Cmseasy某处SQL盲注漏洞（绕过360防护）

简要描述： 注入..但是木回显 盲注了.. 详细说明： index.php 84行 stats::getbot; 由于初始化的时候也没对$SERVER做过滤的什么措施 导致的注入 stats.php 13行到78行 getbot 这个功能是看蜘蛛的记录 $SERVER 没过滤 我们只需要把HTTPUSERAGENT伪造成蜘蛛的就ok了 public static function getbot $ServerName = $SERVER"SERVERNAME"; $ServerPort = $SERVER"SERVERPORT"; $ScriptName =...

Expiro User-Agent

Xpiro is a virus designed to steal sensitive information from affected users...

CVE-2014-4309

Multiple cross-site scripting XSS vulnerabilities in Openfiler 2.99 allow remote attackers to inject arbitrary web script or HTML via the 1 TinkerAjax parameter to uptime.html, or remote authenticated users to inject arbitrary web script or HTML via the 2 MaxInstances, 3 PassivePorts, 4 Port, 5...

PHPBTTracker+ 2.2 - SQL Injection

Exploit Title: PHPBTTracker+ 2.2 SQL Injection Date: May 13th, 2014 Exploit Author: BackBox Team Vendor Homepage: http://phpbttrkplus.sourceforge.net/ Software Link: http://sourceforge.net/projects/phpbttrkplus/files/ Version: PHPBTTracker+ 2.2 Tested on: PHP 5.4.27, Apache 2.4.9, MySQL = 5.0.0...

PHPBTTracker+ 2.2 - SQL Injection

PHPBTTracker+ 2.2 - SQL Injection Exploit Title: PHPBTTracker+ 2.2 SQL Injection Date: May 13th, 2014 Exploit Author: BackBox Team Vendor Homepage: http://phpbttrkplus.sourceforge.net/ Software Link: http://sourceforge.net/projects/phpbttrkplus/files/ Version: PHPBTTracker+ 2.2 Tested on: PHP...

CmsEasy最新版本前台SQL注射 (2)

简要描述： 这几天在尝试做一款PHP源码审计工具，匹配一些初步的规则时扫出来的，并非针对，感谢CmsEasy 详细说明： 还是INSERT注入，/index.php下有一个stats::getbot;这个方法在做什么呐？ /lib/table/stats.php public static function getbot $ServerName = $SERVER"SERVERNAME"; $ServerPort = $SERVER"SERVERPORT"; $ScriptName = $SERVER"SCRIPTNAME"; $QueryString =...

HTTPNetworkSniffer - Http Sniffer Utility

HTTPNetworkSniffer is a packet sniffer tool that captures all HTTP requests/responses sent between the Web browser and the Web server and displays them in a simple table. For every HTTP request, the following information is displayed: Host Name, HTTP method GET, POST, HEAD, URL Path, User Agent,...

Mail.ru: Reflected XSS in User-Agent

Уязвимость существует на сайтах: 11x11.mail.ru s2.11x11.mail.ru Злоумышленник может внедрить произвольный User-Agent, содержащий JS код. Для примера - alert/BigBear/!--...

EFS Easy Chat Server 3.1 - Remote Stack Buffer Overflow

EFS Easy Chat Server 3.1 - Remote Stack Buffer Overflow Exploit-DB Note: The offset to SEH is influenced by the installation path of the program. For this specific exploit to work, easy chat must be installed to: 'C:\Program Files\EFS Software\Easy Chat Server' Exploit Title: Easy Chat Server 3.1...

StopTheHacker: XSS 1

Request GET /login/?loc=de"prompt994787 HTTP/1.1 Referer: https://panel.stopthehacker.com Cookie: sthpanel=9fj5MyELdr2SAJ3yNP5p%2C3 Host: panel.stopthehacker.com Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko...

Xerox DocuShare - SQL Injection

Xerox DocuShare - SQL Injection The following request is vulnerable to a SQL injection in the last URI segment: GET /docushare/dsweb/ResultBackgroundJobMultiple/1 HTTP/1.1 Host: 172.31.16.194:8080 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:26.0 Gecko/20100101 Firefox/26.0 Accept:...

Xangati - '/servlet/Installer?file' Directory Traversal

source: https://www.securityfocus.com/bid/66817/info Xangati XSR And XNR are prone to a multiple directory-traversal vulnerabilities. A remote attacker could exploit these vulnerabilities using directory-traversal characters '../' to access or read arbitrary files that contain sensitive...

CubeCart 5.2.8 - Session Fixation

Exploit for php platform in category web applications Exploit Title: CubeCart 5.2.8 Session Fixation Exploit Author: James Sibley absane Blog: http://www.pentester.co Download link: http://www.cubecart.com/download/5.2.8/zip Discovery date: March 14th, 2014 Vendor notified: March 15th, 2014 Vendo...

CubeCart 5.2.8 - Session Fixation

CubeCart 5.2.8 - Session Fixation Exploit Title: CubeCart 5.2.8 Session Fixation Exploit Author: James Sibley absane Blog: http://www.pentester.co Download link: http://www.cubecart.com/download/5.2.8/zip Discovery date: March 14th, 2014 Vendor notified: March 15th, 2014 Vendor fixed: April 10th,...

CubeCart 5.2.8 - Session Fixation

Exploit Title: CubeCart 5.2.8 Session Fixation Exploit Author: James Sibley absane Blog: http://www.pentester.co Download link: http://www.cubecart.com/download/5.2.8/zip Discovery date: March 14th, 2014 Vendor notified: March 15th, 2014 Vendor fixed: April 10th, 2014 Vendor ack:...

phpdisk V7 sql盲注一枚

简要描述： 又到周末。 详细说明： 刚从官网上面下载下来的。 plugins\phpdiskclient\clientsub.php 我看了下这目录下的其他几个文件 在iconv后都调用了escape函数来转义 但是这个没有。 造就了注入。 $agent = $SERVER'HTTPUSERAGENT'; if$agent!='phpdisk-client' exit'PHPDisk Access Deny Invalid Entry!'; $uinfo = trimgpc'uinfo','P',''; parsestrpdencodebase64decode$uinfo,'DECODE...

[FGscanner] Find hidden contents using dictionary-like attack

FGscanner is a completely rewritten version of littlescanner script. FGscanner is an opensource advanced web directory scanner to find hidden contents on a web server using dictionary-like attack with proxy and tor support. Quick reference for switches Usage: ./fgscan.pl --host=hostname...

Dexter (CasinoLoader) Panel - SQL Injection Exploit

Exploit for multiple platform in category web applications import pycurl import urllib import cStringIO import base64 import argparse import sys import string import pygeoip version = "0.1-httpbots-PoC" def PrintHelp: global version print "usage: dexter.PoC.py -h action gateway url" print "" prin...

Linux little-known security vulnerabilities: do not output the contents of the pipe to your shell-vulnerability warning-the black bar safety net

Will wget or curl to output the contents of the pipe to the bash or sh is a very stupid thing, for example something like the following: | 1 | wget-O - http://example.com/install.sh | sudo sh ---|--- Command explanation: wget-O parameter is specified the output file name, usually followed by a...

MyBB Extended Useradmininfo Plugin 1.2.1 - Cross-Site Scripting

Exploit Title: Extended Useradmininfo MyBB Plugin 1.2.1 - Cross Site Scripting Google Dork: N/A Date: 09.02.2014 Exploit Author: Fikri Fadzil - [email protected] Vendor Homepage: http://forum.mybboard.de/user-9022.html Software Link: http://mods.mybb.com/view/extended-useradmininfo...