601 matches found
易思ESPCMS sql注入（demo成功）
简要描述： rt V6.0.14.07.07 UTF8 详细说明： 看了大牛们提交的 WooYun: ESPCMS最新 V5.8.14.03.03 UTF8 正式版暴力注入 下了最新版来看看，发现 加密函数 还是老样子啊- - 不过 ，查询换成 了 id 而不是 username了， 但是 id 是 intval的。 function membercookieview$keyword = false $retrunstr = array; $retrunstr'username' = $this-fun-eccode$this-fun-accept'ecispmemberusername...
Ecmall V2.3.0-UTF8 正式版暴力注入（爆破）
简要描述： RT，打了最新补丁 详细说明： 存在两个问题，最新版未修补： 1.后台可被爆破，导致暴力注入；（很多SQL注入点最终是为了进后台，那么这里直接暴力点） 2.模板编辑下可得shell。 漏洞证明： 暴力注入： 1.在后台登录页，点击登录后抓包： 2.设置爆破字段为password： 3.不要看burp返回，直接再次刷新页面，登录成功！ 拿shell的方法： 1.看下图，点击编辑（这一列的都可以编辑）： 2.写入shell： 3.访问这个地址： http:/...
CmsEasy最新 V5.5-UTF8 正式版暴力注入
简要描述： 官网下载最新版为20140605 注入+后台getshell 详细说明： cmseasy最新版后台无验证码，导致管理员账户可被暴力破解： 1.cmseasy后台无验证码导致可暴力破解管理员密码登陆后台； 2.后台模板编辑html文件，发现html里可执行php代码，利用php的写文件函数写shell。 漏洞证明： 0x01:爆破登陆后台 1.后台点击登陆后抓包： 2.burp爆破，通过回显得知管理员密码： 3.成功登陆后台： 0x02:后台模板编辑getshell 后台模板编辑处，我们先看left.html，点击编辑后发现是一堆代码。那我添加写文件的代码不就getshell了...
openSUSE Security Update : samba (openSUSE-SU-2013:1787-1)
"the following security issues were fixed in samba : - ACLs are not checked on opening an alternate data stream on a file or directory; CVE-2013-4475; bso10229 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...
phpdisk V7 （20140604） 注入一枚 (直接出数据)
简要描述： 20140604 详细说明： 在ajax.php中 else $file = unserializebase64decode$data; /foreach$file as $k=$v $file$k = $db-escape$file$v; / $filefileid = int$filefileid; $filefilesize = int$filefilesize; $filefiledescription = $db-escapetrim$filefiledescription; $filefileextension =...
DEBIAN-CVE-2013-2031
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox...
Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2013-2513)
The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2513 advisory. - wakeupprocess should be never used to wakeup a TASKSTOPPED/TRACED task Oleg Nesterov Orabug: 16405869 CVE-2013-0871 - ptrace: ensure...
kernel: VFAT slab-based buffer overflow
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service system crash via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversi...
phpwind 疑似注入一枚.
简要描述： 9.0 utf8版本 看看是不是注入 详细说明： db.WindSqlStatement.execute SQLSTATE42000: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1SQL:DELETE FROM pwmessagenotices WHERE...
Espcms V5.6.13.04.22 UTF8 正式版注入漏洞之1/N
简要描述： Espcms V5.6.13.04.22 UTF8 正式版某文件存在注入漏洞，可获取管理员帐号和密码 详细说明： 漏洞文件：\interface\membermain.php $zipcode = trim$this-fun-accept'zipcode', 'P', true, true; //第185行 $zipcode = empty$zipcode ? 0 : $zipcode; ...... $dbwhere = "userid=$this-ecmemberusernameid AND username='$this-ecmemberusername' ";...
kernel: VFAT slab-based buffer overflow
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service system crash via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversi...
USN-1775-1: Linux kernel vulnerabilities
A flaw was reported in the permission checks done by the Linux kernel for /dev/cpu//msr. A local root user with all capabilities dropped could exploit this flaw to execute code with full root capabilities. CVE-2013-0268 A flaw was discovered in the Linux kernels handling of memory ranges with...
kernel: VFAT slab-based buffer overflow
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service system crash via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversi...
CVE-2013-1773
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service system crash via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversi...
CVE-2013-1773: Improper Restriction of Operations within the Bounds of a Memory Buffer
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service system crash via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversi...
UBUNTU-CVE-2013-1773
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service system crash via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversi...
Design/Logic Flaw
vicious-extensions/ve-misc.c in GNOME Display Manager gdm 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs...
libexif: "exif_convert_utf16_to_utf8()" off-by-one
Off-by-one error in the exifconvertutf16toutf8 function in exif-entry.c in the EXIF Tag Parsing Library aka libexif before 0.6.21 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image...
Mandrake Linux Security Advisory : perl-Digest-MD5 (MDKSA-2002:035)
A bug exists in the UTF8 interaction between the perl-Digest-MD5 module and perl that results in UTF8 strings having improper MD5 digests. The 2.20 version of the module corrects this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...