ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities

Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 27/09/2014 1 and 2, 09/11/2014 3 and 4 / Last updated:...

ManageEngine OpManager Social IT Plus IT360 - Multiple Vulnerabilities

ManageEngine OpManager Social IT Plus IT360 - Multiple Vulnerabilities Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ==========================================================================...

ManageEngine OpManager / Social IT Plus / IT360 File Upload / SQL Injection

Hi, This is the 8th part of the ManageOwnage series. For previous parts see 1. This time we have a file upload leading to remote code execution and a blind SQL injection in ManageEngine OpManager, Social IT Plus and IT360. ManageEngine have released an emergency fix, see details in the advisory...

骑士CMS某新功能4处SQL注入

简要描述： 骑士CMS官网某新功能4处SQL盲注，官网测试。 详细说明： 官网培训信息搜索和猎头工作搜索等4处SQL盲注。 0x01: 当前位置：首页 教育培训 课程列表 搜索课程 http://demo.74cms.com/train/train-curriculum-list.php?district=&category=&sdistrict=&classtype=&start=&refre=&sort=hot%3Edesc&key= 参数sort存在SQL注入,desc后面的字符串全部带入SQL：...

PHPB2B存储xss+getshell

简要描述： PHPB2B 存在多处xss。 可盲打后台且getshell。 官方最新版本. https://github.com/ulinke/phpb2b/archive/master.zip 详细说明： ex: 发布供求信息 管理后台审核供求信息: 执行post操作 dataBsettingsiteurl 存在configs/config.inc.php中。 修改siteurl为\';phpinfo;//...

phpok最新版(phpok4.2.024)一处盲注+后台getshell

简要描述： RT 详细说明： 文件/framework/www/postcontrol.php 26-38行 function indexf $id = $this-get"id"; $pid = $this-get'pid'; if!$id && !$pid errorPLang'未指定项目','','error'; $projectrs = $this-call-phpok'project',array"phpok"=$id,'pid'=$pid; if!$projectrs || !$projectrs'module' errorPLang"项目不符合要求",'','error';...

Enalean Tuleap 7.4.99.5 - Remote Command Execution / Blind SQL Injection Vulnerabilities

Enalean Tuleap versions 7.4.99.5 and below suffer from a remote command execution vulnerability and below suffer from a remote, authenticated blind SQL injection vulnerability Vulnerability title: Tuleap /usr/share/codendi/src/www/passwd.txt && "ozilla/5.0 Windows NT 6.1; WOW64; rv:31.0...

Tapatalk for vBulletin 4.x - Blind SQL Injection

!/usr/bin/env python -- coding: utf-8 -- ''' @author: tintinweb 0x721427D8 ''' import urllib2, urllib import xmlrpclib,re, urllib2,string,itertools,time from distutils.version import LooseVersion class Exploitobject: def initself, target, debug=0 : self.stopwatchstart=time.time self.target = targ...

Tuleap 7.4.99.5 Blind SQL Injection

Vulnerability title: Tuleap &globalfiltersubmit=Apply HTTP/1.1 Host: 192.168.56.108 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:31.0 Gecko/20100101 Firefox/31.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, defla...

vBulletin 4.x Tapatalk Blind SQL Injection

!/usr/bin/env python -- coding: utf-8 -- ''' @author: tintinweb 0x721427D8 ''' import urllib2, urllib import xmlrpclib,re, urllib2,string,itertools,time from distutils.version import LooseVersion class Exploitobject: def initself, target, debug=0 : self.stopwatchstart=time.time self.target = targ...

TinyRise 最新版sql注入

简要描述： TinyRise 最新版sql注入 详细说明： simple.php: $ordertype = 2; else if$type=="bundbuy"//捆绑销售处理 $productids = implode',', $productid; $num = Filter::int$buynum0; $model = new Model"bundling"; $bund = $model-where"id=$id"-find; if$bund $goodsid = $bund'goodsid'; $products = $model-table"goods as...

YourMembers Blind SQL Injection

Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin CVE: N/A Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007 https://github.com/YourMembers/yourmembers/blob/master/LICENSE Google...

YourMembers Plugin - Blind SQL Injection

Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin CVE: N/A Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007 https://github.com/YourMembers/yourmembers/blob/master/LICENSE Google...

YourMembers Plugin - Blind SQL Injection

YourMembers Plugin - Blind SQL Injection Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin CVE: N/A Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007...

WordPress Content Audit 1.6 Blind SQL Injection

Details ================ Software: Content Audit Version: 1.6 Homepage: http://wordpress.org/plugins/content-audit/ Advisory report: https://security.dxw.com/advisories/blind-sqli-vulnerability-in-content-audit-could-allow-a-privileged-attacker-to-exfiltrate-password-hashes/ CVE: CVE-2014-5389...

AllMyVisitors 0.5.0 SQL Injection

AllMyVisitors0.5.0 Blind SQL Injection Vulnerability ==================================================== Author : indoushka Vondor : http://www.php-resource.net/ Dork: Copyright c 2004 by voice of web ========================== SQL injection is a vulnerability that allows an attacker to alter...

CuuMall 最新版本sql注入一枚

简要描述： CuuMall 最新版本sql注入一枚 详细说明： 感觉 CuuMall 的官网文件是不是被人改动了 还是本身就是个bug，不多说了 直接看代码 DetailsAction.class.php282-313 public function addpru $coo = new Cookie ; if $coo-isset c "GUESTCOOK" ."mall-m-name" $this-assign "waitSceond", 3 ; $this-assign "jumpUrl", "APP/Home/login" ; $this-error "请登录后收藏商品" ; ex...

DouPHP CSRF配合存储型XSS可盲打后台

简要描述： DouPHP 挺好的，不过还是有一些问题。 详细说明： None 这个点前台也是可以显示的。...

Cart Engine 3.0 - Multiple Vulnerabilities

=== Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially crafted HTTP request, it is possible to exploi...

KPPW开源威客系统绕过防护盲注

简要描述： KPPW开源威客系统 绕过防护盲注 详细说明： 1. WooYun: kppw一处sql注入 厂商对这个漏洞进行了修复。替换了union 不能进行联合了 但是可以进行盲注。 同一个类型，多点。不过问题都出在消息这。 2. 注册两个帐号，然后其中一个对另外那个发送3个消息。 3. 打开中间那条 url如下 http://192.168.1.101/KPPW/index.php?do=user&view=message&op=detail&type=private&intPage=1&msgId=16 然后尝试注入 下面我们可以看到 上一条 和 下一条 。 注入测试...