DianYiPS V3.0建站系统后台sql注入漏洞

南宁典意数码科技有限公司，简称典意设计（http://www.dianyisheji.com/），注入点位于网站后台登陆用户名处，案例具体寻找办法可以通过谷歌搜索：powered by DianYiPS，找到案例后在域名后面加/dianyi/即是管理后台，可以用万能密码admin' or '1'='1登陆。...

PageAdmin v3.0 /e/database/v3.mdb 数据库泄漏

PageAdmin CMS V3.0版，默认数据库地址“/e/database/v3.mdb“，默认后台地址：“/e/master/login.aspx”，由于数据库地址未做限制，导致可以下载。通过逆向管理员MD5加密算法获得md5密文，并通过md5密文可以破解管理员密码。发现非常规MD5加密，于是使用ILSPY逆向源代码，查看加密方式public string GetMd5string s MD5 mD = new MD5CryptoServiceProvider; Encoding encoding = Encoding.GetEncoding"UTF-8"; string s2 =...

Amazon Linux: Security Advisory (ALAS-2014-426)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ThinkSNS V3.0 /apps/public/Lib/Action/AccountAction.class.php SQL注入漏洞

/apps/public/Lib/Action/AccountAction.class.php public function doAuthenticate $verifyInfo = D'userverified'-where'uid='.$this-mid-find; $data'usergroupid' = intval$POST'usergroupid'; if!$data'usergroupid' $data'usergroupid' = 5; …… //$data'info' = t$POST'info'; $data'attachid' = t$POST'attachids...

dyp2p v3.0 index.php SQL注入漏洞

No description provided by source...

Traidnt Up 3.0 - SQL Injection

Traidnt Up 3.0 - SQL Injection Exploit Title: Traidnt Up v3.0 SQL Injection Google Dork: "Powered by TRAIDNT UP Version 3.0" Date: 10-04-2015 Exploit Author: Ali Sami [email protected] Vendor Homepage: http://traidnt.net Software Link:...

Traidnt Up 3.0 - SQL Injection

Exploit Title: Traidnt Up v3.0 SQL Injection Google Dork: "Powered by TRAIDNT UP Version 3.0" Date: 10-04-2015 Exploit Author: Ali Sami [email protected] Vendor Homepage: http://traidnt.net Software Link: http://www.traidnt.net/vb/attachments/519880d1285278011-traidnt-up-v3.0.zip Version:...

SDCMS 最新门户版 V3.0 储存型xss一枚 可盲打后台

简要描述： 严谨的说 是编辑器xss储存型漏洞 详细说明： 虚拟主机搭建测试： 需要条件： 开启会员注册默认开启 开启投稿功能（默认开启） 下载地址： http://www.sdcms.cn/product/portal.html 默认 开启会员注册 无需审核 原本想在demo上测试的 但是他开启审核了 ---------------------------------------- 注册个会员 找到在线投稿 选择文章模型 远程上传地址处 插入： " 提交 img...

What does PCI DSS 3.1 and PA-DSS 3.1 mean for you and your organization

In the wake of the POODLE vulnerability identified by NIST and subsequent attacks, the PCI SSC has announced its intent to release the first revision of the PCI DSS 3.0 and PA-DSS 3.0 standards. The PCI DSS 3.1 and PA-DSS 3.1 standards will indicate that the SSL v3.0 protocol no longer meets the...

LotusCMS v3.0 /core/lib/router.php 代码执行漏洞

No description provided by source...

FRHRCMS V3.0 /person/person_certificate.php 任意文件删除漏洞

No description provided by source...

NewLife Blogger <= 3.0 Insecure Cookie Handling / SQL Injection Vuln

No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NewLife Blogger = v3.0 / Insecure Cookie Handling & SQL Injection Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= $ Program: NewLife...

ZipItFast 3.0 - (.ZIP) Heap Overflow Exploit

No description provided by source. !/usr/bin/perl +Exploit Title: ZipItFast v3.0 .ZIP File Heap Overflow Exploit +Date: 08\07\2011 +Author: C4SS!0 G0M3S +Software Link: http://www.freewarefiles.com/ZipItFast---Zip-It-Free-Vprogram22803.html +Version: v3.0 +Tested On: WIN-XP SP3 Brazilian Portugue...

TopicsViewer v3.0 Beta 1 Multiple Sql Injection Vulnerabilty

TopicsViewer version 3.0 Beta 1 suffers from multiple remote SQL injection vulnerabilities. TopicsViewer v3.0 Beta 1 - Multiple Sql Injection Vulnerabilty =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : email protected ,...

PHPJabbers Hotel Booking System V3.0 - Multiple Vulnerabilties

Exploit for php platform in category web applications Hotel Booking System V3.0 - Multiple Vulnerabilties ==================================================================== .:. Author : HackXBack .:. Contact : email protected .:. Home : http://www.iphobos.com/blog/ .:. Script :...

Hotel Booking System 3.0 CSRF / XSS / File Disclosure

Hotel Booking System V3.0 - Multiple Vulnerabilties ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.phpjabbers.com/hotels-booking-system/ .:. Tested On Demo :...

部分万户EIP v3.0 未授权访问导致任意上传和路径泄露

简要描述： 万户EIP v3.0 任意上传和路径泄露 详细说明： 今天在对时代传媒集团渗透的过程中发现的这个问题，并通过google发现是通用型的 时代传媒http://www.chinatmg.com 首先是用工具跑出了源码http://www.chinatmg.com/chinatmg.rar 艹，居然近400mb，面对渣渣的网速我想还是算了，把资源留给迅雷云播同志，管理员显然安全意识不足，不如找找有没有其他的收获 然后首先发现几个目录的遍历： http://www.chinatmg.com/whirsystem/module/...

chshcms 程氏CMS V3.0 注射（已在官方演示站测试）

简要描述： chshcms 程氏CMS V3.0 注射（已在官方演示站测试） 图片中演示站为http://www.dj221.com 详细说明： /user/do.php function TOPIC ifisset$COOKIE"csname" $cscmsname=$COOKIE"csname"; else exitMsgError'你还没有登入或者登入已经超时!','login.php'; $op=CSRequest"op"; //使用安全的CSrequest addslash ...省略无关代码若干 elseif$op=='zjadd' $tid=CSRequest"tid";...

JEEBBS v3.0（最新版）漏洞来几发

简要描述： 为了写6对不住了,刚开始看源码. jeebbs 产品介绍 jeebbs是金磊科技推出的一款以社区为基础的论坛系统，系统采用SpringMVC3+Spring3+Hibernate3+Freemarker技术架构，功能丰富、操作简单，能与jeecms进行无缝整合，实现全站用户统一，门户网站首页轻松调用论坛数据，在用户体验方面能够更加自然的过渡，增加用户在站内应用的一站式服务用户体验。 详细说明： 1、注册： 邮箱逻辑验证漏洞： package com.jeecms.common.web.springmvc; public boolean ifMaxLength...

Joomla Component GarysCookBook v3.0.x File Upload Vulnerability

GarysCookBook Component is suffer from file/shell upload Vulnerability 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS,...