Backend Authentication Bypass Vulnerability in S-CMS

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS has a background authentication bypass vulnerability, due to the failure to accurately verify cookie information, an attacker can bypass login authentication by importing arbitrary cookie values...

Cross-site scripting vulnerability in the 'adminfrom.php' page of the DM website builder system

DM enterprise building system is developed by php + mysql for small and medium-sized enterprise website construction of a set of open source cms. A cross-site scripting vulnerability exists in the 'adminfrom.php' page of the DM website builder system. The program fails to filter user-supplied...

SQL Injection Vulnerability in Ektronix Website Building System

Ektrosys developed a general-purpose CMS program for schools, education and other sites. The product has a SQL injection vulnerability, the vulnerability URL is: http://www.sxzkc.cn/BlogManage/Message/ManageInBoxMessage.aspx, the vulnerability parameter is: txtInBoxSearch The attacker can use the...

SQL Injection Vulnerability in Ningxia Government Website Building System of Yinchuan Ruitong Fangsheng Information Technology Co.

Ningxia government website system is a set of software developed specifically for the Ningxia Autonomous Region government websites. SQL injection vulnerability exists in Ningxia Government Website System, which can be exploited by attackers to obtain sensitive information from the database...

XYCMS加盟店企业建站系统 v1.6 参数id SQL注入漏洞

No description provided by source...

SQL Injection Vulnerability in IDC Website Building System

IDC website building system is a set of intelligent website building system. The product suffers from a sql injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

XYCMS健身会所建站系统 v1.1 jsxm_detail.asp 参数id SQL注入漏洞

0x01漏洞简介 XYCMS健身会所建站系统采用asp+access架构。其v1.1版本在/jsxmdetail.asp处对参数id 过滤不严，导致出现SQL注入漏洞。 0x02漏洞详情 该系统默认存在一个管理员数据表adminuser，该表包含管理员名称字段admin和密码 md5加密字段password，远程攻击者可以结合union方式获取敏感信息，登陆后台，上传shell。 0x03修复方案 过滤。...

SQL Injection Vulnerability in Website Building System of Shenyang Woodman Culture Communication Co.

Shenyang Woodman Culture Communication Co., Ltd. is a high-tech company dedicated to website construction, mobile client app, customized system application software, e-commerce development and operation. The website building system developed by Shenyang Woodman suffers from SQL injection...

SQL Injection Vulnerability in Government Website System of Bazhong Wanshan Software Co.

Bazhong Wanshan Software Co., Ltd. is a software company specializing in serving Bazhong city government departments. A SQL injection vulnerability exists in the Bazhong Wanshan Software Government Website Building System, which allows attackers to exploit this vulnerability to obtain sensitive...

Hangzhou Boce Network Technology Co., Ltd. station-building system / bocadmin/j/uploadify.php there are arbitrary file upload vulnerability

BOC is a system of Hangzhou Bocai Network Technology Co., Ltd. that provides professional website construction services. The website building system /bocadmin/j/uploadify.php of Hangzhou Bocai Network Technology Co., Ltd. has an arbitrary file upload vulnerability, which allows an attacker to...

某通用型建站系统SQL注射之八

简要描述： 之八 详细说明： 某通用型建站系统SQL注射之八。 源码：XYCMS管理咨询公司建站系统 v4.2 地址：http://down.chinaz.com/soft/29472.htm 注入点：Showdxal.asp?id= 可搜索到实例： 实例如下： http://www.laco-hr.com/showdxal.asp?id=66 http://www.pundun.cn/showdxal.asp?id=66 http://www.szcxl.com/showdxal.asp?id=63 http://www.jshbls.com/showdxal.asp?id=19...

某校园建站系统同一文件多处sql注入漏洞

简要描述： sql 详细说明： 使用量非常多 http://www.dlwsxx.com/ws2004/model/login1.asp http://www.fzjcxx.cn/ws2004/model/login1.asp http://www.nxyancgjzx.com/ws2004/model/login1.asp http://www.sgtjb.com/ws2004/model/login1.asp http://www.sdwhys.com/ws2004/model/login1.asp...

Sistem Biwes Multiple Vulnerability`

=================================================================== Sistem Biwes Multiple Vulnerability =================================================================== Author: eidelweiss @randyarios Product / software: SISTEM BIWES Vendor Site: http://sistembiwes.com/ Product Price: RM240 /...

MYPHP 4.0 企业建站系统上传漏洞

未能很好的过滤上传文件扩展而引起的上传漏洞 /adminc/downupload.php ====================================================================================== $downtype=".doc|.zip|.rar|.gif|.jpg|.jpeg|.png|.xls|.pdf|.ppt|.exe"; if !strstr$downtype, $imgtypetype echo "span class=txt请上传".$downtype."类型文件/span"; exit;...