EUVD-2009-1479

Malware in sbrugna...

PuterJam\'s Blog PJBlog3 3.0.6 \'action.asp\' SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/34701/info PJBlog3 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

PJBlog3 V3. 2. 8. 3 5 2 file Action. asp to modify any user password 0day-vulnerability warning-the black bar safety net

PJBlog a set of open source free Chinese personal blog system program, using asp+Access technology, has a relatively high operating performance and Update rate, but also support the current Blog the use of new technologies In the file Action. asp: ElseIf Request. QueryString“action” =...

PJBlog v3.0.6.170 文件Action.asp xss跨站漏洞

PJBlog一套开源免费的中文个人博客系统程序，采用asp+Access的技术，具有相当高的运作效能以及更新率，也支持目前Blog所使用的新技术。 在文件Action.asp中： elseif request"action"="type1" then //第23行 dim mainurl,main,mainstr mainurl=request"mainurl" main=trimcheckstrrequest"main" response.clear mainstr="" If LenmemName0 Then mainstr=mainstr&"img...

PJBlog3 V3.2.8.352 Action.asp 任意修改用户问题和答案漏洞

PJBlog一套开源免费的中文个人博客系统程序，采用asp+Access的技术，具有相当高的运作效能以及更新率，也支持目前Blog所使用的新技术。 文件Action.aspp中： ElseIf Request.QueryString"action" = "UpdatePass" Then //第283行 If ChkPost Then Dim uID, uq, ua uID = CheckStrUnEscapeRequest.QueryString"id" uq = CheckStrUnEscapeRequest.QueryString"q" ua =...

PJBLOG文件Action.asp 修改任意用户密码

PJBlog一套开源免费的中文个人博客系统程序，采用asp+Access的技术，具有相当高的运作效能以及更新率，也支持目前Blog所使用的新技术 在文件Action.asp中： ElseIf Request.QueryString"action" = "updatepassto" Then //第307行 If ChkPost Then Dim ePass, eRePass, eID, eRs, ehash, dpass eID = CheckStrUnEscapeRequest.QueryString"id" ePass =...

PJBlog博客系统后台Action.asp页面DelUserID变量过滤不严导致SQL注入缺陷

文件control/ Action.aspp中： 1. ElseIf Request.Form"whatdo" = "DelUser" Then //第510行 2. Dim DelUserID, DelUserName, blogmemberNum, DelUserStatus 3. DelUserID = Request.Form"DelID" 4. blogmemberNum = conn.Execute"select countmemID from blogMember where memStatus='SupAdmin'"0 5. 6. DelUserStatus =...

PJBlog个人博客系统Action.asp页面跨站脚本攻击漏洞

在文件Action.asp中： elseif request"action"="type1" then //第23行 dim mainurl,main,mainstr mainurl=request"mainurl" main=trimcheckstrrequest"main" response.clear mainstr="" If LenmemName0 Then mainstr=mainstr&"img src=""images/download.gif"" alt=""下载文件"" style=""margin:0px 2px -4px 0px""/ a...