerCMS/Modules/member/index.php SQL注入

No description provided by source...

InVision: Deleting a Project for which the user is not owner but a normal member

A Project member who is not the owner of the project does not have delete option. But using proxy tool like Burp Suite, a low privilege Project member user can delete the Project, Where only the project owner has the privilege to delete the project. Pre-Requisite: A project where current user is...

JeeCMS Government Service Center Member Reservation SQL Injection Vulnerability

JEECMS is the domestic Java version of the open source web content management system java cms, jsp cms for short. JeeCMS Government Government Service Center , member reservation function SQL injection vulnerability exists. Allow attackers to exploit the vulnerability to obtain sensitive...

WordPress WP Symposium Plugin 15.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin wp-symposium Unauthenticated SQL Injection Vulnerability Date: 2015-07-30 Exploit Author: PizzaHatHacker Vendor Homepage: http://www.wpsymposium.com/ Version: ? = version = 15.5.1 Tested on: Apache / WordPress...

ntpda.com XSS vulnerability

Vulnerable URL: http://www.ntpda.com/member-search.cfm Details: Description| Value ---|--- Patched:| Yes, at 22.08.2015 Latest check for patch:| 22.08.2015 05:51 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 2 VIP...

dadecitychamber.org XSS vulnerability

Vulnerable URL: http://www.dadecitychamber.org/Dade%20City%20Chamber%20Member%20Search.cfm?who Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 8339080 Google Pagerank| 4 VIP website...

金蝶shop商城后台弱口令泄露大量商家/会员信息/订单/网站信息

简要描述： 之前报的洞走了大厂商竟然就给了1rank，桑心啊，深夜挖洞挺不容易的，求给良心rank。。。 详细说明： 直接上图证明吧，出现问题的域名。 http://k3shop.k3cloud.kingdee.com/ 大致的扫了下网站目录，找到后台可直接登录admin用户！ 泄露的网站信息 http://k3shop.k3cloud.kingdee.com/sitemap.xml 漏洞证明： 订单信息 商家信息 会员信息...

SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:1264-1)

PostgreSQL was updated to the security and bugfix release 9.3.8 including 9.3.7. Security issues fixed : - CVE-2015-3165, bsc931972: Avoid possible crash when client disconnects just before the authentication timeout expires. - CVE-2015-3166, bsc931973: Consistently check for failure of the print...

phpyun_v4.0.0625最新版注入（可获取部分数据）

简要描述： RT 详细说明： 出现在wap\member\model\index.class.php中 function rinfoaction if$GET'type'&&intval$GET'id' $nid=$this-obj-DBdeleteall"resume".$GET'type',"eid='".int$GET'eid'."' and id='".int$GET'id'."' and uid='".$this-uid."'"; if$nid $url=$GET'type';...

WordPress Ultimate Member 'class.p.php' plugin cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Ultimate Member 'class.p.php' plugin due to the program failing to adequately filter user-supplied inpu...

fineCMS免费版注入再来一弹

简要描述： 抢先呵呵!!! 详细说明： 问题文件： /controllers/member/InfoController.php public function favoriteAction $favorite = $this-model'favorite'; if $this-isPostForm $ids = ''; foreach $this-post'ids' as $i $ids.= ','.int$i; $ids = trim$ids, ','; if empty$ids $this-memberMsglang'm-inf-11'; $ids = @implode',',...

fineCMS免费版某处又一sql注入

简要描述： 这次让我先呵呵！！！ 详细说明： 会员中心，文章-先发表一篇文章，然后去修改，看看修改的代码 controllers/member/ContentController.php public function editAction 。。。。 if $this-post'submit' $data = $data; unset$data; $data = $this-post'data'; /printr$data; exit;/ if empty$data'title' $this-memberMsglang'm-con-13'; if $data'catid' != $cat...

Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS)

The Ultimate Member plugin utilizes the Redux Framework. The Redux Framework includes a script named ‘class.p.php’, which acts as a HTTP proxy. Utilizing this script, it is possible to trigger a Reflected XSS attack, by loading data from a location controlled by the attacker. The data from this...

Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS)

The Ultimate Member plugin utilizes the Redux Framework. The Redux Framework includes a script named ‘class.p.php’, which acts as a HTTP proxy. Utilizing this script, it is possible to trigger a Reflected XSS attack, by loading data from a location controlled by the attacker. The data from this...

WordPress Ultimate Member Plugin <= 1.2.994 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability, because attackers load data from a location. After that, data from that location is output on the target domain and JavaScript is executed under the context of the current user of the site. Solution Update the plugin...