FreeBSD : piwigo -- CSRF/Path Traversal (edd201a5-8fc3-11e2-b131-000c299b62e1)

High-Tech Bridge Security Research Lab reports : The CSRF vulnerability exists due to insufficient verification of the HTTP request origin in '/admin.php' script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create arbitrary PHP file on the remote...

CVE-2013-0224

The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file...

Code injection

The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file...

Bubble Amoy（popotao）Amoy program official back door analysis-vulnerability warning-the black bar safety net

Bubble scouring is a pretty good Amoy built Station program, the official web site: http://www.popotao.com the. I was their one of the users of Since the official months are not updated to keep up with Taobao API update speed, so I want to solve on their own, put the official 6 a ZEND encrypted P...

piwigo -- CSRF/Path Traversal

High-Tech Bridge Security Research Lab reports: The CSRF vulnerability exists due to insufficient verification of the HTTP request origin in "/admin.php" script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create arbitrary PHP file on the remote...

Sky classroom file upload vulnerability-vulnerability warning-the black bar safety net

Brief description: Allow the upload of dangerous file type,this system is still a lot of Open the network course website, as shown in Figure, landing it, and now SkyDrive. Upload a PHP file, the web site didn't filter PHP file. ! 1 8-300x166. png ! 1 8-300x166. png ! 1 8-300x166. png After enteri...

Thinksns2. 8 file upload exploit exp-vulnerability warning-the black bar safety net

Vulnerability version The presence of vulnerabilities the version: latest 2. 8 stable version. Other version not test. Vulnerability file Vulnerable file is: thumb.php Author: Wei kunpeng 1, Prepare the following PHP file and upload it to the server yourself. File content as follows: ? php echo “...

PHPLiteAdmin 1.9.3 - Remote PHP Code Injection

PHPLiteAdmin 1.9.3 - Remote PHP Code Injection Exploit Title: phpliteadmin phpliteadmin.php1785: 'When you create a new database, the name you entered will be appended with the appropriate file extension .db, .db3, .sqlite, etc. if you do not include it yourself. The database will be created in t...

WordPress WP-Property PHP file upload vulnerability-vulnerability warning-the black bar safety net

WordPress WP-Property PHP file upload vulnerability This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

banana dance b.2.6 - Multiple Vulnerabilities

Advisory ID: HTB23118 Product: Banana Dance Vendor: bananadance.org Vulnerable Versions: B.2.6 and probably prior Tested Version: B.2.6 Vendor Notification: October 3, 2012 Public Disclosure: December 19, 2012 Vulnerability Type: PHP File Inclusion CWE-98, Improper Access Control CWE-284, SQL...

banana dance b.2.6 - Multiple Vulnerabilities

banana dance b.2.6 - Multiple Vulnerabilities Advisory ID: HTB23118 Product: Banana Dance Vendor: bananadance.org Vulnerable Versions: B.2.6 and probably prior Tested Version: B.2.6 Vendor Notification: October 3, 2012 Public Disclosure: December 19, 2012 Vulnerability Type: PHP File Inclusion...

Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload (CVE-2012-0299)

An arbitrary code execution vulnerability has been reported in the management GUI in Symantec Web Gateway...

Multiple vulnerabilities in BabyGekko

Advisory ID: HTB23122 Product: BabyGekko Vendor: babygekko.com Vulnerable Versions: 1.2.2e and probably prior Tested Version: 1.2.2e Vendor Notification: October 24, 2012 Vendor Patch: November 4, 2012 Public Disclosure: November 14, 2012 Vulnerability Type: SQL Injection CWE-89, PHP File Inclusi...

BabyGekko 1.2.2e - Multiple Vulnerabilities

BabyGekko 1.2.2e - Multiple Vulnerabilities Advisory ID: HTB23122 Product: BabyGekko Vendor: babygekko.com Vulnerable Versions: 1.2.2e and probably prior Tested Version: 1.2.2e Vendor Notification: October 24, 2012 Vendor Patch: November 4, 2012 Public Disclosure: November 14, 2012 Vulnerability...

BabyGekko 1.2.2e XSS / LFI / SQL Injection Vulnerabilities

BabyGekko version 1.2.2e suffers from cross site scripting, local file inclusion, and remote SQL injection vulnerabilities. Product: BabyGekko 1.2.2e Vendor: babygekko.com Vulnerable Versions: 1.2.2e and probably prior Tested Version: 1.2.2e Vendor Notification: October 24, 2012 Vendor Patch:...

BabyGekko 1.2.2e XSS / LFI / SQL Injection

Advisory ID: HTB23122 Product: BabyGekko Vendor: babygekko.com Vulnerable Versions: 1.2.2e and probably prior Tested Version: 1.2.2e Vendor Notification: October 24, 2012 Vendor Patch: November 4, 2012 Public Disclosure: November 14, 2012 Vulnerability Type: SQL Injection CWE-89, PHP File Inclusi...

BabyGekko 1.2.2e - Multiple Vulnerabilities

Advisory ID: HTB23122 Product: BabyGekko Vendor: babygekko.com Vulnerable Versions: 1.2.2e and probably prior Tested Version: 1.2.2e Vendor Notification: October 24, 2012 Vendor Patch: November 4, 2012 Public Disclosure: November 14, 2012 Vulnerability Type: SQL Injection CWE-89, PHP File Inclusi...

Family Connections CMS v2. 5. 0-v2. 7. 1 (less.php) remote command execution exploit-vulnerability warning-the black bar safety net

Author: TPCS From: 90sec Blog: http://blog.163.com/jianshitianxiaao/ 0x01 introduction Recently in practice some PoC, to find this old cave to practice hand, the first PoC released is in the exploitDB on, just not posted the link, we go to search under it. A start to get to the original PoC, want...

akcms code execution vulnerability-vulnerability warning-the black bar safety net

Last week digging out of the akcms background stencil getshell feeling nothing new, and then carefully looked at the code, found a comparison with“the future”of the hole, the code execution vulnerability, and the problem function is that the authors provided to the station user for secondary...

qdPM 7.0 - Arbitrary '.PHP' File Upload (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "qdPM v7 Arbitrary...