PHPMyWind 5.3 - Cross-Site Scripting

PHPMyWind 5.3 - Cross-Site Scripting Exploit Title：PHPMyWind 5.3 has XSS Exploit Author:小雨 Vendor Homepage:http://phpmywind.com Software Link:http://phpmywind.com/downloads/PHPMyWind5.3.zip Version:5.3 CVE:CVE-2017-12984 $r= $dosql-GetOne"SELECT Maxorderid AS orderid FROM @message"; $orderid=...

PHPMyWind 5.3 - Cross-Site Scripting

Exploit Title：PHPMyWind 5.3 has XSS Exploit Author:小雨 Vendor Homepage:http://phpmywind.com Software Link:http://phpmywind.com/downloads/PHPMyWind5.3.zip Version:5.3 CVE:CVE-2017-12984 $r= $dosql-GetOne"SELECT Maxorderid AS orderid FROM @message"; $orderid= empty$r'orderid' ? 1 : $r'orderid' + 1;...

Arbitrary code writing vulnerability in phpmywind cms

PHPMyWind is a PHP MySQL-based development , W3C-compliant building engine . An arbitrary code write vulnerability exists in phpmywind cms, which can be exploited by attackers to gain service privileges...

PHPMyWind v5. 4 background arbitrary file deletion

No description provided by source...

phpmywind 前台留言处存储型XSS漏洞

No description provided by source...

phpmywind admin/infoclass_save.php第二处sql注入

No description provided by source...

phpmywind admin路径下多处sql注入

No description provided by source...

phpmywind /admin/paymode_save.php sql注入

No description provided by source...

phpMyWind v5.3 /goodsshow.php 代码执行

No description provided by source...

PHPMyWind 5.0后台管理界面的SQL注入漏洞

No description provided by source...

PHPMyWind任意用户密码重置

简要描述： PHPMyWind任意用户密码重置 详细说明： 首先我们注册两个用户 第一个叫jkgh006 第二个叫test123 那么我们下来分析一下代码: member.php: else if$a == 'saveedit' //检测数据完整性 if$password!=$repassword or $email=='' header'location:?c=edit'; exit; //HTML转义变量 $answer = htmlspecialchars$answer; $cnname = htmlspecialchars$cnname; $enname =...

PHPMyWind一枚注入

简要描述： rt 详细说明： Finger能把这个合到之前那个洞一起么 类似的 漏洞文件 /member.php else if$a == 'binding' //初始化参数 $username = empty$username ? '' : $username; $password = empty$password ? '' : md5md5$password; //验证输入数据 if$username == '' or $password == '' header'location:?c=binding'; exit; $row = $dosql-GetOne"SELECT...

PHPMyWind一个为所欲为的注入

简要描述： rt 详细说明： PHPMyWind最新版 只需会员登录 即可进行任意sql操作 漏洞代码: /member.php 861-941行 else if$a == 'perfect' //初始化参数 $username = empty$username ? '' : $username; $password = empty$password ? '' : md5md5$password; $repassword = empty$repassword ? '' : md5md5$repassword; $email = empty$email ? '' : $email;...

PHPMyWind 5.2 /4g.php SQL注入漏洞

No description provided by source...

phpmywind最新5.2版本存在CSRF添加管理员漏洞

简要描述： phpmywind最新5.2版本存在CSRF添加管理员漏洞 详细说明： 嗯哼？ 在后台添加管理员时候开启burp截取下包 看看是怎么样的。 None...

PHPMyWind 5.2 /admin/infoimg_do.php SQL注入漏洞

No description provided by source...

PHPMyWind v5.0 /product.php SQL注入漏洞

No description provided by source...

PHPMyWind 5.1 /admin/infoimg_do.php SQL注入漏洞

No description provided by source...

PHPMyWind 5.1 /member.php 远程密码修改漏洞

/member.php//初始化参数 …… $id = isset$id ? intval$id : 0; …… //更新资料 else if$a == 'saveedit' //检测数据完整性 if$password!=$repassword or $email=='' header'location:?c=edit'; exit; //HTML转义变量 .... //检测旧密码是否正确 if$password != '' $oldpassword = md5md5$oldpassword; $r = $dosql-GetOne"SELECT password FROM @member...

PHPMyWind 5.1 /include/common.func.php 代码执行漏洞

/include/common.func.php/字符串转数组/ if!functionexists'String2Array' function String2Array$data if$data == '' return array; @eval"$array = $data;"; return $array; $data变量进入eval执行，当传入$data为：111|222$phpinfo执行的PHP语句为：@eval"$array = array"1"="111|222$phpinfo","2"="";;"页面返回：...