H-Sphere Webshell 2.4 - Local Root Exploit

No description provided by source. source: http://www.securityfocus.com/bid/6527/info A vulnerability has been discovered in H-Sphere Webshell. During the pre-authentication phase Webshell fails to perform sufficient bounds checking on user-supplied HTTP parameters. As a result, a malicious...

elFinder 2.0 - file manager for web(rc1) - File Upload Vulnerability

Usage Info Info : u can upload .php .php3 .php6 .txt .html .pl .htaccess and ... Upload Your webshell and load from : site.com/var/upload/ro0t.php site.com/files/upload/ro0t.php site.com/var/upload/ro0t.php for get file url double click on your file to open file iframe page |/ o o...

Antak WebShell - A webshell which utilizes PowerShell

Antak is a webshell written in C.Net which utilizes powershell. Antak is a part of Nishang and updates could be found here: https://github.com/samratashok/nishang Use this shell as a normal powershell console. Each command is executed in a new process, keep this in mind while using commands like...

某图书管理系统存在默认口令导致getshell

简要描述： 图书管理系统自带tomcat存在默认管理员口令，可以直接getshell，影响大量图书管理馆 详细说明： 自带tomcat系统存在默认管理员账号： 可以登录tomcat，直接上传webshell 漏洞证明： intitle:博云非书资料管理系统 inurl:poweb 可以发现大量图书馆使用了该系统，都可以登录tomcat后台，上传webshell：...

Open source BUG tracking platform JIRA directory traversal vulnerability analysis-vulnerability warning-the black bar safety net

Recently, a new announcement report a Jira 5.0. 1 1 and 6. 0. 3 versions of the directory traversal vulnerability in the last 7 months to be verified, and in the next few months to repair. Attack method is very simple, but the potential impact is very large, the vulnerability could allow an...

U-Mail邮件系统上传文件缺陷导致暴力getshell

简要描述： U-Mail邮件系统某处上传缺陷，导致可以暴力获取webshell 详细说明： 漏洞文件：C:\umail\WorldClient\html\client\mail\module\oattach.php 代码： if ACTION == "attach-upload" if $FILES $filename = $FILES'Filedata''name'; $filetype = $FILES'Filedata''type'; $filesize = $FILES'Filedata''size'; $filesource = $FILES'Filedata''tmpname...

NetCms website management system upload vulnerability and fix-vulnerability warning-the black bar safety net

NetCms website management system upload vulnerability and fix Vulnerabilities Web application:NetCms website management system Vulnerability in the file the website registration address:/user/login. aspx 1. First of all, we in the Baidu or Google searchkeywords: “NetCms site management system” ! ...

科讯KESION CMS最新版任意文件上传WEBSHELL

简要描述： 最新版本上传漏洞哦^^ 详细说明： 会员上传文件漏洞，可以上传任意后缀 user/swfupload.asp文件漏洞 If UpFileObj.Form"NoReName"="1" Then '不更名 Dim PhysicalPath,FsoObj:Set FsoObj = KS.InitialObjectKS.Setting99 PhysicalPath = Server.MapPathreplaceTempFileStr,"|","" TempFileStr= midTempFileStr,1, InStrRevTempFileStr, "/" & FileTitles ...

U-mail后台任意文件上传漏洞（测试version=20100326）

简要描述： 两个问题： 1.U-mail后台存在任意文件上传漏洞，利用需要具有管理员权限的用户。 2.湖南省农业综合开发办公室、湖南省会计管理系统被黑记录 详细说明： 演示案例为：湖南省农业综合开发办公室 http://220.168.30.69:8080/webmail/admin/index.php 用户admin 密码123456 该公网IP220.168.30.69映射了很多web服务，如湖南省财政厅下属的会计考试报名管理等系统 http://220.168.30.69:6011/collectdata/...

Easily around the various WAF POST injection, cross-site Defense(such as security Dog)-vulnerability warning-the black bar safety net

XXX before there was mention of a multipart request to bypass the various WAF way: 3 6 0 website po/security po/accelerating music and other similar product protection to bypass the defective one, and seemingly didn't cause much concern. Found out today that a security Dog gets smart before that ...

PHP168 6.0 and below the version login. php memory major security vulnerability-vulnerability warning-the black bar safety net

A big problem, it is best not to ignore。。。。 The use of the code will be php Trojan is inserted into the cache/directory to easily get webshell, you can bulk. Use a search engine to search Powered by php168 v6 or what version of v5, v4, v3, v2, v1 will search to many, many more related site Since...

phpcms front Desk avatar upload vulnerability to cause the webshell detailed and case-vulnerability warning-the black bar safety net

What is upload vulnerability A lot of cms in order to enrich their functions are to provide the upload an avatar, upload pictures and other functions. But if the uploaded content does not do better than the filter, it is equal to say to the attacker to an arbitrary code execution. For example, an...

Allied Telesis AT-RG634A ADSL Broadband Router - Unauthenticated Webshell

Exploit for hardware platform in category web applications Title: Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell. Vulnerability Information: - CVE: CVE-2014-1982 - Type of Vulnerability: - CWE-78 : OS Command Injection - CWE-306 : Missing...

Allied Telesis AT-RG634A ADSL Broadband Router - Web Shell

Title: Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell. Vulnerability Information: - CVE: CVE-2014-1982 - Type of Vulnerability: - CWE-78 : OS Command Injection - CWE-306 : Missing Authentication for Critical Function Affected products: - Allied Teles...

Allied Telesis AT-RG634A Unauthenticated Webshell

Title: Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell. Vulnerability Information: - CVE: CVE-2014-1982 - Type of Vulnerability: - CWE-78 : OS Command Injection - CWE-306 : Missing Authentication for Critical Function Affected products: - Allied Teles...

National Civil Service Bureau, the suspect had been hacking found webshell traces-vulnerability warning-the black bar safety net

Attention Gov safe! Continue crawling and scanning the directory and found a former cattle over the traces Continue to Scan down··· ! These are all the pony··Malaysia··pictures of horses··horses··· ! The LDAP build ! This pants is not insurance.···visual inspection has been off···...

强智综合教务系统后台上传漏洞，可沦陷服务器

简要描述： 后台上传获取webshell 通过搜索获得Oracle数据库管理权限 修改成绩 详细说明： http://www.qzdatasoft.com:8088/qznjw/ewebeditor/admin/ 默认账号密码admin 直接上传webshell 获取root权限 （ewebeditor后台授权漏洞修补 目前无法使用ewebeditor后台进行上传） 搜索 oracle.jdbc.driver.OracleDriver 可以获取Oracle数据库账号密码 通过官方PDF文档知晓 成绩保存在CJ0708 补考保存在CJ0708BK 通过近期对服务器信息收集发现...

Java Faces Miniwebshell

Всем привет, немного посмотрел java server faces. Если у вас есть возможнось загрузить shell.xhtml и как-то проинклудить его, то вот небольшой вебшелл. Соус в том, что мы не можем создавать переменные или что-то куда-то нормально присваивать. Но можем вызывать стейтменты, подгружать классы и в...

Ecmall存储型xss可Getshell（有条件）

简要描述： 希望厂商不要又是通过XX渠道知晓，没有人修复找我修吧，在家待业中... 详细说明： 标题党一下，实际上是一处xss，欺骗管理访问下我们发布的商品页面便可结合csrf直接getshell，成功率还是很可观的，即使骗不到管理员也可以骗到其他的店主，也就发了。 注册会员开店发布商品，挨个fuzz，终于有地方没有过滤，tags和货号处存在xss漏洞。 后台可以直接编辑php文件，并且没有token的校验，正好可以拿来利用getshell: http://ecmall/admin/index.php?app=widget&act=edit&name=notice&file=script...

PHPMyWind后台无条件获取webshell

简要描述： 当时我就惊呆了... 详细说明： 在/include/mysql.class.php487行有这样一段代码 //保存MySql错误日志 $userIP = GetIP; $getUrl = GetCurUrl; $getTime = GetDateTimetime; $logfile = dirnameFILE.'/../data/error/mysqlerrortrace.php'; $savemsg = ' Time: '.$getTime.'. || Page: '.$getUrl.' || IP: '.$userIP.' || Error: '.$msg."\r\n"...