WordPress WP Fastest Cache Plugin 0.8.4.8 - Blind SQL Injection

WP Fastest Cache plugin's plugin to a blind SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

Pligg CMS 2.0.2 - Multiple SQL Injections

Pligg CMS 2.0.2 - Multiple SQL Injections Security Advisory - Curesec Research Team 1. Introduction Affected Product: Pligg CMS 2.0.2 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://pligg.com/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor:...

Pligg CMS 2.0.2 - Multiple SQL Injections

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Pligg CMS 2.0.2 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://pligg.com/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 09/01/2015 Disclosed to public: 10/07/2015 Releas...

Joomla JNews (com_jnews) Component 8.5.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Description of the component: Reach, engage and delight more customers with newsletters, auto-responders or campaign management. Exploit Title: Joomla component comjnews - SQL injection Google Dork: inurl:option=comjnews Date: 2015-10-29 Explo...

Joomla! Component com_jnews 8.5.1 - SQL Injection

Description of the component: Reach, engage and delight more customers with newsletters, auto-responders or campaign management. Exploit Title: Joomla component comjnews - SQL injection Google Dork: inurl:option=comjnews Date: 2015-10-29 Exploit Author: Omer Ramić Twitter:...

wp-championship <= 5.8 - Authenticated Blind SQL Injection

The wp-championship WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. PoC $ sqlmap -u 'http://www.example.com/wp-admin/wp-championship/csadminusers.php=' --data="isadmin=1" --cookie=AUTHCOOKIEHERE --level=5 --risk=3...

xpshop系统sql盲注一处

简要描述： 详细说明： 漏洞位置:xpshop.webui.checkout protected void PageLoadobject sender, EventArgs e this.sid = Utils.ReqIntParams"sid", -1; if base.CurrentUser == null base.Response.Redirectstring.Concatnew object "Login.aspx?ReturnUrl=/", WebUIBase.ShopFolder, "Checkout.aspx?sid=", this.sid ; else string...

ZEDx 2.0 - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Title : ZEDx 2.0 - Blind SQL Injection Vulnerability Author : ZwX Version : ZEDx 2.0 Demo Online : http://demo.zedx.org/ Vendor : http://www.zedx.org/ Date : 09/12/2014 ------------------------------- Description ------------------------------...

Sendy 2.0.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications Title : Sendy 2.0.1 - Multiple Vulnerabilities Author : ZwX Vendor Homepage: http://sendy.co/ Software Link: http://sendy.co/ Tested on : Windows 7 ------------------------------ ! SQL Injection Exploit ! ------------------------------...

CmsTop媒体版某模板存在三处SQL盲注漏洞（非全部网站用户）

简要描述： 不是全部网站都安装了这几个模板，这个模板用户量一般 详细说明： 漏洞文件是/apps/rss/controller/fullsite.php中 public function getsectiondata $sectionid = $GET'sectionid'; //多个以','隔开 $outtyle = $GET'outtyle'; //输出类型 $sectionlist = $this-rss-lssection$sectionid; $data = array; foreach$sectionlist as $section if $section'data' &&...

PHP-Fusion 7.02.07 - Blind SQL Injection

PHP-Fusion 7.02.07 - Blind SQL Injection ============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score...

PHP-Fusion 7.02.07 Blind SQL Injection Vulnerability

PHP-Fusion versions 7.02.07 and below suffer from a remote blind SQL injection vulnerability in the admin panel. ============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas -...

PHP-Fusion 7.02.07 Blind SQL Injection

============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

e-cology 时间盲注（hpid参数）

1、缺陷文件homepage/LoginHomepage.jsp 2、注入参数：hpid3、涉及厂商：泛微软件4、证明：sqlmap.py -u "http://localhost/homepage/LoginHomepage.jsp?hpid=52" --technique T --dbms "Microsoft SQL Server"...

e-cology 时间盲注（templateId参数）

1、应用：泛微e-cology2、缺陷文件：/page/maint/login/Page.jsp3、expurl:http://localhost/page/maint/login/Page.jsp?templateId=18 4、验证：sqlmap.py -u "http://localhost/page/maint/login/Page.jsp?templateId=18" --technique T --dbms "Microsoft SQL Server"...

Cyberoam CR500iNG-XP SQL Injection Vulnerability

Cyberoam NG is a next-generation firewall product based on CyberoamOS. A remote SQL blind injection vulnerability exists in Cyberoam CR500iNG-XP - 10.6.2 MR-1 and earlier versions. This vulnerability allows attackers to execute sql commands in a database...

ZeusCart v4.0 /classes/Core/CFeaturedItems.php SQL注入

ZeusCart 4.0: SQL Injection1.漏洞描述在ZeusCart4.0中存在两个注入漏洞，一个注入不需要任何条件即可exploit，另一个是是发生在admin后台的注入。因为大部分参数都是依赖于简单的过滤，所以很容易由于过滤不全而产生漏洞。2a. Timing based Blind SQL Injection 基于时间的盲注证明：http://localhost/zeuscart-master/index.php?do=featured&action=showmaincatlanding&maincatid=-1AND IFSUBSTRINGversion, 1,...

ZeusCart 4.0 - SQL Injection / CSRF Vulnerability

Exploit for php platform in category web applications ZeusCart 4.0: SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: email protected Vulnerability Type: SQL Injection Remote...

ZeusCart 4.0 - SQL Injection

ZeusCart 4.0 - SQL Injection ZeusCart 4.0: SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to...

ZeusCart 4.0 - SQL Injection

ZeusCart 4.0: SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclosed ...