CVE-2014-6324

Summary: CVE-2014-6324 affects the Microsoft Windows Kerberos Key Distribution Center (KDC) used by the Domain, affecting Windows Server 2003 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7, 8, 8.1, and Server 2012 Gold/R2. The vulnerability stems from improper validation of cryptographic signa...

Cicada-known Enterprise Portal system v2. 5 sql injection to admin-vulnerability warning-the black bar safety net

The problem is when the user modifies the information of the place /system/module/user/control.php public function edit$account = " if!$ account or RUNMODE == 'front' $account = $this-app-user-account; if$this-app-user-account == 'guest' $this-locateinlink'login'; if! empty$POST...

php云人才系统 小漏洞一步步getshell（后台）

简要描述： php云人才系统 小漏洞一步步getshell，这里包含了php与mysql交互时候的特性（也算一个漏洞），还有phpyun自身图片的验证机制问题，等等，步骤比较艰辛，本来想在这里搞一个csrf呢，找了半天没有找到，到时找到一大堆xss，这里就不利用xss了，且看分析 详细说明： 首先我们做一个小测试： 对于mysql存储来说，建站者都会给每一个字段设置长度，然后当我们插入进去的数据长度超过了设置的长度，那么mysql是不会报错，然而会自然截断存储，这个就给我们编写程序的人留下了隐患。 利用场景分析...

Multi Manage DbVisualizer Add Db Admin

Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases With GUI. The remote database can be accessed from the command line without the need to authenticate, which can be abused to create an administrator in the database with the proper database permissions. Note:...

PHPMyWind后台管理界面的SQL注入漏洞

简要描述： 后台管理界面因为过滤不严格导致SQL注入漏洞，可以使权限较低的管理员取得较高权限，以及获取并修改超级管理员的用户名密码。 详细说明： 存在问题的代码，adminsave.php 59-101行，SQL语句中的$id存在注入 else if$action == 'update' //创始人账号不允许更改状态 if$id == 1 and $checkadmin != 'true' or $levelname != '1' ShowMsg'抱歉，不能更改创始账号状态！','-1'; exit; //只有超级管理员才有权修改超级管理员 if$cfgadminlevel 1 and...

Ubuntu 12.04 LTS : linux-lts-quantal vulnerability (USN-2269-1)

Andy Lutomirski discovered a flaw with the Linux kernel's ptrace syscall on x8664 processors. An attacker could exploit this flaw to cause a denial of service System Crash or potential gain administrative privileges. Note that Tenable Network Security has extracted the preceding description block...

Oracle Database Server <= 10.1.0.2 - Buffer Overflow Exploit

No description provided by source. / Advanced SQL Injection in Oracle databases Exploit for the buffer overflow vulnerability in procedure MDSYS.MD2.SDOCODESIZE of Oracle Database Server version 10.1.0.2 under Windows 2000 Server SP4. Fixes available at http://metalink.oracle.com. The exploit...

Digital Scribe 1.4 Login SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14843/info Digital Scribe is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation cou...

CuteNews 1.4.6 editnews Module doeditnews Action Admin Moderation Bypass

No description provided by source. source: http://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that...

Cobbler 2.4.x - 2.6.x 本地文件包含

Cobbler是一个自动化管理和系统安装工具，安装过程中会配置授权和身份验证。 该软件并不对普通用户开放，而触发漏洞需要管理员。 并且，触发漏洞需要管理员主动添加如'/etc/passwd'的文件项目，然后进行项目查看才能读取任意文件。 0 2.4.x - 2.6.x 更新到最新版本...

PHPOK CSRF获取管理员权限

简要描述： PHPOK CSRF获取管理员权限 详细说明： PHPOK CSRF获取管理员权限 漏洞证明： 测试环境（PHPOK）： 添加用户： 抓包抓到如下内容： None 打开POC页面前： 打开后： 为此添加管理员成功。。。 理论上是通杀所有版本的。。。...

Project description is persistent XSS vector for project admins

This issue is a clone of another one that was fixed in OD but left unfixed in BTF as "admin xss". It has been pointed out by several customers that this exploit requires only project admin level of privilege. The following project description: code alert1 code Pops up in the view project page, th...

CVE-2013-3929

Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...

UBUNTU-CVE-2013-6382

Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging the CAPSYSADMIN capability for a 1 XFSIOCATTRLISTBYHANDLE or 2 XFSIOCATTRLISTBYHANDLE32...

JEECMS 逻辑和跨站再来四五发

简要描述： 再折磨最后一次，JEECMS中最郁闷的就是展现层用的freemarker，就算传了jsp也没法解析。JEEBBS和JEECMS的前台功能还算简单，偷个cookie跑台没法穿越改xml或者读tom猫密码或者系统配置不存在敏感信息还是不是那么容易拿到webshell的。刚又看了下能够读写配置的地方已经加上了StartWith判断了。如果能把逻辑漏洞和跨站什么的都解决了就完美了。 详细说明： 1、邮箱的两处没有验证xss 一处是注册，之前JEEBBS已经提过了，一处是修改密码那里。 直接用官方的demo站演示： 2、个人资料全部xss 依旧用demo站演示...

C.P.Sub 4.5 - Authentication Bypass

C.P.Sub 4.5 - Authentication Bypass !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: ...

C.P.Sub 4.5 - Authentication Bypass

!/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: = v4.5 Tested on: Windows 7 Improper...

C.P.Sub 4.5 Privilege Escalation Exploit

C.P.Sub versions 4.5 and below allows for administrative access escalation by the simple tweak of a user-supplied parameter. !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage:...

Foreman: app/controllers/users_controller.rb arbitrary admin user creation due to mass assignment

The create method in app/controllers/userscontroller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by 1 changing the admin flag or 2 assigning an arbitrary role...

espcms后台getshell-3，并可利用csrf交互强制管理员getshell

简要描述： 详细说明： 后台修改模板处未过滤，可在模板中插入php代码（此处方便演示，使用了phpinfo 本来，一个后台getshell的危害应该属于较低的，因为需要管理员权限。但是，espcms后台操作无token，通过csrf的交互，就可以强迫管理员干很多事。修改模板为shell的包如下： 无token，所以可以通过一个自动提交表单给管理员点击，然后就会自动getshell了。（此处主要是后台getshell，csrf就不再说了，详细的POC可以查看我以前提交的一些漏洞） 漏洞证明：...