PHPB2B网站管理系统SQL注入漏洞(无视防注入)

简要描述： RT 详细说明： 注入链接：/virtual-office/job.php 注入参数：job 漏洞代码：（第52行开始） if !empty$POST'job' && $POST'save' $vals = $POST'job'; pbsubmitcheck'job'; // 验证post提交的token,可直接使用get访问job.php后在网页源码中搜索formhash获取 $nowjobamount = $job-findCountnull, "created".$todaystart." AND memberid=".$thememberid; if...

WordPress Survey And Poll 1.1.7 Blind SQL Injection

Exploit Title : Wordpress Survey and poll Blind SQL Injection Data : 2015 – 02 - 11 Exploit Author : Securely Yoo Hee man Plugin : WordPress Survey and Poll Vender Homepage : http://modalsurvey.sympies.com Tested On : Windows XP / sqlmapv1.0 Software Link :...

WordPress Plugin Survey and Poll 1.1 - Blind SQL Injection

WordPress Plugin Survey and Poll 1.1 - Blind SQL Injection Exploit Title : Wordpress Survey and poll Blind SQL Injection Data : 2015 – 02 - 11 Exploit Author : Securely Yoo Hee man Plugin : WordPress Survey and Poll Vender Homepage : http://modalsurvey.sympies.com Tested On : Windows XP /...

WordPress Survey and Poll Plugin 1.1 - Blind SQL Injection

Survey and Poll plugin is prone to a Blind SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...

Chamilo LMS 1.9.8 - Blind SQL Injection

Chamilo LMS 1.9.8 - Blind SQL Injection Exploit Title: Chamilo LMS 1.9.8 Blind SQL Injection Date: 06-12-2014 Software Link: http://www.chamilo.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description...

Chamilo LMS 1.9.8 Blind SQL Injection

Exploit Title: Chamilo LMS 1.9.8 Blind SQL Injection Date: 06-12-2014 Software Link: http://www.chamilo.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Database::escapestring function is used to...

Chamilo LMS 1.9.8 - Blind SQL Injection

Exploit Title: Chamilo LMS 1.9.8 Blind SQL Injection Date: 06-12-2014 Software Link: http://www.chamilo.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Database::escapestring function is used to...

ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities

Multiple vulnerabilities in FailOverServlet in ManageEngine OpManager, Applications Manager and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 28/01/2015 / Last updated: 09/02/20...

[The ManageOwnage Series, part XII]: Multiple vulnerabilities in FailOverServlet (OpManager, AppManager, IT360)

Hi, This is part 12 of the ManageOwnage series. For previous parts, see 1. This time we have an arbitrary file download, directory content disclosure and blind SQL injection vulnerabilities in ManageEngine OpManager, Applications Manager and IT360. I've pushed two new Metasploit modules into the...

金蝶商城xss盲打

简要描述： xss盲打 详细说明： 地址：http://mall.kingdee.com/cart.action 1.三处小的xss （鸡肋） .jpg" width="600" onerror="javascript:errimgthis;" 2.一处反射型的xss， 位于商城主页的搜索处（鸡肋） http://mall.kingdee.com/search.action?k=%3Cscript%3Ealert%282%29%3B%3C%2Fscript%3E 3.后台盲打组织成员（较严重） 注册了两个帐号进行测试，用B账户申请加入A账户的组织中，盲打A账户！...

53KF某处一个注入点

简要描述： 某处的一个注入 详细说明： 存在注入的地址: http://www10.53kf.com/zdydbgg2.php?styleid=106098168&companyid=72067196&dbggtype=2 sqlmap identified the following injection points with a total of 0 HTTPs requests: --- Place: GET Parameter: styleid Type: boolean-based blind Title: AND boolean-based blind - WHERE or...

ZeroCMS 1.3.3 SQL Injection

Advisory: SQL injection vulnerabilities in zerocms = v.1.3.3 Advisory ID: SROEADV-2015-13 Author: Steffen Rösemann Affected Software: zerocms = v.1.3.3 released 23rd-Jan-2015 Vendor URL: http://aas9.in/zerocms/ Vendor Status: platform will be moving to Rails4 CVE-ID: - ==========================...

ManageEngine File Download / Content Disclosure / SQL Injection

Hi, This is part 12 of the ManageOwnage series. For previous parts, see 1. This time we have an arbitrary file download, directory content disclosure and blind SQL injection vulnerabilities in ManageEngine OpManager, Applications Manager and IT360. I've pushed two new Metasploit modules into the...

Photo Gallery <= 1.2.8 - Blind SQL Injection

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by a Blind SQL Injection security vulnerability...

Iwebshop最新版注入又一枚

简要描述： Iwebshop最新版注入又一枚 详细说明： 看到wooyun上有人提了几个iweshop（2014-11-18更新）的漏洞（ WooYun: iWebShop开源电子商务系统SQL注入漏洞 ），去官网看了看，在2014-12-16 已更新到了 iwebshop2.9.14121000，下下来研究研究，希望不要重复。 注入一枚：POST /index.php?controller=seller&action=orderlist POST参数中的search作为一个数组传入，search的KEY and VALUE...

ManageEngine Password Manager Pro 6.5 < 7.1 Build 7105 Blind SQL Injection

The remote host is running a version of ManageEngine Password Manager Pro between 6.5 inclusive and 7.1 Build 7105. It is, therefore, affected by a blind SQL injection vulnerability due to a failure to validate the 'SEARCHALL' parameter. %NASLMINLEVEL 70300 C Tenable, Inc...

WordPress Photo Gallery Blind SQL injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

用友NC-IUFO系统通用SQL注入(三)

简要描述： ... 详细说明： 该系统“忘记密码”模块存在sql注入漏洞 链接地址为：/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234 说明：输入用户名和邮箱后提交，程序会提交给 /epp/core（可从抓取的数据包中看到）， 漏洞参数：userid 数据库系统：oracle 注入类型：AND/OR time-based blind 这里直接给出证明案例（列出数据库实例名称即可、不深入）： 0x01; http://nc.xhlbdc.com/epp/ POST /epp/core HTTP/1.1 Host: nc.xhlbdc.co...

PHPB2B某处sql注入#5

简要描述： PHPB2B某处sql注入5 详细说明： 官网下载的最新版本 PHPB2B某处sql注入 virtual-office/favor.php 25-45行 ifisset$POST'do' && isset$POST'id' //check limit $typeid = 1; $flimit = $pdb-GetOne$sql = "SELECT countid FROM $tbprefixfavorites WHERE typeid='".$typeid."' AND memberid=".$thememberid; if...

PHPAPP注入第十一枚（无视过滤）

简要描述： PHPAPP注入第十一枚（无视过滤） 详细说明： 在wooyun上看到了有人提了PHPAPP的漏洞： http://wooyun.org/bugs/wooyun-2010-055604，然后去官网看了看，前几天刚有更新，就在官网下了PHPAPP最新的v2.6来看看2014-12-11更新的。 PSOT注入点：wwww.xxx.com/index.php?action=10&app=49, 存在漏洞的文件在/phpapp/apps/taskmode/mainphpapp.php 下面分析一下漏洞产生的原因 第一处绕过：...