Z-blog 1.8 cmd.asp xss跨站漏洞

No description provided by source. !/usr/bin/env python coding: utf-8 from urlparse import urljoin from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = '20520' ssvid version = '1.0' author = 'Disorder' vulDate = ''...

Z-Blog Database Disclosure

/ /| | || || | | | | | || | / \ / || | / | | | | / / |||| | | | | | | / \ | | | / /| /| // |\ || |||| || ||||// \||\ ||| \ ..Bl4ck H4T.. ============================================================================== » Z-Blog 1.8 Remote Database Disclosure Vulnerability...

Z-Blog 1.8 Remote Database Disclosure Vulnerability

Exploit for unknown platform in category web applications =================================================== Z-Blog 1.8 Remote Database Disclosure Vulnerability =================================================== ============================================================================== +...

z-blog 1.8 c-function.asp 跨站脚本漏洞

No description provided by source...

z-blog 1.7 c-urlredirect.asp 跨站脚本漏洞

No description provided by source...

z-blog 1.8 c-error.asp 跨站脚本漏洞

No description provided by source...

z-blog 1.8 catalog.asp 跨站脚本漏洞

No description provided by source...

Z-BLOG XSS Vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability description: Z-BLOG backend login error message display file cerror. asp, although the jump of the URL-parameter sourceurl encoded, but does not determine the link header, the implementation of the javascript pseudo-Protocol, resulting in cross-site scripting vulnerability...

Z-Blog 1.8 Arwen Build 81206 catalog.asp 存在跨站漏洞

Z-Blog是一个asp的博客系统。 catalog.asp，对参数tags过滤不严，存在跨站漏洞。 Z-Blog 1.8 Arwen Build 81206 暂无 等待官方补丁。 http://www.rainbowsoft.org/ http://blog.rainbowsoft.org/catalog.asp?tags=Z-Blog"/titlescriptalert'sebug'/script...

Z-BLOG V1.8 c_error.asp跨站漏洞

Z-BLOG后台登陆错误信息显示文件cerror.asp，虽然对跳转URL的参数sourceurl进行了编码，但没有判断链接头部，执行了javascript伪协议，造成跨站脚本漏洞。 Z-BLOG V1.8 暂无 等待官方补丁 www.rainbowsoft.org http://www.target.com/function/cerror.asp?errorid=7&number=0&description=&source=&sourceurl=javascript:alertdocument.cookie...

Z-Blog infinite loop vulnerability attack caused by blog with frequent pop-vulnerability warning-the black bar safety net

Writing a blog is now a lot of people part of every day life, many users like to record diary-like intentions in a blog to record their life and thoughts, but the blog as a personal Journal seems to be on the safe side by a lot of users ignore, personal blog security really can be ignored? A lot ...

Z-blog FUNCTION/c_function.asp跨站脚本攻击漏洞

Z-Blog是一款基于Asp平台的Blog博客网志程序，支持Wap，支持Firefox，Oprea等浏览器，在国内使用非常广泛，官方主页在http://www.rainbowsoft.org/。Z-blog代码严谨，前台功能简洁，后台功能强大，这为它的产品安全带来很大的优势，但是在上次的xss漏洞被公布后，80sec在产品中又发现一个严重的跨站脚本攻击漏洞，加上产品设计上的一些问题可能带来严重的后果。 在FUNCTION/cfunction.asp中，程序处理UBB标签的时候存在漏洞，导致任何用户可以在目标页面内执行任意js代码，利用该代码恶意用户可以获取目标站点的所有权限。漏洞代码如下...

Z-blog跨站脚本攻击漏洞

Z-Blog是一款基于Asp平台的Blog博客网志程序，支持 Wap，支持Firefox，Oprea等浏览器，在国内使用非常广泛，官方主页在http://www.rainbowsoft.org/。Z- blog代码严谨，前台功能简洁，后台功能强大，这为它的产品安全带来很大的优势，但是80sec在产品中发现一个严重的跨站脚本攻击漏洞，加上产品设计 上的一些问题可能带来严重的后果。 在FUNCTION/curlredirect.asp中，程序对提交的url参数做如下处理 strUrl=URLDecodeForAntiSpamRequest.QueryString"url"...

Improper access control

Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...

CVE-2007-3083

Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...

CVE-2007-3083

CVE-2007-3083 affects Z-Blog 1.7, where sensitive data is stored under the web root with insufficient access control. An attacker can directly access zblog.mdb to download the database, per NVD entry. The CVSS v2 vector (AV:N/AC:L/Au:N/C:C/I:N/A:N) yields a base score of 7.8 (High). No remediatio...

CVE-2007-3083

Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...

Z-Blog 1.7 Authentication Bypass Database Download Vulnerability

Author : Hasadya Raed Contact : [email protected] Israel Hacker Greetz : Fairoz : Advisory : Z-Blog 1.7 Authentication Bypass/Database Download Vulnerability Script : Z-Blog 1.7 Impact : Remote Googledork : "Powered by Z-Blog 1.7" , "Powered By Z-Blog 1.7 Laputa Build 70216" Download :...