GreenCMS Cross-Site Request Forgery Vulnerability

GreenCMS is a content management system CMS based on ThinkPHP. A cross-site request forgery vulnerability exists in GreenCMS version 2.3.0603. A remote attacker can add an administrator account with the help of the index.php?m=admin&c=access&a=adduserhandle URL...

GreenCMS Arbitrary File Download Vulnerability

GreenCMS is a content management system CMS based on ThinkPHP. An arbitrary file download vulnerability exists in GreenCMS version 2.3.0603. An attacker can download arbitrary files with the help of index.php?m=admin&c=media&a=downfile URI...

LFCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-14218)

LFCMS is a video-on-demand system based on ThinkPHP and MySQL. A cross-site request forgery vulnerability exists in LFCMS version 3.7.0. A remote attacker can exploit this vulnerability to arbitrarily add users...

LFCMS Cross-Site Request Forgery Vulnerability

LFCMS is a PHP based on THINKPHP3.2.3 framework development, suitable for all kinds of video, film and television websites, film and television content management program. LFCMS 3.7.0 admin.php cross-site request forgery vulnerability exists. Remote attackers can use this vulnerability to hijack...

GreenCMS Information Disclosure Vulnerability

GreenCMS is a content management system CMS based on ThinkPHP. A security vulnerability exists in GreenCMS version 2.3.0603. A remote attacker can exploit the vulnerability by sending a direct request to the Data/Log/yearmonthday.log file to obtain sensitive information...

ArticleCMS Cross-Site Scripting Vulnerability

ArticleCMS is a responsive content management system CMS built on Bootstrap and ThinkPHP. The system is mainly used for the management of users and articles in the background. A cross-site scripting vulnerability exists in ArticleCMS 2017-02-19 and earlier versions. A remote attacker can exploit...

SQL Injection Vulnerability in ThinkCMF

ThinkCMF is a Chinese Content Management Framework CMF based on ThinkPHP+MYSQL. ThinkCMF has a SQL injection vulnerability , attackers can exploit the vulnerability to obtain sensitive database data...

thinkphp SQL Injection Vulnerability (CNVD-2018-09389)

thinkphp is a set of open source, PHP-based lightweight web application development framework. A SQL injection vulnerability exists in thinkphp version 3.1.3. A remote attacker can use the 's' parameter to send a specially crafted SQL statement to the index.php file to exploit the vulnerability t...

Tpshop 2.0.8 Arbitrary File Download / SSRF

Backdoor in Tpshop = 2.0.8 CVE-2018-9919 The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based on the Thinkphp development framework. Product Download: http://www.tp-shop.cn/Index/Index/download.html Vulnerabili...

Tpshop 2.0.8 Arbitrary File Download / SSRF Vulnerability

Tpshop versions 2.0.8 and below suffer from arbitrary file download and server-side request forgery vulnerabilities. Backdoor in Tpshop = 2.0.8 CVE-2018-9919 The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based...

Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919)

Backdoor in Tpshop = 2.0.8 CVE-2018-9919 The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based on the Thinkphp development framework. Product Download: http://www.tp-shop.cn/Index/Index/download.html Vulnerabili...

Sql injection

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10225

CVE-2018-10225 affects thinkphp 3.1.3. The vulnerability is a SQL injection via the index.php?s parameter, enabling crafted SQL statements to affect the backend database. Exploitation details are not provided in the connected documents; the CVSS info from NVD indicates CRITICAL impact (AV:N/AC:L/...

Thinkphp3.2.3最新版update注入漏洞

原文来自安全客，作者：0r3ak@0kee Team 原文： 简要描述 thinkphp是国内著名的php开发框架，有完善的开发文档，基于MVC架构，其中Thinkphp3.2.3是目前使用最广泛的thinkphp版本，虽然已经停止新功能的开发，但是普及度高于新出的thinkphp5系列，由于框架实现安全数据库过程中在update更新数据的过程中存在SQL语句的拼接，并且当传入数组未过滤时导致出现了SQL注入。 Git补丁更新 新增加了BIND表达式 漏洞详情...

MobileCms v1.2 Arbitrary File Upload Vulnerability

MobileCms is a ThinkPhp framework based on the development of background content management system , provides for Android Iphone Phonegap windowsPhone call api interface , developers only need to make simple changes , you can provide interface data for mobile devices . MobileCms v1.2 there are...

Tpshop <= 2.0.6 Server Side Request Forgery Vulnerability

Exploit for php platform in category web applications SSRF（Server Side Request Forgery） in Tpshop = 2.0.6 CVE-2017-16614 The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based on the Thinkphp development framewor...

XSS Vulnerability in StartBBS Lightweight Micro Community System at Postings

StartBBS Lightweight Micro Community System is an elegant, open source, lightweight community system based on Thinkphp 5.15 & Layui, with its own article system. StartBBS lightweight micro-community system v2.0.0 version of the posting at the storage-type XSS vulnerability, the attacker can inser...