9416 matches found
PHPB2B存储xss+getshell
简要描述： PHPB2B 存在多处xss。 可盲打后台且getshell。 官方最新版本. https://github.com/ulinke/phpb2b/archive/master.zip 详细说明： ex: 发布供求信息 管理后台审核供求信息: 执行post操作 dataBsettingsiteurl 存在configs/config.inc.php中。 修改siteurl为\';phpinfo;//...
phpok最新版(phpok4.2.024)一处盲注+后台getshell
简要描述： RT 详细说明： 文件/framework/www/postcontrol.php 26-38行 function indexf $id = $this-get"id"; $pid = $this-get'pid'; if!$id && !$pid errorPLang'未指定项目','','error'; $projectrs = $this-call-phpok'project',array"phpok"=$id,'pid'=$pid; if!$projectrs || !$projectrs'module' errorPLang"项目不符合要求",'','error';...
Enalean Tuleap 7.4.99.5 - Remote Command Execution / Blind SQL Injection Vulnerabilities
Enalean Tuleap versions 7.4.99.5 and below suffer from a remote command execution vulnerability and below suffer from a remote, authenticated blind SQL injection vulnerability Vulnerability title: Tuleap /usr/share/codendi/src/www/passwd.txt && "ozilla/5.0 Windows NT 6.1; WOW64; rv:31.0...
Tapatalk for vBulletin 4.x - Blind SQL Injection
!/usr/bin/env python -- coding: utf-8 -- ''' @author: tintinweb 0x721427D8 ''' import urllib2, urllib import xmlrpclib,re, urllib2,string,itertools,time from distutils.version import LooseVersion class Exploitobject: def initself, target, debug=0 : self.stopwatchstart=time.time self.target = targ...
Tuleap 7.4.99.5 Blind SQL Injection
Vulnerability title: Tuleap &globalfiltersubmit=Apply HTTP/1.1 Host: 192.168.56.108 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:31.0 Gecko/20100101 Firefox/31.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, defla...
vBulletin 4.x Tapatalk Blind SQL Injection
!/usr/bin/env python -- coding: utf-8 -- ''' @author: tintinweb 0x721427D8 ''' import urllib2, urllib import xmlrpclib,re, urllib2,string,itertools,time from distutils.version import LooseVersion class Exploitobject: def initself, target, debug=0 : self.stopwatchstart=time.time self.target = targ...
TinyRise 最新版sql注入
简要描述： TinyRise 最新版sql注入 详细说明： simple.php: $ordertype = 2; else if$type=="bundbuy"//捆绑销售处理 $productids = implode',', $productid; $num = Filter::int$buynum0; $model = new Model"bundling"; $bund = $model-where"id=$id"-find; if$bund $goodsid = $bund'goodsid'; $products = $model-table"goods as...
YourMembers Blind SQL Injection
Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin CVE: N/A Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007 https://github.com/YourMembers/yourmembers/blob/master/LICENSE Google...
YourMembers Plugin - Blind SQL Injection
Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin CVE: N/A Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007 https://github.com/YourMembers/yourmembers/blob/master/LICENSE Google...
YourMembers Plugin - Blind SQL Injection
YourMembers Plugin - Blind SQL Injection Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin CVE: N/A Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007...
WordPress Content Audit 1.6 Blind SQL Injection
Details ================ Software: Content Audit Version: 1.6 Homepage: http://wordpress.org/plugins/content-audit/ Advisory report: https://security.dxw.com/advisories/blind-sqli-vulnerability-in-content-audit-could-allow-a-privileged-attacker-to-exfiltrate-password-hashes/ CVE: CVE-2014-5389...
CuuMall 最新版本sql注入一枚
简要描述： CuuMall 最新版本sql注入一枚 详细说明： 感觉 CuuMall 的官网文件是不是被人改动了 还是本身就是个bug，不多说了 直接看代码 DetailsAction.class.php282-313 public function addpru $coo = new Cookie ; if $coo-isset c "GUESTCOOK" ."mall-m-name" $this-assign "waitSceond", 3 ; $this-assign "jumpUrl", "APP/Home/login" ; $this-error "请登录后收藏商品" ; ex...
AllMyVisitors 0.5.0 SQL Injection
AllMyVisitors0.5.0 Blind SQL Injection Vulnerability ==================================================== Author : indoushka Vondor : http://www.php-resource.net/ Dork: Copyright c 2004 by voice of web ========================== SQL injection is a vulnerability that allows an attacker to alter...
DouPHP CSRF配合存储型XSS可盲打后台
简要描述： DouPHP 挺好的，不过还是有一些问题。 详细说明： None 这个点前台也是可以显示的。...
Cart Engine 3.0 - Multiple Vulnerabilities
=== Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially crafted HTTP request, it is possible to exploi...
KPPW开源威客系统绕过防护盲注
简要描述： KPPW开源威客系统 绕过防护盲注 详细说明： 1. WooYun: kppw一处sql注入 厂商对这个漏洞进行了修复。替换了union 不能进行联合了 但是可以进行盲注。 同一个类型，多点。不过问题都出在消息这。 2. 注册两个帐号，然后其中一个对另外那个发送3个消息。 3. 打开中间那条 url如下 http://192.168.1.101/KPPW/index.php?do=user&view=message&op=detail&type=private&intPage=1&msgId=16 然后尝试注入 下面我们可以看到 上一条 和 下一条 。 注入测试...
Cart Engine 3.0 XSS / Open Redirect / SQL Injection
=== Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially crafted HTTP request, it is possible to exploi...
1 2 3 0 6 a sub-site at Oracle blind injection+background leakage+a bypass vulnerability-vulnerability warning-the black bar safety net
1. mail. 1 2 3 0 6. cn an Oracle blind injection: the domain parameter is not filtered, causing the injection,can be according to the query returns the time to guess the solution. POST http://mail.12306.cn/app/mail/login domain=aaa'XORifselect 1 from...
UBUNTU-CVE-2014-5369
Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network...