Phpyun注入一枚绕过360注射附exp

简要描述： 可以引入单引号, 但是在这里也不需要引入单引号。 虽然有360 但是还是能注入出密码。 写了个小脚本来跑。（代码很渣 速度很慢 但是还是能跑完整） - - 特么的完全不会写, 太渣了。 详细说明： 在model/register.class.php中。 function ajaxregaction $post = arraykeys$POST; $keyname = $post0; if$keyname=="username" $username=@iconv"utf-8","gbk",$POST'username';...

华天动力OA任意文件删除

简要描述： Just another bug. 详细说明： 以官网http://demo.oa8000.com/为例， user:123456 登陆后， 向http://demo.oa8000.com/OAapp/bfapp//buffalo/oaPubptUploadService POST如下参数： \n removeFile\n C:/PROGRA1/htoa/Tomcat/webapps/OAapp/1.html\n 即可删除1.html 漏洞证明： 在删除前，利用wooyun-2014-065670看到的结果本来是这样的 删除后，...

uTorrent <= 2.0.3 DLL Hijacking Exploit (plugin_dll.dll)

No description provided by source. / Exploit Title: uTorrent = 2.0.3 DLL Hijacking Exploit plugindll.dll Date: 24/08/2010 Author: TheLeader Email: gsog2009 a7 hotmail d0t com Software Link: http://www.utorrent.com/downloads Version: 2.0.3 and prior Tested on: Windows 7 x86 6.1.7600 Compile and...

Kolibri+ Webserver 2 - (GET Request) Remote SEH Overwrite Exploit

No description provided by source. !/usr/bin/python Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret to work correctly despite the large number of usable addresses that were tested. $ ./kolibri.py 192.168.1.146 8080 Kolibri+...

ASPNuke <= 0.80 (register.asp) Remote SQL Injection Vulnerability

No description provided by source. Title : ASPNuke = 0.80 register.asp Remote SQL Injection Vulnerability Author : ajann S.Page : http://www.aspnuke.com D.Page : http://sourceforge.net/project/showfiles.php?groupid=92470...

Oracle 9i/10g Evil Views - Change Passwords Exploit

No description provided by source. -- -- bunkerview.sql -- -- Oracle 9i/10g - evil view exploit CVE-2007-3855 -- Uses evil view to perform unauthorized password update -- -- by Andrea bunker Purificato - http://rawlab.mindcreations.com -- 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2 -- -- Th...

Solaris 2.x/7.0/8,IRIX 6.5.x,OpenBSD 2.x,NetBSD 1.x,Debian 3,HP-UX 10 Telnetd Buffer Overflow

No description provided by source. source: http://www.securityfocus.com/bid/3064/info A boundary condition error exists in telnet daemons derived from the BSD telnet daemon. Under certain circumstances, the buffer overflow can occur when a combination of telnet protocol options are received by th...

Sun Solaris <= 2.6 power management Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/160/info A vulnerability exists in Sun's power management software under Solaris versions 2.4-2.6 although only 2.6 as part of the main distribution. The sys-suspend program is initiated when a user runs the program, or...

BOINC 5.10.20 forum_forum.php id Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/25644/info BOINC Berkeley Open Infrastructure for Network Computing is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage...

Arab Network Tech. (ANT) CMS - SQL Injection

No description provided by source. ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: ::::::::::::::::::::::::: Exploit Title : Arab Network Tech. ANT CMS SQL Injection Author : Tr0y-x Script Site : www.antpage.comhttp://www.antpage.com/ Version : All Versions Tested on : Windows & Linux...

Magic Photo Storage Website include/config.php _config[site_path] Parameter Remote File Inclusion

No description provided by source...

List Site Pro 2.0 User Database Delimiter Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6685/info List Site PRO is a top site ranking system that counts hits from member sites and then ranks them according to the number of hits. A problem has been reported for List Site PRO that would allow an attacker to...

xmlrpc.php Library <= 1.3.0 - Remote Command Execute Exploit (3)

No description provided by source. !/usr/bin/perl -w XML-RPC Remote Command Execution Exploit By Mike Rifone This works on da phpxmlrpc, and da PEAR XMLRPC too! All you need is to put the url to the server and u get shell Dis is my first exploit but hey it works :D Mike@Rifone use LWP::UserAgent;...

Slackware Linux 3.4 makebootdisk temporary file Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/78/info makebootdisk creates the file /tmp/return insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/return to any file and wait for root to run the program. This will clober the targe...

WINMOD 1.4 - (.lst) Universal Buffer Overflow Exploit (SEH) (2)

No description provided by source. !/usr/bin/python Exploit : WINMOD 1.4 .lst Universal Buffer Overflow Exploit SEH Tested on : Xp sp2 fr Original exploit : http://www.milw0rm.com/exploits/9221 By : DzGirl Greets to : hisok4 even if he doesn't know me & all friends win32exec - EXITFUNC=seh CMD=ca...

Dokeos <= 1.8.0 (my_progress.php course) Remote SQL Injection Exploit

No description provided by source...

Invision Power Board <= 1.3.1 Login.PHP SQL Injection (working)

No description provided by source. ?php / = 1.3.1 Final /str0ke / $server = SERVER; $port = 80; $file = PATH; $target = 81; / User id and password used to fake-logon are not important. '10' is a random number. / $id = 10; $pass = ; $hex = 0123456789abcdef; for$i = 1; $i = 32; $i++ $idx = 0; $foun...

Allomani - Super Multimedia 2.5 - CSRF Add Admin Account

No description provided by source. Exploit Title: Allomani - Super Multimedia v2.5 - CSRF Add Admin Account Date: 29-06-2010 Author: G0D-F4Th3r Software Link: http://allomani.com Version: 2.5 html body onload=javascript:fireForms form method=POST name=form0 action=...

Mp3 MuZik Data Base Download Vulnerability

No description provided by source. ======================================================================================== | Title : Mp3 MuZik Data Base Download Vulnerability | Author : indoushka | Home : www.iqs3cur1ty.com | Bug : DB ====================== Exploit By indoushka...

Sun SunVTS 4.x PTExec Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2898/info SunVTS is the Sun Validation Test Suite, distributed and maintained by Sun Microsystems. The SunVTS is used to test various components of OEM Sun hardware, and can also be used to stress-test components and...