phpBB <= 2.0.15 Register Multiple Users Denial of Service (perl code)

No description provided by source. !/usr/bin/perl Name: NsT-phpBBDoS Perl Version Copyright: Neo Security Team Author: HaCkZaTaN Ported: g30rg3x Date: 20/06/05 Description: NsT-phpBB DoS By HackZatan Ported tu perl By g30rg3x A Simple phpBB Registration And Search DoS Flooder...

AstroCMS Multiple Vulnerabilities

No description provided by source. Exploit Title: AstroCMS Multiple Remote Vulnerabilities Google Dork: none Date: 12.03.2011 Author: brainpillow Software Link: http://www.astrocms.com/ Version: UNKNOWN ============================================================ FORGOTPASSWORD SQL-INJ EXPLOIT:...

S8Forum 3.0 - Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6547/info S8Forum is prone to a remote command execution vulnerability. When a user registers with the forum, a file is created locally with the specified username. The contents of this file will be the data entered by th...

苹果CMS继续无视所有过滤进行SQL注入，第二发

简要描述： 这次这个地方主要是想绕过一个限制达到getshell的目的，但是本人水平有限，所以希望大家可以讨论下。 详细说明： 估计依旧小厂商，当然这倒不要紧。 继续上次的注入，如果说上次是因为单词写错的缘故，这次就不仅仅是粗心所造成的了。 接着看代码： 同样index.php开头： 上次分析过，这次直接看 ifempty$ac $ac='vod'; $method='index'; $colnum = array"id","pg","yaer","typeid","classid";//依然是这里 if$parlen=2 $method = $par1; for$i=2;$iP$par...

齐博CMS任意文件读取(鸡肋，需注册)

简要描述： RT 详细说明： 漏洞一:鸡肋的getshell需注册并能发布文章,需配合apache、iis6解析漏洞 文件 /inc/articfunction.php //采集外部图片 function getoutpic$str,$fid=0,$getpic=1 global $webdb,$lfjuid; if!$getpic return $str; pregmatchall"/http://^ '"+.gif|jpg|png/is",$str,$array; $filedb=$array0; foreach $filedb AS $key=$value if...

74CMS 二次注入 #3 (多处)

简要描述： No check out。 6月份了 不知道是自己倒数的多少个洞了。 2014年6月2日 16:06:55 最后写一个 写了就去上晚自习了。 时间原因 怕迟到 可以注入的地方很多 我就贴两个出来就算了。 demo成功。 详细说明： 总所周知 74cms在/user/userreg.php注册的时候 用户名： 只能包含中英文、数字和下划线 不允许注册特殊字符 但是在plus/ajaxuser.php中 也能注册。 在这里就没过滤特殊字符了。 elseif $act=='doreg' $captcha=getcache'captcha'; if...

destoon /v5.0/ 存储型xss 指哪打哪(绕过2)

简要描述： 就这样 继续绕过去 详细说明： 关联url： WooYun: destoon /v5.0/ 存储型xss 指哪打哪绕过1 注册一个用户 http://127.0.0.1/v5.0/member/message.php?action=send&touser=oboi123&title=RE:RE%3ARE%3Asdaaaaaaa 回复处用了编辑器 编辑器有些标签没过滤，导致xss执行 xsscode: 漏洞证明：...

reg.ebay.com Cross Site Scripting

Advisory: reg.ebay.com - Cross-site Scripting vulnerability Advisory ID: SSCHADV2014-004 Author: Stefan Schurtz Affected Software: Successfully tested on reg.ebay.com Vendor URL: http://www.ebay.com/ Vendor Status: informed ========================== Vulnerability Description...

云人才系统SQL注入，绕过WAF

简要描述： 云人才系统SQL注入，绕过WAF 详细说明： 云人才系统SQL注入，绕过了360的WAF 首先需要注册一个普通用户 比如官方演示站点： 然后来到 http://www.hr135.com/member/index.php?M=index&C=info 可以看到有某数字的WAF： 于是我们发现代码如下： function infoaction if$POST"submitBtn" $POST=$this-posttrim$POST; if$POST"name"=="" $this-obj-ACTmsg"index.php?C=info","��������Ϊ�գ�";...

[RT-SA-2014-002] rexx Recruitment: Cross-Site Scripting in User Registration

Advisory: rexx Recruitment Cross-Site Scripting in User Registration RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in rexx Recruitment's user registration page during a penetration test. If attackers can persuade users to click on a prepared link or redirected them to suc...

destoon /v5.0/ 存储型xss指哪打哪

简要描述： 存储型xss 指哪打哪 详细说明： 注册一个用户 http://127.0.0.1/v5.0/member/message.php?action=send&touser=oboi123&title=RE:RE%3ARE%3Asdaaaaaaa 回复处用了编辑器 编辑器有些标签没过滤，导致xss执行 xsscode: object 经过base64 可形成xss语句 漏洞证明：...

rexx Recruitment Cross Site Scripting

Advisory: rexx Recruitment Cross-Site Scripting in User Registration RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in rexx Recruitment's user registration page during a penetration test. If attackers can persuade users to click on a prepared link or redirected them to suc...

Phabricator: Control character allowed in username

It turns out, that it is possible to register a user with a special sign %0a appended in proxy. Possible consequences: 1. You can't see the profile of this newly created user after registration 404 response 2. You can use this to spoof another user - just use the name of another user during...

HackerOne: harvesting attack on user registration

url: https://hackerone.com/users/signup user account registration will ask for the applicant to provide all of the information required to create an account on a registration page. When the registration page is submitted, the application validates the uniqueness of the username and email address...

ILIAS 4.4.1 Cross Site Scripting / Shell Upload

============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias.de ============================================================== First from admin user logged...

phpmps 某处存在sql注入（鸡肋）

简要描述： phpmps 某处存在sql二次注入 详细说明： phpmpsv2.3build121113utf8 在用户注册时候，虽然做了转移，但是存储到数据库的时候转义符被去掉，从而造成sql二次注入，登陆后跳转截图 点击左侧的购买信息币处： 此处有两处，都是从数据库直接取出来用户名，做用户查询所用: 在member.php里面： 526 case 'actgold': 527 $type = $POST'type'; 528 $number = $type == 'money2gold' ? intval$POST'mnumber' : intval$POST'cnumber'; 5...

Job Site 1.0 - Multiple Vulnerabilities

Job Site 1.0 - Multiple Vulnerabilities Jobsite logo - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

shopex register any user-defined pre-Deposit of balance or integration-vulnerability warning-the black bar safety net

Brief description: shopex in the registered user is present when the validation is not strict, leading to the time of registration can be freely defined the pre-Deposit balances or credits such as the contents of the field Detailed description: 在 文件 \core\shop\controller\ctl.passport.php if !$ in...

shopex注册用户任意定义预存款余额或积分

简要描述： shopex在注册用户时存在验证不严，导致注册时可以随意定义预存款余额或积分等字段的内容 详细说明： 在文件\core\shop\controller\ctl.passport.php if !$info = $account-create$POST,$message $this-splash'failed','back',$message,'','',$POST'fromminipassport'; 用户注册的变量都保存在$POST中，继续看根目录文件index.php filterData$POST; require...

shopex最新版前台一处想不到的SQL注入

简要描述： shopex代码核心的地方都做了加密处理，找漏洞就需要一点想象空间了，比如这个SQL注入... 详细说明： 存在于用户注册想不到的位置吧？ 1. /core/shop/controller/ctl.passport.php 267行 if !$info = $account-create$POST,$message ... 2.看到1，想到有没有可能$account-create是foreach $POST构造sql语句的呐？ 3.看数据表结构： 果断提交时$POST里加入memberid测试其实测试时我还试了mobile等，嘿，只捡有用的字段说，然后就有了下图： 漏洞证明：...