173 matches found
phpwind 7.5 apps/groups/index.php远程包含漏洞
apps/groups/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码 ?php if $route == "groups" requireonce $basePath . '/action/mgroups.php'; elseif $route == "group" requireonce $basePath . '/action/mgroup.php'; elseif $route == "galbum" requireonce $basePath . '/action/mgalbum.php';...
phpwind 7.5 api/class_base.php Include Vulnerabilities
PHPWind 论坛系统 是一套采用 php+mysql 数据库 方式运行并可生成 html 页面的全新且完善的强大系统。因具有非凡的访问速度和卓越的负载能力而深受国内外朋友的喜爱。 api/classbase.php文件里callback函数里$mode变量没有过滤导致任意包含本地文件,从而可以执行任意PHP命令. api/classbase.php文件里: function callback$mode, $method, $params if !isset$this-classdb$mode if !fileexistsRP.'api/class' . $mode . '.php'...
phpwind 7.5 apps/share/index.php远程包含漏洞
PHPWind 论坛系统 是一套采用 php+mysql 数据库 方式运行并可生成 html 页面的全新且完善的强大系统。因具有非凡的访问速度和卓越的负载能力而深受国内外朋友的喜爱。 Zoomeye Dork apps/share/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码 ?php if $route == "share" requireonce $basePath . '/action/mshare.php'; elseif $route == "sharelink" requireonce...
phpwind_2.0.1_job.php_任意文件创建漏洞
No description provided by source...
phpwind 1.3.6 header.php 权限提升漏洞
No description provided by source...
Phpwind <=5.3 wap_mod.php SQL注入漏洞
No description provided by source...
Phpwind 4.3.2-6.3.2 编码SQL注入漏洞
No description provided by source...
phpwind 5.3.0 passport-client.php Sql注入漏洞
No description provided by source...
phpwind 6.0&6.3&7.0 CSRF漏洞
No description provided by source...
phpwind 2.0.1 hidden.php 代码执行漏洞
No description provided by source...
phpwind 5.0.1 Sql注入漏洞
No description provided by source...
phpwind 5.0.1 SQL注入漏洞
No description provided by source...
phpwin7. 0 get the shell method,applicable in all space-bug warning-the black bar safety net
It happened a week ago,in the invasion of a PHPWIND Forum results,apply to PHPWIND cannot upload,and the online chatter of the three to take the SEHLL methods are ineffective,you can try,should be considered PHPWIND background of the vulnerability. Preparation Tool:winsock expert v0. 6 betan1...
PHPWIND & DISCUZ! CSRF vulnerability-vulnerability warning-the black bar safety net
PHPWIND & DISCUZ! CSRF vulnerability affects versions: Discuz! 6.0.0 & 6.1.0 & 7.0.0 PHPWIND 6.0 & 6.3 & 7.0 Vulnerability description: PHPWIND & DISCUZ! The presence of CSRF vulnerabilities, triggering PHPWIND & DISCUZ! CSRF WORM! ... d/b31e4d2e6270c384 reference ... d/b31e4d2e6270c384 Safety...
phpwind7.0后台上传漏洞
漏洞产生的原因是跟很久以前的动网上传漏洞一样,没有考滤00这个字节,当我们把生成文件参数后面加上00时,phpwind就以为程序结束,然后就会直接生成我们想要的asp.有很多人问,能不能直接生成PHP呢,这个我也一直在试,但都是没有办法,因为PHP会把我们输入的一句话包含到单引号里面,这样我们的一句话就不能执行了,而ASP单引号不影响我们的执行,由于本人不懂PHP.所以不知道有没有其它的办法,希望本文丢拋字怎么打也打不出来砖引玉.让高手来解决这个问题。 phpwind7.0 暂无...
Hidden website back-end management-vulnerability warning-the black bar safety net
A recent search through some of the search terms of information, combined with some of the actual search experience draw some of the Security aspects of thinking: Example: Use GOOGLE's search commands intitle:management intitle:background intext:admin And some very simple Search command, you will...
PHPWIND & DISCUZ! CSRF漏洞
PHPWIND & DISCUZ!存在CSRF漏洞，引发PHPWIND & DISCUZ! CSRF WORM!br / http://groups.google.com/group/ph4nt0m/browsethread/thread/b31e4d2e6270c384 Discuz! 6.0.0 & 6.1.0 & 7.0.0 PHPWIND 6.0 & 6.3 & 7.0 DISCUZ删除templates/default/header.htm 里面的 $seohead就可以了。 暂无，等待官方补丁。 http://hk.chinakernel.org/worm.tar.gz...
phpwind V7. 0 XSS vulnerabilities-vulnerability warning-the black bar safety net
http://site/upload2/admin.php?adminjob=%22%3E%3Cscript%3Ealert%27hiphop%2 7%3C/script%3E ! $REQUESTURI = $SERVER'PHPSELF'.'?'.$ SERVER'QUERYSTRING'; $windversion = '7.0'; $windrepair = "; From the outside any QUERYSTRING didn't do the filter leads to vulnerability ============================== S...
Discuz!/phpwind flash标签的xss
flash标签的xss在以前的是很流行的,以前只要随便一个调用外面的一个swf就ok了,现在的则都不可以直接使用调用外码的swf了,这个是因为一般都设置了allowScriptAccess12.比如dz的codz: dz60904\upload\forumdata\cache\cachebbcodes.php 同样出现在cacheviewthread.php cachepost.php cacheblog.php里 00017: 0 = 'marquee width="90%" behavior="alternate" scrollamount="3"\1/marquee', 00018...
PHPWind passport_client.php文件UPDATE参数远程SQL注入漏洞
PHPWind的实现上存在变量过滤漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击，非授权操作数据库，完全控制论坛。 PHPWind的passportclient.php文件里变量没有初始化，可以通过构造特定的变量值判断： codeif!$passportifopen || $passporttype != 'client' exit"Passport closedPHPWind"; //可以提交“passportifopen =1&passporttype=client”绕过 ifmd5$action.$userdb.$forward.$passportkey != $verify...