大汉Jvideo两处漏洞小合集（可能导致管理后台权限劫持）

简要描述： 两处。 详细说明： 一个是任意文件下载，一个是sql注入。 先看任意文件下载吧，任意文件下载可以下载到setup的相关安装信息，从而可以登录setup目录的管理后台 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/web.xml 来点好东西 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/ini/merpserver.ini 可以看见setup下Admin的密码（屏蔽了），登录成功 另外一个网站...

Beetel 450TC2 Router - Cross-Site Request Forgery (Admin Password)

Beetel 450TC2 Router - Cross-Site Request Forgery Admin Password ​​ input type=...

Beetel 450TC2 Router Admin Password CSRF Vulnerability

Exploit for hardware platform in category web applications input type="hidden" name="uiViewToolsPasswordConfirm"...

Beetel 450TC2 Router - Cross-Site Request Forgery (Admin Password)

docume...

COMTREND CT-5361T Router - 'Password.cgi' Cross-Site Request Forgery (Admin Password Manipulation)

source: https://www.securityfocus.com/bid/67033/info Comtrend CT-5361T ADSL Router is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user...

Free Monthly Websites 2.0 - Admin Password Change

Exploit for php platform in category web applications ========================================================================================== Title : Free Monthly Websites 2.0 Administrator Remote Password Change Date : 10/04/2013 Name : Free Monthly Websites Affected Version : 2.0 Vendor :...

Design/Logic Flaw

The Change Password dialog box changepassword in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request...

CVE-2014-2849

The CVE-2014-2849 issue affects Sophos Web Appliance (versions up to 3.8.1.x). A flaw in the Change Password dialog (change_password) allows remote authenticated users to change the admin password, potentially enabling privilege escalation. Red Hat confirms the vulnerability; ZDI and other adviso...

逐浪CMS任意SQL游走CMS2 V1.4 V1.5、 CMS6.0均受影响（其他版本死链未测）

简要描述： 问题出现在详细说明中 详细说明： 问题出现在 User\Develop\ashx\UserTage.ashx 代码片段： try MZoneNode MZN = new MZoneNode; BEditPage BEP = new BEditPage; MZN.NodeID = Convert.ToInt32nodeid; MZN.UserID = BU.GetLogin.UserID; string strTemp = style; string strStyle = strTemp.Split'|'; if strStyle != null foreach string...

QuickCms 5.4 - Multiple Vulnerabilites

Exploit for php platform in category web applications Exploit Title: QuickCms 5.4 Multiple Vulnerabilites Date: 04/08/2014 Author: shpendk Software Link: http://opensolution.org/download,en,18.html?sFile=Quick.Cms/Quick.Cmsv5.4.zip Version: 5.4 Tested on: Xampp on Windows Reflected XSS...

QuickCms 5.4 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: QuickCms 5.4 Multiple Vulnerabilites Date: 04/08/2014 Author: shpendk Software Link: http://opensolution.org/download,en,18.html?sFile=Quick.Cms/Quick.Cmsv5.4.zip Version: 5.4 Tested on: Xampp on Windows Reflected XSS Vulnerability in Admin Area: Trigger:...

Quick.CMS 5.4 - Multiple Vulnerabilities

Exploit Title: QuickCms 5.4 Multiple Vulnerabilites Date: 04/08/2014 Author: shpendk Software Link: http://opensolution.org/download,en,18.html?sFile=Quick.Cms/Quick.Cmsv5.4.zip Version: 5.4 Tested on: Xampp on Windows Reflected XSS Vulnerability in Admin Area: Trigger:...

[CVE-2014-0683]Router Cisco RV110W - RV215W - CVR100W - Bypass Login Page - Admin Password Disclosure

Title: ====== Router CISCO RV110W - RV215W - CVR100W - Bypass Login Page Date: ===== 05/03/2014 CVE Number: ============ CVE-2014-0683 Cisco Security Advisory: =========== http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-rpd Status: ======== Reported to Cisco...

OSX: the HP printer tool program security vulnerabilities(HP Utility. app)?- Vulnerability warning-the black bar safety net

If you have a“newer”models of the HP Uility. app supported HP printer, then you can easily from the HP Utility program Management section of the printer configuration, this feature is and HP WebJet Admin provides similar functionality, but function a lot less, and is not suitable for the network...

D-link DSL-2640B Router Admin password change Information Disclosure - Ver2 (CVE-2010-1308)

An information disclosure vulnerability has been reported in La-souris-verte Com Svmap. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...

D-LINK DIR-615 Cross Site Request Forgery

Exploit Title: Dlink DIR-615 Hardware Version E4 Firmware Verion 5.10 CSRF Vulnerability Google Dork: N/A Date: 19/02/2014 Exploit Author: Dhruv Shah Vendor Homepage: http://www.dlink.com/us/en/home-solutions/connect/routers/dir-615-wireless-n-300-router Software Link: N/A Hardware Version:E4...

WRT120N 1.0.0.7 Stack Overflow

!/usr/bin/env python WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password. Craig Heffner http://www.devttys0.com 2014-02-14 import sys import urllib2 try: target = sys.argv1 except IndexError: print "Usage: %s " % sys.argv0 sys.exit1 url = target +...

WRT120N 1.0.0.7 - Remote Stack Overflow

!/usr/bin/env python WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password. Craig Heffner http://www.devttys0.com 2014-02-14 import sys import urllib2 try: target = sys.argv1 except IndexError: print "Usage: %s " % sys.argv0 sys.exit1 url = target +...

WRT120N 1.0.0.7 - Remote Stack Overflow

WRT120N 1.0.0.7 - Remote Stack Overflow !/usr/bin/env python WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password. Craig Heffner http://www.devttys0.com 2014-02-14 import sys import urllib2 try: target = sys.argv1 except IndexError: print "Usage: %s " % sys.arg...

Kloxo SQL Injection / Remote Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Kloxo SQL Injection and Remote Code Execution', 'Description' = %q This module exploits an unauthenticated SQL injection vulnerabilit...