1383 matches found
Project description is persistent XSS vector for project admins
This issue is a clone of another one that was fixed in OD but left unfixed in BTF as "admin xss". It has been pointed out by several customers that this exploit requires only project admin level of privilege. The following project description: code alert1 code Pops up in the view project page, th...
CVE-2013-3929
Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...
UBUNTU-CVE-2013-6382
Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging the CAPSYSADMIN capability for a 1 XFSIOCATTRLISTBYHANDLE or 2 XFSIOCATTRLISTBYHANDLE32...
JEECMS 逻辑和跨站再来四五发
简要描述： 再折磨最后一次，JEECMS中最郁闷的就是展现层用的freemarker，就算传了jsp也没法解析。JEEBBS和JEECMS的前台功能还算简单，偷个cookie跑台没法穿越改xml或者读tom猫密码或者系统配置不存在敏感信息还是不是那么容易拿到webshell的。刚又看了下能够读写配置的地方已经加上了StartWith判断了。如果能把逻辑漏洞和跨站什么的都解决了就完美了。 详细说明： 1、邮箱的两处没有验证xss 一处是注册，之前JEEBBS已经提过了，一处是修改密码那里。 直接用官方的demo站演示： 2、个人资料全部xss 依旧用demo站演示...
C.P.Sub 4.5 - Authentication Bypass
C.P.Sub 4.5 - Authentication Bypass !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: ...
C.P.Sub 4.5 - Authentication Bypass
!/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: = v4.5 Tested on: Windows 7 Improper...
C.P.Sub 4.5 Privilege Escalation Exploit
C.P.Sub versions 4.5 and below allows for administrative access escalation by the simple tweak of a user-supplied parameter. !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage:...
Foreman: app/controllers/users_controller.rb arbitrary admin user creation due to mass assignment
The create method in app/controllers/userscontroller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by 1 changing the admin flag or 2 assigning an arbitrary role...
espcms后台getshell-3，并可利用csrf交互强制管理员getshell
简要描述： 详细说明： 后台修改模板处未过滤，可在模板中插入php代码（此处方便演示，使用了phpinfo 本来，一个后台getshell的危害应该属于较低的，因为需要管理员权限。但是，espcms后台操作无token，通过csrf的交互，就可以强迫管理员干很多事。修改模板为shell的包如下： 无token，所以可以通过一个自动提交表单给管理员点击，然后就会自动getshell了。（此处主要是后台getshell，csrf就不再说了，详细的POC可以查看我以前提交的一些漏洞） 漏洞证明：...
WordPress Plugin User Role Editor 3.12 - Cross-Site Request Forgery
WordPress Plugin User Role Editor 3.12 - Cross-Site Request Forgery Exploit Title: WP User Role Editor CSRF Date: 19/5/13 Exploit Author: Henry Hoggard Author Website: http://henryhoggard.co.uk Vendor Homepage:https://wordpress.org/support/plugin/user-role-editor Software...
ecshop最新2.7.3后台可注射提权
简要描述： ecshop最新2.7.3后台低权限用户登录以后可进行注射提权 详细说明： 问题出在admin/shopinfo.php的108行 if $REQUEST'act' == 'edit' / 权限判断 / adminpriv'shopinfomanage'; / 取得文章数据 / $sql = "SELECT articleid, title, content FROM ".$ecs-table'article'."WHERE articleid =".$REQUEST'id'; $article = $db-GetRow$sql; id没有过滤直接进行查询，构造语句...
Simple Machine Forum 2.0.x 2.0.4 - File Disclosure Directory Traversal
Simple Machine Forum 2.0.x 2.0.4 - File Disclosure Directory Traversal Exploit Title: SMF /index.php?action=admin;area=logs;sa=errorlog;file=BASE64 ENCODED FILE PATH;line=LINE NUMBER Example : /srv/www/smf/Settings.php : L3Nydi93d3cvc21mL1NldHRpbmdzLnBocA= /etc/passwd : L2V0Yy9wYXNzd2Q= SMF...
CVE-2011-4961
SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDITPERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups...
webpa 1.1.0.1 - Multiple Vulnerabilities
:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2012-08-23 WebPA fail'; fputs$fp, $headers; return $fp; function httprecv$fp $ret=""; while !feof$fp $ret.= fgets$fp, 1024;...
PBBoard - Authentication Bypass
PBBoard - Authentication Bypass source: https://www.securityfocus.com/bid/54862/info PBBoard is a web-based messaging board application implemented in PHP. Attackers may exploit these issues to gain unauthorized access to user accounts or to bypass intended security restrictions. Other attacks ma...
Jrobalian CMS SQL Injection Vulnerability
Exploit for php platform in category web applications ===================================================== Jrobalian CMS SQL Injection Vulnerability =====================================================...
Jrobalian CMS SQL Injection Vulnerability
===================================================== Jrobalian CMS SQL Injection Vulnerability ===================================================== :----------------------------------------------------------------------------------------------------------------------------------------: :...
Jrobalian CMS SQL Injection
===================================================== Jrobalian CMS SQL Injection Vulnerability ===================================================== :----------------------------------------------------------------------------------------------------------------------------------------: : Exploi...
NEC Backdoor Administrative Account
Exploit for hardware platform in category remote exploits NEC Corp. has a product line of high perfomance servers - http://www.nec.com.sg/index.php?q=products/enterprise-servers In the documentations it is said that there is two user privilege levels: 1. Common user - who can monitor the system...