phpSQLiteCMS - Multiple Vulnerabilities

phpSQLiteCMS - Multiple Vulnerabilities Exploit Title: CSRF, Unrestricted File Upload, Privilege escalation & XSS Google Dork: intitle: CSRF, Unrestricted File Upload, Privilege escalation & XSS Date: 2015-07-12 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage...

Beckhoff IPC Diagnostics Arbitrary User Creation Vulnerability

Beckhoff IPC Diagnostics is a set of support software pre-installed in all Beckhoff IPCs/PLCs Programmable Logic Controllers running on the Microsoft Windows operating system. Beckhoff IPC Diagnostics fails to properly restrict access to functions in the /config URI, allowing a remote attacker to...

CVE-2015-4051

Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service reboot or shutdown, create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a...

Pie Register 2.0.14-2.0.15 - Privilege Escalation

User input is not validated correctly when accepting a login request via the Pie Register plugin. It is possible to manipulate posted variables in order to login using an arbitrary User ID such as 1, for the default Administrative account. PoC import requests target="http://localhost" payload =...

Design/Logic Flaw

The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-access restrictions via 1 a crafted CREATE HADOOP TABLE statement referencing the data of an arbitrary user or 2 an import of a certain Hive table definition with...

某CMS存在越权漏洞(任意用户信息修改)

简要描述： 某CMS存在越权漏洞任意用户信息修改 详细说明： 账号A uid=726 账号B uid=727 越权修改账号A uid=726 的信息 成功修改 ok http://demo2.74cms.com/ demo演示站点2也存在说明存在漏洞了 漏洞证明： 账号A uid=726 账号B uid=727 img src="https://images.seebug.org/upload/201504/0722363756a38e431bcb1a1da23429...

WordPress Ajax Search Pro Remote Code Execution Vulnerability

This vulnerability allows any registered user to execute arbitrary functions Usage Info http://localhost/x/wordpress/wp-admin/admin-ajax.php?page=ajax-search-pro/backend/settings.php&action=wpdreams-ajaxinput post data:...

CVE-2014-6131

IBM Rational Jazz Team Server JTS, as used in Rational Collaborative Lifecycle Management 3.x and 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational Team Concert 2.x and 3.x...

Wordpress MainWP Child Plugin 2.0.9.1 /class/MainWPChild.class.php 登录绕过漏洞

/class/MainWPChild.class.php $this-postswheresuffix = ''; $this-commentsandclauses = ''; addaction'templateredirect', array$this, 'templateredirect'; addaction'init', array&$this, 'parseinit'; addaction'adminmenu', array&$this, 'adminmenu'; addaction'admininit', array&$this, 'admininit';...

LebiShop商城系统最新版任意用户登陆

简要描述： LebiShop商城系统最新版任意用户登陆 详细说明： LebiShop商城系统最新版Powered by LebiShop V3.1.01，存在任意用户登陆 官方demo测试 http://plus.demo.lebi.cn/——可注册普通用户和商家用户 http://demo.lebi.cn/——可注册普通用户 我们使用http://plus.demo.lebi.cn/进行测试 首先我们注册一个普通用户222222，并登陆 注意这里的COOKIE中user的值，id=37，这里是用户222222的用户userid...

BMC TrackIt! Unauthenticated Arbitrary User Password Change

This module exploits a flaw in the password reset mechanism in BMC TrackIt! 11.3 and possibly prior versions. If the password reset service is configured to use a domain administrator which is the recommended configuration, then domain credentials can be reset such as domain Administrator. This...

Arbitrary User Registration Vulnerability in Secure Browser of Qihoo 360 Technology Co.

360 Safe Browser has the leading malicious URL database in China, and adopts the cloud checking engine, which can automatically block the malicious URLs such as horse mounting, fraud, Internet banking imitation, etc. The unique "quarantine mode" allows users to visit the Trojan website without...

Mulesoft ESB Runtime 3.5.1 - Privilege Escalation

Mulesoft ESB Runtime 3.5.1 Authenticated Privilege Escalation → Remote Code Execution Mulesoft ESB Runtime 3.5.1 allows any arbitrary authenticated user to create an administrator user due to a lack of permissions check in the handler/securityService.rpc endpoint. The following HTTP request can b...

Mulesoft ESB Runtime 3.5.1 Privilege Escalation / Code Execution

Mulesoft ESB Runtime 3.5.1 Authenticated Privilege Escalation → Remote Code Execution Mulesoft ESB Runtime 3.5.1 allows any arbitrary authenticated user to create an administrator user due to a lack of permissions check in the handler/securityService.rpc endpoint. The following HTTP request can b...

Moab User Impersonation [CVE-2014-5375]

Moab User Impersonation : CVE-2014-5375 Software: Moab Affected Versions: All current versions of Moab. However, the impact is limited in Moab 7.2.9 and Moab 8. CVE Reference: CVE-2014-5375 Author: John Fitzpatrick, Luke Jennings MWR Labs http://labs.mwrinfosecurity.com/ Severity: High Risk Vendo...

YiDacms 最新版重置任意用户账户二及其他越权操作

简要描述： YiDacms 最新版重置任意用户账户，及其他越权操作 详细说明： 易达CMS 企业建站系统 当前最新版本是：YidaCms X3.2（20140718）版 之前发过一次重置任意用户密码的漏洞，但是只能修改成固定的密码，要是修改成任意密码的话，比较麻烦，需要md5明文密码后取10位作为信息密码，较麻烦。 这里我们直接输入任意明文密码，即可修改 来看看源代码： 文件/Yidacms/user/user.asp if request"yidacms"="password" Then set rs=server.createobject"adodb.recordset" useri...

BirthSys 3.1 - Multiple SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/16684/info BirthSys is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitatio...

Vanilla Forums 2-0-18-4 - SQL-Injection Vulnerability

Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable Date: 04/05/2013 Exploit Author: bl4ckw0rm Vendor Homepage: http://vanillaforums.org/ Version: 2-0-18-4 Tested on: Windows Product Name: Vanilla Forums Vulnerable Version: Up to vanilla-core-2-0-18-4 Tested on:...

Pet Grooming Management System <= 2.0 Arbitrary Add-Admin Exploit

No description provided by source. !/usr/bin/perl use strict; use LWP::UserAgent; print -+- Pet Grooming Management System = 2.0 Arbitrary Add-Admin Exploit -+-\n; print -+- Discovered && Coded By: t0pP8uZz - Discovered On: 15 MAY 2008 -+-\n; print -+- Script Download:...

Messagerie 1.0 Arbitrary User Removal DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4635/info Messagerie is a web message board application maintained by La Basse. An issue has been discovered in Messagerie, which could allow an attacker to delete arbitrary user accounts. Reportedly, submitting a special...