CuuMall最新版sql注入-2

简要描述： CuuMall免费网上商城系统基于企业级MVC技术架构，安全、稳定，可保证同时在线人数达10000人左右，能适应不同领域的公司企业，文件缓存机制、数据库缓存机制，保证系统稳定运行，多种功能以满足不同客户网上开店的需求。 详细说明： 在文件 carAction.class.php中： public function getmallcar $getmallcar = new MallcarAction ; $arr = $getmallcar-redcar ; $car = new Model "produc" ; $i = 0; foreach $arr as $key =...

IPFire 2.15 Bash Command Injection

!/usr/bin/env python Exploit Title : IPFire = 2.15 core 82 Authenticated cgi Remote Command Injection ShellShock Exploit Author : Claudio Viviani Vendor Homepage : http://www.ipfire.org Software Link: http://downloads.ipfire.org/releases/ipfire-2.x/2.15-core82/ipfire-2.15.i586-full-core82.iso Dat...

Nucom ADSL ADSLR5000UN ISP Credentials Disclosure Vulnerability

Exploit for hardware platform in category web applications !/usr/bin/perl Exploit Author: Sebastián Magof Hardware: Modem Nucom ADSL R5000UNv2 Software Version: R5TC008 Vulnerable file: guidewan.html location: http://gateway/telecomGUI/guidewan.html Bug: ISP usr+pwd disclosure Type: Local Date:...

Nucom ADSL ADSLR5000UN - ISP Credentials Disclosure

Nucom ADSL ADSLR5000UN - ISP Credentials Disclosure !/usr/bin/perl Exploit Author: Sebastián Magof Hardware: Modem Nucom ADSL R5000UNv2 Software Version: R5TC008 Vulnerable file: guidewan.html location: http://gateway/telecomGUI/guidewan.html Bug: ISP usr+pwd disclosure Type: Local Date: 24/09/20...

Nucom ADSL ADSLR5000UN - ISP Credentials Disclosure

!/usr/bin/perl Exploit Author: Sebastián Magof Hardware: Modem Nucom ADSL R5000UNv2 Software Version: R5TC008 Vulnerable file: guidewan.html location: http://gateway/telecomGUI/guidewan.html Bug: ISP usr+pwd disclosure Type: Local Date: 24/09/2014 Vendor Homepage: http://www.nucom.hk/ Version:...

Yahoo Quickly Fixes SQL Injection Vulnerability Escalated to Remote Code Execution

Yahoo! was recently impacted by a critical web application vulnerabilities which left website's database and server vulnerable to hackers. A cyber security expert and penetration tester, Ebrahim Hegazy a.k.a Zigoo from Egypt, has found a serious SQL injection vulnerability in Yahoo's website that...

ALCASAR index.php Crafted HTTP host Header Vulnerability

Added: 09/16/2014 BID: 69662 OSVDB: 111026 Background ALCASAR is a free Network Access Controller that allows network managers to restrict Internet service access to authenticated users. ALCASAR allows control and logging of all network activity by users and/or defined user groups. Problem ALCASA...

ALCASAR index.php Crafted HTTP host Header Vulnerability

Added: 09/16/2014 BID: 69662 OSVDB: 111026 Background ALCASAR is a free Network Access Controller that allows network managers to restrict Internet service access to authenticated users. ALCASAR allows control and logging of all network activity by users and/or defined user groups. Problem ALCASA...

Mail.ru: XSS via .eml file

сначала смотрим скриншот : XSS возможен через .eml вложения, уязвимо имя .eml файла, которое присваивается из названия Темы сообщения строка Subject в eml. JS отыграет на странице превью файлов https://e.mail.ru/attaches-viewer/?... шаги для воспроизведения пересылая письмо: -...

Automattic: Open Redirect in WordPress Feed Statistics {Affected All Versions}

Hi, Feed Statistics Plugin is vulnerable to Open Redirect and effecting large amount of Websites. Which is the reason it should be patched swiftly. Detail description is given below: Tested on: Wordpress 3.9.1 Vulnerable Plugin: Feed Statistics Plugin Link:...

Aerohive HiveOS 5.1r5 < 6.1r5 - Multiple Vulnerabilities

Exploit Title: Aerohive HiveOS XSS and limited LFI Date: 11-07-2014 Exploit Author: Rik van Duijn - DearBytes dearbytes.com Vendor Homepage: http://www.aerohive.com/products/overview.html Version: 5.1r5 - 6.1r5 possibly earlier versions Description ================ Aerohive version 5.1r5 through...

fengcms任意文件下载

简要描述： 2014-07-08 12:40 | FengCMS乌云厂商 0 FengCms安全测试站地址：http://guf521656.h163.92hezu.org/ 有效期2014-7-8至2014-7-15 欢迎各位安全界的朋友帮我们寻找安全漏洞！作为一个小小的创业团队，对各位朋友对FengCms的关注表示衷心的感谢！ 既然官方这么说了，我帮个小忙吧，可获得认证码、数据库账号密码等。就用官方给的演示站做测试。不知道你们有没有小礼物呢？ 详细说明： /app/controller/downController.php 代码如下： class downController...

National Science Foundation Squid Web Proxy 1.0/1.1/2.1 Authentication Failure

No description provided by source. source: http://www.securityfocus.com/bid/741/info There is a vulnerability present in certain versions of the Squid Web Proxy Cache developed by the National Science Foundation. This problem is only in effect when users of the cache are using an external...

Blackboard Learning System 6.0 Dropbox File Download Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10515/info It is reported that Blackboard improperly allows users to download files posted in the 'Digital Dropbox'. Files in the dropbox are intended for the course administrators. The application does not verify that th...

Simple Machine Forum 2.0.x < 2.0.4 File Disclosure/Path Traversal

No description provided by source. Exploit Title: SMF 2.0.4 File Disclosure/Path Traversal Google Dork: Powered by SMF 2.0.x Date: 02/02/2013 Exploit Author: NightlyDev Software Link: http://download.simplemachines.org/index.php?thanks;filename=smf2-0-3install.zip Version: 2.0.x 2.0.4 Tested on:...

JBoss Application Server Remote Exploit

No description provided by source. JBoss AS Remote Exploit by Kingcope use IO::Socket; use LWP::UserAgent; use URI::Escape; use MIME::Base64; sub usage print JBoss AS Remote Exploit\nby Kingcope\n\nusage: perl jboss.pl target targetport yourip yourport win/lnx\n; print example: perl daytona.pl...

NukeET 3.0/3.1 Base64 Codigo Variable Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13570/info NukeET is prone to a cross-site scripting vulnerability. The source of this issue is that HTML and script code is not properly sanitized from URI variables before being output in a dynamically generated Web pag...

Virtual Store Open 3.0 Acess SQL Injection

No description provided by source. !/usr/bin/perl Script Name: Virtual Store Open = 3.0 Link1 : http://www.virtuastore.com.br/shopping.asp?link=ShoppingVirtuaStore Link2 : http://www.virtuastore2010.com.br/ Link3 Yahoo Group : http://br.groups.yahoo.com/group/virtuastore/ Bug: Acess Sql Injection...

ADN Forum <= 1.0b Insecure Cookie Handling Vulnerability

No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- adnforum = 1.0b / Insecure Cookie Handling Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- $ Program: adnforum $ Version: = 1.0b $ File affected: index.php $ Download:...

Microsoft Windows Script Host 5.1/5.5 GetObject() File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1718/info It is possible for an outside attacker to view known files on a remote system if the target user visits a website or opens an email containing a specially formed script containing the JScript function 'GetObject...