SQL Injection Vulnerability in indexNum Parameter of E-procurement System of Yizaitong

Yicai Tong has been committed to enterprise procurement informationization and procurement consulting, providing in-depth solutions in the direction of procurement management, group intensive procurement management, lean supply chain, strategic procurement, project supply chain, and industrialize...

SQL Injection Vulnerability in id Parameter of E-procurement System of Yizitong

Yicai Tong has been committed to enterprise procurement informationization and procurement consulting, providing in-depth solutions in the direction of procurement management, group intensive procurement management, lean supply chain, strategic procurement, project supply chain, and industrialize...

一采通电子采购系统多处SQL注入漏洞#2

简要描述： 一采通电子采购系统多处SQL注入漏洞2 详细说明： google:inurl:companycglist.aspx?ComId= 1 漏洞存在于 /Products/CategoryMSelect.aspx，参数Name 例如 http://eps.umgg.com.cn/Products/CategoryMSelect.aspx?Name=树脂磨盘 2 漏洞存在于 /RAT/Product/HistoryPrice.aspx，参数kw 例如 http://eps.umgg.com.cn/RAT/Product/HistoryPrice.aspx?kw=1 3 漏洞存在于...

某通用型电子采购系统Oracle盲注漏洞

简要描述： 捡漏啊 详细说明： 前人有经验： WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） 厂商： http://www.1caitong.com/ 北京网达信联科技发展有限公司 SQL注入点： /GetPassWord.aspx POST参数txtUserName存在注入 Case: http://eps.umgg.com.cn/GetPassWord.aspx http://ygcg.xuangang.com.cn/GetPassWord.aspx http://222.134.89.6/GetPassWord.aspx...

某通用型电子采购平台可遍历用户和管理员账户密码

简要描述： RT 详细说明： 前人大牛的洞洞 WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） WooYun: 某通用型电子采购平台存在任意文件上传漏洞GETSHELL WooYun: 某通用型电子采购平台从某处目录遍历到任意文件上传GetShell 我也来凑凑热闹 老问题，权限控制问题 漏洞证明： 演示地址为某上市公司 http://cg.jishimedia.com 首先注册账户，登录之后进入密码修改 此时查看源代码即可获取当前用户密码 burpsuite抓包 放入intruder利用0000-9999遍历UserID即可获取所有人员姓名用户和密码，包括管理员 管理后台...

CVE-2014-4313

SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User field...

CVE-2014-4312

Multiple cross-site scripting XSS vulnerabilities in Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the 1 Notes section to Order details; 2 Description section to "Order to consume"; 3 Favorites name section to Favorites; 4...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the 1 Notes section to Order details; 2 Description section to "Order to consume"; 3 Favorites name section to Favorites; 4...

Sql injection

SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User field...

CVE-2014-4312

Multiple cross-site scripting XSS vulnerabilities in Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the 1 Notes section to Order details; 2 Description section to "Order to consume"; 3 Favorites name section to Favorites; 4...

CVE-2014-4313

SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User field...

CVE-2014-4313

The CVE-2014-4313 entry describes a SQL injection vulnerability in Epicor Procurement before 7.4 SP2 that allows remote attackers to execute arbitrary SQL commands via the User field. Affected component: Epicor Procurement (before 7.4 SP2). Root cause: improper input handling enabling SQL injecti...

某通用型电子采购平台SQL注射（涉及大量企业）

简要描述： sql注入，应该没重复吧 详细说明： 之前大牛提交过，其他的还没搜到 WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） google:inurl:custom/CompanyCGList.aspx?ComId= 目测为一采通电子采购平台，所属：北京网达信联科技发展有限公司 百度百科介绍：http://baike.baidu.com/view/5293437.htm?fr=aladdin 涉及大量企业 其中ComId参数存在注入 http://eps.alnan.com.cn/custom/CompanyCGList.aspx?ComId=1...

某通用型电子采购平台存在任意文件上传漏洞GETSHELL

简要描述： 详细说明： 1.看看前人提交的漏洞： WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） ,说的是注入漏洞，后来仔细研究发现存在一个编辑器存在任意文件上传可导致批量Getshell，影响危害极大。 厂商： http://www.ng.com/ 北京网达信联科技发展有限公司 关键字（构造的不是很好）： 2.Getshell漏洞。 /ftb.imy.aspx 可以直接上传asp文件 漏洞证明： 【声明以下案例仅供CNCERT、CNVD复现测，其它人不得利用或使用其恶意破坏，否则后果自负！】 3.案例测试：...

[Onapsis Security Advisories] Multiple Hard-coded Usernames in SAP Components

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisories:Multiple Hard-coded Usernames CWE-798 have been found and patched in a variety of SAP components. Summaries of the advisories with links to full versions follow: 1. ONAPSIS-2014-011-SAP Project System Structures and...

China Bans Microsoft Windows 8 for Government Computers

While US government is always prohibiting the purchase of Huawei products due to suspected backdoors from the Chinese government, China also keep itself totally apart from the US productions. China is a bit famous for using its own operating systems, smartphone application services and lots more,...

Former NSA Director Addresses Crypto Standard Subversion

During the last 11 months of mounting leaks and revelations about the government’s surveillance operations and the lengths it will go to gain intelligence on foreign threats, perhaps the most disturbing revelation was the intentional subversion of widely used cryptographic standards. It’s also be...

Security feature bypass

Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security...

CVE-2014-0425

Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security...

CVE-2014-0425

CVE-2014-0425 concerns Oracle PeopleSoft 9.2 SCM Services Procurement. The provided documents do not reveal concrete technical details about the vulnerability’s root cause, affected component specifics beyond the general SCM Services Procurement scope, or explicit exploit/mitigation data. NVD des...