u-Auctions - Multiple Vulnerabilities

u-Auctions - Multiple Vulnerabilities Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This vulnerability affects...

u-Auctions - Multiple Vulnerabilities

Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This vulnerability affects /adsearch.php URL encoded POST input...

mcms最新版SQL注入二枚打包（可出任意数据）

简要描述： mcms最新版SQL注入二枚打包（可出任意数据） 详细说明： 前段时间在wooyun提交了几个mcms的漏洞，以前mcms的版本是v3.1.1.enterprise， WooYun: mcms最新版SQL注入三枚打包（可出任意数据） ，现在都升级到v3.1.3.enterprise了，还是来研究一下mcmsv3.1.3.enterprise吧。 注入一枚：POST...

KPPW最新版本 绕过防护继续盲注

简要描述： KPPW2620150327UTF-8.zip 3月27 最新版本 详细说明： Url1: http://localhost/KPPW/index.php?do=user&view=message&op=detail&msgId=74&type=trends&intPage=1 Url2: http://localhost/KPPW/index.php?do=user&view=message&op=detail&type=trends&intPage=1&msgId=74%26%261%3D1 Url3:...

SP Project & Document Manager <= 2.5.3 - Blind SQL Injection

The SP Project & Document Manager WordPress plugin was affected by a Blind SQL Injection security vulnerability. http://www.example.com/wp-content/plugins/sp-client-document-manager/ajax.php?function=thumbnails&pid=SQLi...

SP Project & Document Manager <= 2.5.3 - Blind SQL Injection

The SP Project & Document Manager WordPress plugin was affected by a Blind SQL Injection security vulnerability. PoC http://www.example.com/wp-content/plugins/sp-client-document-manager/ajax.php?function=thumbnails=SQLi...

SP Project Document Manager <= 2.5.3 - Blind SQL Injection

The SP Project & Document Manager WordPress plugin was affected by a Blind SQL Injection security vulnerability...

WordPress SP Project & Document Manager Plugin 2.5.3 - Blind SQL Injection

SP Project & Document Manager plugin is prone to a blind SQL injection that is in the thumbnails function location: /wp-content/plugins/sp-client-document-manager/ajax.php. Solution Upgrade the plugin...

某学校综合管理系统通用SQL注入漏洞

简要描述： 某学校综合管理系统通用SQL注入漏洞 详细说明： 系统名称：学校综合管理平台 厂商：上海安脉计算机科技有限公司 关键字：版权所有：上海安脉计算机科技有限公司 系统架构：ASPX+MSSQL 漏洞文件：OA/usecar/carStat.aspx 注入参数：startdate 枚举部分案例： http://anmai.net:81/OA/usecar/carStat.aspx http://jwxx.am.jsedu.sh.cn/ANMAI/OA/usecar/carStat.aspx http://bssyxxgl.eicbs.com/OA/usecar/carStat.as...

Joomla! Component ECommerce-WD 1.2.5 - SQL Injection

Version 1.2.5 of the ECommerce-WD plugin for Joomla! has multiple unauthenticated SQL injections available via the advanced search functionality. http://extensions.joomla.org/extension/ecommerce-wd The vulnerable parameters are searchcategoryid, sortorder, and filtermanufacturerids within the...

Live Forms - Visual Form Builder 3.0.1 - Blind SQL Injection

The AJAX action ‘getreqlist’ is available to all logged in users. The parameter ‘ipp’ sent to this action is vulnerable to Blind MySQL Injection. This can be leveraged by detecting how long a query takes to return...

WordPress Live Forms Plugin <= 3.0.1 - Blind SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...

Gravity Forms 1.8 <= 1.9.3.5 - Authenticated Blind SQL Injection

Title: Gravity Forms 1.8 = 1.9.3.5 - Blind SQL Injection CVE-2015-2260 Version/s Tested: 1.9.3.1 Description: Gravity Forms is one of the most popular WordPress plugins gravityforms used to create forms for WordPress sites. The latest version at the time of writing 1.9.3.5 contains an authenticat...

WordPress Plugin SEO by Yoast 1.7.3.3 - Blind SQL Injection

WordPress Plugin SEO by Yoast 1.7.3.3 - Blind SQL Injection Title: WordPress SEO by Yoast = 1.7.3.3 - Blind SQL Injection Version/s Tested: 1.7.3.3 Patched Version: 1.7.4 CVSSv2 Base Score: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2 Temporal Score: 7...

WordPress Pods Plugin <= 2.5.1.1 - Blind SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...

Pods 1.4.7 <= 2.5.1.1 - Blind SQL Injection

Version/s Tested: 2.5.1.1 and previous Description: Pods is a popular custom content types and fields plugin for WordPress. In the PodsUI class, which is used to build Pods administration interfaces, the orderby SQL query is set via a GET variable, which was not properly sanitized. Technical...

WordPress SEO by Yoast 1.7.3.3 SQL Injection Vulnerability

WordPress SEO by Yoast plugin versions 1.7.3.3 and below suffer from a remote blind SQL injection vulnerability. Title: WordPress SEO by Yoast = 1.7.3.3 - Blind SQL Injection Version/s Tested: 1.7.3.3 Patched Version: 1.7.4 CVSSv2 Base Score: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2...

SDCMS 最新门户版 V3.0 储存型xss一枚 可盲打后台

简要描述： 严谨的说 是编辑器xss储存型漏洞 详细说明： 虚拟主机搭建测试： 需要条件： 开启会员注册默认开启 开启投稿功能（默认开启） 下载地址： http://www.sdcms.cn/product/portal.html 默认 开启会员注册 无需审核 原本想在demo上测试的 但是他开启审核了 ---------------------------------------- 注册个会员 找到在线投稿 选择文章模型 远程上传地址处 插入： " 提交 img...

damicms绕过防xss规则盲打后台(v4.9)

简要描述： damicms绕过防xss规则盲打后台v4.9 详细说明： 前台留言的地方，使用了getclientip ，代码如下。 使用了 removexss 来做过滤，但是可以这样来绕过 之后就可以弹窗了 漏洞证明：...

Elastix 2.5.0 SQL Injection

Title: Elastix v2.x Blind SQL Injection Vulnerability Author: Ahmed Aboul-Ela Twitter: https://twitter.com/aboul3la Vendor : http://www.elastix.org Version: v2.5.0 and prior versions should be affected too - Vulnerable Source Code snippet in "a2billing/customer/iridiumthreed.php": SQLExec...