Discuz!x xss反弹后台无防御sql注入getshell(附带exploit)

简要描述： Discuz!x xss反弹后台无防御sql注入getshell，这里的xss只是做一个药引子，因为xss来自日志功能，然而这个日志功能却又默认关闭的，为了测试我们开启它。这个漏洞应该是所有dz通杀的，我下载了最新版本的所以测试通过...... 详细说明： 首先我们开启日志功能，然后存储一个xss看看： 测试一个xss页面： 我们调到文章页面看看，是否被执行了： 下来我们看看怎样把这个发给管理员呢，底下有一个举报页面： 我们以管理员的身份看看这个后台的举报请求： 这个过程我们分析完毕了，下来我们看看后台一处，无防御的sql注入：...

Wordpress Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities Google Dork: N/A Date: 09.09.2014 Exploit Author: Fikri Fadzil - email protected Vendor Homepage - http://wpsuportplus.byethost7.com/...

XSScrapy - Fast, thorough XSS vulnerability spider

Fast, thorough, XSS spider. Give it a URL and it'll test every link it finds for cross-site scripting vulnerabilities. XSS attack vectors xsscrapy will test Referer header way more common than I thought it would be! User-Agent header Cookie header added 8/24/14 Forms, both hidden and explicit URL...

WordPress Plugin WP Support Plus Responsive Ticket System 2.0 - Multiple Vulnerabilities

WordPress Plugin WP Support Plus Responsive Ticket System 2.0 - Multiple Vulnerabilities Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities Google Dork: N/A Date: 09.09.2014 Exploit Author: Fikri Fadzil - [email protected] Vendor...

WordPress Plugin Premium Gallery Manager - Configuration Access

WordPress Plugin Premium Gallery Manager - Configuration Access Exploit Title : Wordpress Plugins Premium Gallery Manager Unauthenticated Configuration Access Vulnerability Author : Hannaichi @dntkun Date : February 5th, 2014 Type : php, html, htm, asp, etc. Category : Web Applications...

CVE-2014-4759

An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager BPM 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results...

CVE-2014-4759

IBM BPM 8.5.x through 8.5.5 is affected by CVE-2014-4759 due to an Ajax service in the Content Management toolkit that allows authenticated users to perform a document-attachment search and read document properties, potentially exposing sensitive information. The vulnerability arises because quer...

CVE-2014-4759

An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager BPM 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results...

VulnCheck KEV: CVE-2014-9734

Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...

[SECURITY] Fedora 19 Update: zarafa-7.1.10-4.fc19

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

WordPress KenBurner Slider Arbitrary File Download

Exploit Title : WordPress Plugin KenBurner Slider Arbitrary File Download Vulnerability Google Dork: Index of /wp-content/plugins/kbslider Date: 2014-08-21 Exploit Author: MF0x and Daniel Pentest Vendor Homepage: http://codecanyon.net/item/responsive-kenburner-slider-jquery-plugin/1633038 Version...

CVE-2014-5250

Unspecified vulnerability in the AJAX autocompletion callback in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to access data via unspecified vectors...

CVE-2014-5250

The CVE-2014-5250 issue affects the Drupal Biblio Autocomplete module (6.x-1.x prior to 6.x-1.1 and 7.x-1.x prior to 7.x-1.5). The Drupal SA indicates an AJAX autocompletion vulnerability in the Biblio Autocomplete submodule, enabling data access by remote users (including anonymous) via unspecif...

CVE-2014-5250

Unspecified vulnerability in the AJAX autocompletion callback in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to access data via unspecified vectors...

SA-CONTRIB-2014-075 - Biblio Autocomplete - SQL injection and Access Bypass

This module provides functionality for AJAX based auto-completion of fields in the Biblio node type provided by the Biblio module using previously entered values and third party services. The submodule "Biblio self autocomplete" for previously entered values doesn't sufficiently sanitize user inp...

BuddyPress Extended Friendship Request - wp-admin/admin-ajax.php friendship_request_message Parameter XSS

The BuddyPress Extended Friendship Request WordPress plugin was affected by a wp-admin/admin-ajax.php friendshiprequestmessage Parameter XSS security vulnerability...

Ajax Multi Upload 1.1 - Shell Upload

The ajaxmultiupload WordPress plugin was affected by a Shell Upload security vulnerability...

Ajax Pagination 1.1 - wp-admin/admin-ajax.php loop Parameter Local File Inclusion

Plugin is still affected and has been closed...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:143)

Multiple vulnerabilities has been discovered and corrected in phpmyadmin : Cross-site scripting XSS vulnerability in the PMAgetHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a...

CVE-2014-3548

Multiple cross-site scripting XSS vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog...