CVE-2018-15198

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2018-15198

CVE-2018-15198 affects OneThink v1.1. A CSRF in admin.php?s=/User/add.html can add a user. Exploitation context and impact are described (CVSS2/3: base scores 6.8/8.8; network vector, no auth, user interaction required). No remediation/patch details are provided in the connected documents; no add...

CVE-2018-15197

CVE-2018-15197 affects OneThink v1.1. A CSRF in admin.php?s=/AuthManager/addToGroup.html could grant administrator privileges, enabling privilege escalation. The issue is described across multiple feeds (NVD/Red Hat/CVEs) as allowing an attacker to endow admin rights; no public exploit details or...

CVE-2018-15198

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

OneThink Cross-Site Request Forgery Vulnerability

Onethink is a ThinkPHP-based content management framework for web development . A cross-site request forgery vulnerability exists in the admin.php?s=/AuthManager/addToGroup.html page in OneThink version 1.1. A remote attacker can exploit this vulnerability to gain administrator privileges...

OneThink Cross-Site Request Forgery Vulnerability (CNVD-2018-14976)

Onethink is a ThinkPHP-based content management framework for web development . A cross-site request forgery vulnerability exists in the admin.php?s=/User/add.html page in OneThink version 1.1. A remote attacker can exploit this vulnerability to add users...

Onethink Ueditor Server-Side Request Forgery Vulnerability

Onethink is a content management framework for web development based on ThinkPHP.Ueditor is one of the HTML editors. A server-side request forgery vulnerability exists in the getRemoteImage.php file of Ueditor in Onethink version 1.0 and 1.1. A remote attacker can exploit this vulnerability with...

CVE-2017-14323

SSRF Server Side Request Forgery in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter...

CVE-2017-14323

SSRF Server Side Request Forgery in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter...

CVE-2017-14323

CVE-2017-14323 describes a Server-Side Request Forgery (SSRF) in Onethink’s Ueditor component, specifically in getRemoteImage.php used by Onethink V1.0 and V1.1. An attacker can use the upfile parameter to fetch or reach internal network resources and, per sources, potentially trigger remote comm...

Onethink CMS Server Side Request Forgery Vulnerability

Onethink CMS versions released up to date 2018/04/06 suffer from a server-side request forgery vulnerability. SSRFPS"Server Side Request ForgeryPSc in Onethink All version CVE-2017-14323 The Onethink is an open source CMSContent Management System.This system is based on the Thinkphp3.2 developmen...

Onethink CMS Server Side Request Forgery

SSRFPS"Server Side Request ForgeryPSc in Onethink All version CVE-2017-14323 The Onethink is an open source CMSContent Management System.This system is based on the Thinkphp3.2 development framework. Product Download: http://www.onethink.cn Vulnerability TypePSoSSRFPS"Server Side Request ForgeryP...

OneThink Frontend Cache Mechanism Has Design Flaw Vulnerability

OneThink is an open source content management framework developed by ThinkPHP team based on ThinkPHP. OneThink front-end caching mechanism has a design flaw vulnerability. Since the program caches registered usernames to a cache file in the temp directory, and the cache file has executable...

onethink reception code execution vulnerability

No description provided by source...

ThinkOX full version through the kill 0day-vulnerability warning-the black bar safety net

Affected versions: ThinkOX the full version of the pass to killonethink and thinkphp framework may be affected, particularly too lazy to do it, who are interested in your own analysis. Vulnerability description: Through a dynamic caching mechanism, the input illegal content. Malicious execution o...

ThinkPHP框架架构上存在SQL注入

简要描述： ThinkPHP框架本身缺陷导致SQL注入漏洞，基本影响所有使用ThinkPHP开发的应用，包括thinksns、onethink等，这里以thinkphp自家的OneThink为例。 这个猛料，希望能加精呀 详细说明： 很多人天真的以为，使用了框架提供的数据库查询方法，不再进行SQL语句拼接，就能完美避免SQL注入。那么你就错了，有时候框架反而成为带你进入陷阱的人。 我们翻开最新版thinkphp框架文档，其中的“表达式查询”章节：http://document.thinkphp.cn/manual32.htmlexpressquery...

OneThink内容管理框架官网储存型XSS攻击

简要描述： 此内容管理框架OneThink为ThinkPHP框架同公司产品。用到了ThinkPHP最新版本3.2。 详细说明： 今天刚开始分析该内容管理框架，说实话，很喜欢BootStrap，喜欢这款内容管理框架，所以决定与小伙伴一起为该内容管理框架的安全努力下去！继续以我的风格，先黑盒后白盒。 漏洞证明：...