74CMS talent system v3. 2 injection and full version pass rounded out the background is attached using the EXP-bug warning-the black bar safety net

Set of procedures filter is still relatively full, but all versions are GBK encoding is his flawed but basically the string into the library when the author used the iconv to convert the submitted over the data encoding into utf8 So the use of wide-character injection there is no way out but the...

MyMarket 1.72 bypass admin login & product_details blind sqli

Exploit for php platform in category web applications Exploit Title: MyMarket 1.72 bypass admin login & productdetails blind sqli Google Dork: intext:"MyMarket version 1.71" Tested on: Linux Bug finder & Exploit Coder:NEt Bomber http://fb.me/net.bomba Beside other sqli exploits found on exploits...

ecshop最新版本SQL注入+存储XSS=任意管理员登录

简要描述： 一个功能点的SQL注入和存储XSS，内含多种技巧，我觉得我就是个艺术家～～ 详细说明： 刚下的ecshop V2.7.3版本～ 1.漏洞存在于站外广告统计功能对应管理后台的报表统计-站外投放JS，即/affiche.php页面，将from参数网站来源referer存储到了数据库表ecsadsense，而在后台的“站外投放JS”读取出来未过滤又进入了sql语句，导致二次注入。 /affiche.php 119行 $sql = "INSERT INTO " . $ecs-table'adsense' . "fromad, referer, clicks VALUES '-1', ...

Smoke Loader LFI / File Deletion

Two other vulnerabilities I forgot to mention, lfi and file deletion via control.php. The user must be logged into the administrative panel. 1. LFI GET http://evilserver.net/control.php?act=dwnshell&file=../../../../etc/passwd Enter username for Who are you? at evilsite.net:80:eviladmin Password:...

0day full - Free Monthly Websites v2.0 - Multiple Web Vulnerabilities

Title: ====== Free Monthly Websites v2.0 - Multiple Web Vulnerabilities Date: ===== 2013-02-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=851 VL-ID: ===== 851 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: =============...

Free Monthly Websites 2.0 - Multiple Vulnerabilities

Free Monthly Websites 2.0 - Multiple Vulnerabilities Title: ====== Free Monthly Websites v2.0 - Multiple Web Vulnerabilities Date: ===== 2013-02-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=851 VL-ID: ===== 851 Common Vulnerability Scoring System:...

Free Monthly Websites 2.0 - Multiple Vulnerabilities

Title: ====== Free Monthly Websites v2.0 - Multiple Web Vulnerabilities Date: ===== 2013-02-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=851 VL-ID: ===== 851 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: =============...

Free Monthly Websites 2.0 Multiple Vulnerabilities

Exploit for php platform in category web applications ========================================================================================== Free Monthly Websites 2.0 Multiple Vulnerabilities ==========================================================================================...

Free Monthly Websites v2.0 - Multiple Web Vulnerabilities

Document Title: =============== Free Monthly Websites v2.0 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=851 Release Date: ============= 2013-02-04 Vulnerability Laboratory ID VL-ID: ==================================== 8...

CVE-2011-5255

CVE-2011-5255 corresponds to multiple XSS weaknesses in X3 CMS, affecting admin/login for version 0.4.3.1 and earlier. The vulnerability allows remote attackers to inject arbitrary web script or HTML via PATH_INFO, username, or password parameters. Reports in the connected documents confirm the a...

PT-2013-1470

Name of the Vulnerable Software and Affected Versions X3 CMS versions 0.4.3.1 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the PATH INFO, username, or password...

CVE-2011-5255: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin/login in X3 CMS 0.4.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, 2 username, or 3 password parameter...

CVE-2012-6507

Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL commands via the 1 uname or 2 pass parameters in a login action...

AwAuctionScript (Aw Auction Script - Market Place for WebMasters) Multiple Vulnerabilities

========================================================================================== AwAuctionScript Aw Auction Script - Market Place for WebMasters Multiple Vulnerabilities ==========================================================================================...

Sunny Navigation System cms the background filter is not strict vulnerability-vulnerability warning-the black bar safety net

BY: madmen From 1 6 3 Micro Forum Test URL http://www.xxx.com/admin/log/dispcont.asp admin/log/dispcont. asp View administrator login records where the filter is not strict lead to can view the login record of success Although success is cmd5 encryption, but a large part can be cracked Tasteless ...

SongCMS enterprise website backstage management system, several problems result getshell-a vulnerability warning-the black bar safety net

SongCMS enterprise built Station system is based on ASP+ACCESS/SQL technical site background management system, Suitable for General programmers to develop a variety of personalized corporate website,database and call the function have detailed comments; ewebeditor: inc/ewebeditor/adminlogin. asp...

PT-2012-3635

Name of the Vulnerable Software and Affected Versions Wolf CMS versions 0.75 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for various requests. This includes deleting users via the user id number to "admin/user/delete", deleting pages vi...

CVE-2012-1897: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 delete users via the user id number to admin/user/delete; 2 delete pages via the page id number to admin/page/delete;...

Smart PHP Poll - CSRF/SQLi Vulnerabilities

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Beijing Huasheng website management system injection vulnerability-vulnerability warning-the black bar safety net

Default background: admin/Login. asp Default password: admin 1 2 3 4 5 6 exp: http://www.xxxxx.com/showpt.asp?id=1568 and 1=2 union select 1,password,3,username,5,6,7,8,9,1 0,1 1,1 2,1 3,1 4,1 5 from admin Note: error will return to the home page. As the field does not, to construct their own it!...