mcms最新版SQL注入6枚打包（可出任意数据）

简要描述： mcms最新版SQL注入6枚打包（可出任意数据） 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚：/app/public/flink.php?m=save&ajax=1 post中有6个参数，虽然都经过了xss和sql的过滤，但是过滤的并不完全，我们看看是如何注入的。这里以forder为例进行说明（虽然下面的代码中，forder被intval了，但是不影响注入啊，慢慢看下去吧）。 function msave glob...

Shopify: Force 500 Internal Server Error on any shop (for one user)

There is very strange behavior. If user open urls like below: - https://whashp.myshopify.com/?previewthemeid=11288717 - or https://lmfshp.myshopify.com/?previewthemeid=11290937 He got redirect to shop https://whashp.myshopify.com/ and 500 Internal Server Error response, and reload does not help i...

Discuz全版本存储型DOM XSS（可打管理员）附Discuz官方开发4大坑&验证脚本

简要描述： 由此次漏洞和上次的命令注入，看出Discuz官方开发4大坑： 1.发的补丁和diff官方最新版本安装包的结果不一定相同（导致后台升级，手动更新后已经在新版本修了的漏洞还在） 2.发补丁不发修复点的公告（导致二次开发的站考虑到兼容性不愿第一时间更新） 3.在线上改代码修漏洞却不发补丁 4.发补丁，发新版本安装包的时间，论坛发补丁帖的时间不一致，参见：http://download.comsenz.com/DiscuzX/3.2/ http://www.discuz.net/forum-10-1.html 详细说明： Discuz编辑器JS处理不当导致的存储型XSS。 产生原因：...

Mango cloud KODExlporer information leak+arbitrary command execution getshell(a-vulnerability warning-the black bar safety net

Do you want to blast your entire chrysanthemum it??? I take it slow and... Don't be afraid to hurt it. Give up Detailed description: Code I from official website next. Dog brother, waiting for the Universal rewards. I don't have how analysis, own download sets of source code to build it! I don't...

KPPW最新版SQL注入漏洞九(全局问题导致大面积注入及总结)

简要描述： KPPW最新版SQL注入漏洞九，也是全局问题导致的大面积注入，这里申明不是在刷漏洞，因为每一个问题都很严重，都能引发很多问题... 详细说明： KPPW最新版SQL注入漏洞九，也是全局函数的问题，导致大面积注入... 文件/control/user/accountauth.php if $code&&inarray$code,$arrAllowAuth $code or $code = $keys '0'; $code or kekezu::showmsg $lang 'paramerror', "index.php?do=auth", 3, '', 'warning' ;...

Discuz! Micro-channel public platform plug-ins patch to bypass the override to delete the database-vulnerability warning-the black bar safety net

Discuz! Micro-channel public platform plug-ins patch to bypass the override to delete the database, and can completely bypass the Baidu cloud waf A vulnerability published is getshell, the results of the plug-in in response to the rapid Ah, today hit the patch, have to say dz is awesome Then real...

[CVE-2 0 1 4-8 9 5 9] phpmyadmin arbitrary file include vulnerability analysis with presentation-vulnerability warning-the black bar safety net

0x01 vulnerability description phpmyadmin is a widely used mysql database management software, based on PHP development. Latest CVE-2 0 1 4-8 9 5 9 announcement, mentioned the program several versions exist of any of the files containing the vulnerability, affected versions are as follows:...

CVE-2 0 1 4-1 8 0 6 . NET Remoting Services vulnerability analysis-vulnerability warning-the black bar safety net

0x00 description Microsoft . NET Remoting is a distributed processing manner, there is provided a method that allows the object by the application domain with the other objects to interact with the framework. A few days ago James Forshaw posted a CVE-2 0 1 4-1 8 0 6 . NET Remoting Services exploi...

Radare - The Reverse Engineering Framework

r2 is a rewrite from scratch of radare in order to provide a set of libraries and tools to work with binary files This is the rewrite of radare 1.x branch to provide a framework with a set of libraries and programs to work with binary data. Radare project started as a forensics tool, an scriptabl...

cmseasy的SQL注射漏洞（附分析和exp）

简要描述： cmseasy sql注射漏洞 详细说明： 先看 manageact.php 174行 if!session::get'from' session::set'from',front::$from; 如果 session中没有 from这个的话就设置front类中$from这个为值,我们追追他的$from怎么产生的。 在 frontclass.php 312-313 if isset$SERVER'HTTPREFERER' self::$from=$SERVER'HTTPREFERER'; 看了下,好像没有对...

CVE-2 0 0 9-1 1 5 1 phpMyadmin Remote Code Injection && Execution-vulnerability warning-the black bar safety net

Directory 1. Vulnerability Description 2. Vulnerability trigger conditions 3. Vulnerability the range of 4. Vulnerability code analysis 5. Defense method 6. Offensive and defensive thinking 1. Vulnerability description Insufficient output sanitizing when generating configuration file phpMyAdmin i...

ThinkSNS SQL注射一枚(无视WAF)

简要描述： 开发时候发现的。 详细说明： apps/page/Lib/Action/DiyAction.class.php 192行： public function doCopyTemplate $id = intval $POST 'id' ; $page = $POST 'page'; $channel = $POST 'channel'; $databaseData = D 'Page' -getPageInfo $page, $channel ; $result = $this-checkRole $databaseData 'manager', $databaseData ;...

ESPCMS 权限限定绕过直接登录后台(DEMO站测试通过)

简要描述： ESPCMS 权限限定绕过直接登录后台 仅测试了 最新版本 然后demo测试进去看了一眼，别的什么也没做。 详细说明： 先看下 后台验证的代码 function softbase$adminpurview = false header"Content-Type: text/html; charset=utf-8"; $this-dbmysql; $this-commandinc; $this-systemfile; $this-cachedb; if $adminpurview $this-adminpurview; $this-sitelng = $this-getlng;...

With legacy code dealing with get rid of the stubborn vulnerability of the simple way-vulnerability warning-the black bar safety net

It turns out that with legacy code dealing not necessarily need to spend a few days to study the obscure comment. To find and fix vulnerability, developers can use simple testing tools to the problem of unraveling it. With legacy code dealing will be more difficult, especially if the code is...

FineCMS 最新版sql注入一枚(无防御)

简要描述： FineCMS 最新版sql注入一枚 厂商不会又说6月份已经修复吧,我说了这只是一个开始.............................................................................................. 详细说明： 直接看代码： member/controllers/pm.php:lines：27-37： public function index if ISPOST if $this-input-post'action' == 'read' $this-pmmodel-setread$this-uid...

ProFTPD 1.3.0/1.3.0 a (mod_ctrls support) Local Buffer Overflow Exploit vulnerabilities and attack code analysis-vulnerability warning-the black bar safety net

Exploit code URL: ! 1, Operating environment: 1, The ProFTPD 1.3.0/1.3.0 a 2, the compiled ProFTPD,--enable-ctrls option must be open ./ configure --enable-ctrls 3, the local user need to have through the Unix Socket permission to connect 2, The Run parameters: revenge@darklight$ ./...

ProFTPd Local pr_ctrls_connect Vulnerability - ftpdctl vulnerability and exploit code analysis-vulnerability warning-the black bar safety net

Exploit code URL: http://www.exploit-db.com/exploits/394/ ! 1, Operating environment: 1, The ProFTPD 1.3.0/1.3.0 a 2, the compiled ProFTPD,--enable-ctrls option must be open ./ configure --enable-ctrls 2, The Run parameters: root@kali: gcc 3 9 4. c-o 3 9 4 root@kali: ./ 3 9 4 –s option -p...

PHPMyWind后台管理界面的SQL注入漏洞

简要描述： 后台管理界面因为过滤不严格导致SQL注入漏洞，可以使权限较低的管理员取得较高权限，以及获取并修改超级管理员的用户名密码。 详细说明： 存在问题的代码，adminsave.php 59-101行，SQL语句中的$id存在注入 else if$action == 'update' //创始人账号不允许更改状态 if$id == 1 and $checkadmin != 'true' or $levelname != '1' ShowMsg'抱歉，不能更改创始账号状态！','-1'; exit; //只有超级管理员才有权修改超级管理员 if$cfgadminlevel 1 and...

Kreed <= 1.05 Format String and Denial of Service Exploit

No description provided by source. / by Luigi Auriemma / include stdio.h include stdlib.h include string.h include time.h / Read/Write bits to buffer 0.1.1 by Luigi Auriemma e-mail: [email protected] web: http://aluigi.altervista.org max 32 bits numbers supported from 0 to 4294967295. Probabl...

cmseasy最新版存储型XSS+代码分析（可绕过xss防护机制）

简要描述： cmseasy 5.5.0.20140605 详细说明： bbs/ajax.php $data = array; $POST'content' = unescape$POST'content'; $data'aid' = isset$POST'aid' ? intval$POST'aid' : exit0; $data'tid' = isset$POST'tid' ? intval$POST'tid' : 0; $data'content' = isset$POST'content' ? $POST'content' : exit0; $data'username' =...