Struts2 S2-016 Remote Command Execution Vulnerability in Shenzhen Huan Yu Huan Tong Logistics Website Management System

Shenzhen HuanYuHuTong Logistics Website Management System is a logistics website management system developed and maintained by HuanYuHuTong Information Technology Co. Shenzhen HuanYuHuTong logistics website management system uses Apache Struts xwork as the website application framework, due to th...

Linyi Yifeng Network Technology Service Co., Ltd. website system has SQL injection vulnerabilities

Linyi Yifeng Network Technology Service Co., Ltd. is a comprehensive network technology service company integrating e-commerce service, e-commerce training and e-commerce. SQL injection vulnerability exists in the website building system of Linyi Yifeng Network Technology Service Co. Ltd. Due to...

SQL injection vulnerability in the channelcode parameter of the government website building system belonging to Beijing Hezheng Software Co.

Government website system is a set of software developed specifically for government websites. A SQL injection vulnerability exists in the channelcode parameter of the government website system belonging to Beijing Hezheng Software Co. The vulnerability allows an attacker to exploit the...

某通用型建站系统SQL注射之九

简要描述： 之九 详细说明： 某通用型建站系统SQL注射之九。 源码：XYCMS律师事务所网站系统v1.3 地址：http://code.it168.com/d-25428.shtml 注入点：showflfg.asp?id= 可谷歌搜索：inurl:showflfg.asp?id= 实例： http://www.yn148.net/showflfg.asp?id=22 http://www.dbawx.com/showflfg.asp?id=21 http://www.keyels.com/showflfg.asp?id=29...

XDcms订餐网站系统单店版注入(demo测试)

简要描述： rt 详细说明： 黑盒demo测试 首先注册一个用户，然后修改用户资料 http://dd.xdcms.cn/index.php?m=member&f=edit 修改完成之后，下单点餐。 然后报错了。二次注入 由于demo有安全狗，就没用深入测试了。 漏洞证明：...

ECStore开源网店系统任意文件读取漏洞

简要描述： 后台模板编辑功能可越权查看系统文件 详细说明： file参数对../未做过滤，导致可以跨目录读取文件 测试url：http://shop.xxx.com/index.php/shopadmin/index.php?app=site&ctl=adminthemewidget&act=preview&theme=ecstore&file=../../../../../etc/passwd 漏洞证明：...

YiDacms 最新版重置任意用户账户二及其他越权操作

简要描述： YiDacms 最新版重置任意用户账户，及其他越权操作 详细说明： 易达CMS 企业建站系统 当前最新版本是：YidaCms X3.2（20140718）版 之前发过一次重置任意用户密码的漏洞，但是只能修改成固定的密码，要是修改成任意密码的话，比较麻烦，需要md5明文密码后取10位作为信息密码，较麻烦。 这里我们直接输入任意明文密码，即可修改 来看看源代码： 文件/Yidacms/user/user.asp if request"yidacms"="password" Then set rs=server.createobject"adodb.recordset" useri...

e107 Website System 0.6 Nested BBCode URL Tag Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14301/info e107 Website System is prone to a script injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrar...

e107 website system 0.6 usersettings.php avmsg Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/10436/info e107 is prone to multiple cross-site scripting, HTML injection, file inclusion, and SQL injection vulnerabilities. This may compromise various security properties of a Web site running the software, including...

e107 Website System 0.555 DB.PHP Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8273/info e107 Website System 'db.php' has been reported prone to an information disclosure vulnerability. A remote attacker may exploit this vulnerability to invoke the dumpsql routine without prior authentication...

e107 Website System 0.617 Request.PHP Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13573/info e107 Website System is prone to a directory traversal vulnerability. This issue could be exploited to obtain the contents of arbitrary files on the vulnerable computer...

e107 0.7.23 - SQL Injection Vulnerability.

No description provided by source. Vulnerability ID: HTB22604 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityine1072.html Product: e107 Website System Vendor: e107 http://www.e107.org/ Vulnerable Version: 0.7.23 and Probably Prior Versions Vendor Notification: 13 September 20...

E107 Website System 0.6 Attached File Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14495/info e107 Website System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have...

e107 website system 0.6 "email article to a friend" Feature XSS

No description provided by source. source: http://www.securityfocus.com/bid/10436/info e107 is prone to multiple cross-site scripting, HTML injection, file inclusion, and SQL injection vulnerabilities. This may compromise various security properties of a Web site running the software, including...

e107 Website System 0.617 Forum_viewforum.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13576/info e107 Website System is prone to an SQL injection vulnerability. This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other...

e107 Website System 0.5/0.6 Log.PHP HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10395/info It is reported that e107 website system is prone to a remote HTML injection vulnerability. This issue is due to a failure by the application to properly sanitize user-supplied input. The problem presents itself...

JVN#06870202: EC-CUBE information disclosure vulnerability

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability. Impact When the server receives a specially crafted request, the absolute path of the product on the server may be obtained. Solution Apply the update or...

Qi Bo cms website system is improperly configured to cause the arbitrary user login vulnerability-vulnerability warning-the black bar safety net

Vulnerability type: unauthorized access/permissions bypass Brief description: Qi Bo cms whole Station system of the original PHP168 configured improperly cause any user login, such as the cms administrator. Detailed description: Or due to UCCENTER the problem, before it is too UCKEY variable is...

Cannes the company registered the class website system cookie injection vulnerability-vulnerability warning-the black bar safety net

Cannes the company registered the class website system v9. 6 cookies injection transit http://www.xxxx.com /jmcook. asp? jmdcw=1 7+and 1=2 union select 1,2,password,4,5,password,7,8,9,1 0,1 1,1 2,1 3 from admin Background get the shell cookies name kid can upload ewe modify the style Database...

Period-rich ultra-personal website system guestbook write horse vulnerability-vulnerability warning-the black bar safety net

Source code download: http://www.mycodes.net/24/2149.htm addgbook. asp to submit a word. Connection: google:as anti-batch, Tello is!...