R-Scripts VRS 7R Multiple Stored XSS And CSRF Vulnerabilities

Summary PHP Vacation Rental Script is the best solution for your vacation rentals online business. Description The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions...

X2Engine 4.2 - Arbitrary File Upload / CSRF Vulnerabilities

Exploit for php platform in category web applications X2Engine 4.2 - Arbitrary File Upload Details: It was discovered that authenticated users were able to upload files of any type providing that the file did not have an extension that was listed in the following blacklist: const EXTBLACKLIST =...

Huawei AR1200 series routers the background code for any implementation-vulnerability warning-the black bar safety net

School to a group of routers, not with, then test the following There's a function System administration diagnostics Ping ! Constituency 045. png Capture code area POST http://192.168.1.119/view/main/config.cgi HTTP/1.1 Host: 192.168.1.119 Connection: keep-alive Content-Length: 3 7 2 Origin:...

ESPCMS最新版后台登入绕过DEMO测试

简要描述： 漏网之鱼，同样是加解密函数，但又与以前不同。 详细说明： 看看加解密函数 function eccode$string, $operation = 'DECODE', $key = '@LFK24s224%@safS3s%1f%', $mcrype = true $result = null; if $operation == 'ENCODE' if extensionloaded'mcrypt' && $mcrype $result = $this-encryptCookie$string, $key; else for $i = 0; $i...

ecshop一处验证码绕过逻辑漏洞

简要描述： 一处逻辑漏洞导致绕过 详细说明： 虽然验证码进行了加密，但是逻辑上还有点问题 问题出在 ..\includes\clscaptcha.php 通过验证函数可以看到直接返回，并没有对验证失败进行处理 function checkword$word $recorded = isset$SESSION$this-sessionword ? base64decode$SESSION$this-sessionword : ''; $given = $this-encryptswordstrtoupper$word; //MD5加密处理 return pregmatch"/$given/...

CVE-2014-9193 Innominate mGuard Improper Privilege Management

Innominate mGuard with firmware before 7.6.6 and 8.x before 8.1.4 allows remote authenticated admins to obtain root privileges by changing a PPP configuration setting...

CVE-2014-6324

Summary: CVE-2014-6324 affects the Microsoft Windows Kerberos Key Distribution Center (KDC) used by the Domain, affecting Windows Server 2003 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7, 8, 8.1, and Server 2012 Gold/R2. The vulnerability stems from improper validation of cryptographic signa...

Cicada-known Enterprise Portal system v2. 5 sql injection to admin-vulnerability warning-the black bar safety net

The problem is when the user modifies the information of the place /system/module/user/control.php public function edit$account = " if!$ account or RUNMODE == 'front' $account = $this-app-user-account; if$this-app-user-account == 'guest' $this-locateinlink'login'; if! empty$POST...

php云人才系统 小漏洞一步步getshell（后台）

简要描述： php云人才系统 小漏洞一步步getshell，这里包含了php与mysql交互时候的特性（也算一个漏洞），还有phpyun自身图片的验证机制问题，等等，步骤比较艰辛，本来想在这里搞一个csrf呢，找了半天没有找到，到时找到一大堆xss，这里就不利用xss了，且看分析 详细说明： 首先我们做一个小测试： 对于mysql存储来说，建站者都会给每一个字段设置长度，然后当我们插入进去的数据长度超过了设置的长度，那么mysql是不会报错，然而会自然截断存储，这个就给我们编写程序的人留下了隐患。 利用场景分析...

Multi Manage DbVisualizer Add Db Admin

Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases With GUI. The remote database can be accessed from the command line without the need to authenticate, which can be abused to create an administrator in the database with the proper database permissions. Note:...

PHPMyWind后台管理界面的SQL注入漏洞

简要描述： 后台管理界面因为过滤不严格导致SQL注入漏洞，可以使权限较低的管理员取得较高权限，以及获取并修改超级管理员的用户名密码。 详细说明： 存在问题的代码，adminsave.php 59-101行，SQL语句中的$id存在注入 else if$action == 'update' //创始人账号不允许更改状态 if$id == 1 and $checkadmin != 'true' or $levelname != '1' ShowMsg'抱歉，不能更改创始账号状态！','-1'; exit; //只有超级管理员才有权修改超级管理员 if$cfgadminlevel 1 and...

Ubuntu 12.04 LTS : linux-lts-quantal vulnerability (USN-2269-1)

Andy Lutomirski discovered a flaw with the Linux kernel's ptrace syscall on x8664 processors. An attacker could exploit this flaw to cause a denial of service System Crash or potential gain administrative privileges. Note that Tenable Network Security has extracted the preceding description block...

Oracle Database Server <= 10.1.0.2 - Buffer Overflow Exploit

No description provided by source. / Advanced SQL Injection in Oracle databases Exploit for the buffer overflow vulnerability in procedure MDSYS.MD2.SDOCODESIZE of Oracle Database Server version 10.1.0.2 under Windows 2000 Server SP4. Fixes available at http://metalink.oracle.com. The exploit...

Digital Scribe 1.4 Login SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14843/info Digital Scribe is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation cou...

CuteNews 1.4.6 editnews Module doeditnews Action Admin Moderation Bypass

No description provided by source. source: http://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that...

Cobbler 2.4.x - 2.6.x 本地文件包含

Cobbler是一个自动化管理和系统安装工具，安装过程中会配置授权和身份验证。 该软件并不对普通用户开放，而触发漏洞需要管理员。 并且，触发漏洞需要管理员主动添加如'/etc/passwd'的文件项目，然后进行项目查看才能读取任意文件。 0 2.4.x - 2.6.x 更新到最新版本...

PHPOK CSRF获取管理员权限

简要描述： PHPOK CSRF获取管理员权限 详细说明： PHPOK CSRF获取管理员权限 漏洞证明： 测试环境（PHPOK）： 添加用户： 抓包抓到如下内容： None 打开POC页面前： 打开后： 为此添加管理员成功。。。 理论上是通杀所有版本的。。。...

Project description is persistent XSS vector for project admins

This issue is a clone of another one that was fixed in OD but left unfixed in BTF as "admin xss". It has been pointed out by several customers that this exploit requires only project admin level of privilege. The following project description: code alert1 code Pops up in the view project page, th...

CVE-2013-3929

Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...

UBUNTU-CVE-2013-6382

Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging the CAPSYSADMIN capability for a 1 XFSIOCATTRLISTBYHANDLE or 2 XFSIOCATTRLISTBYHANDLE32...