JAWS 0.2/0.3 Cookie Manipulation Authentication Bypass

No description provided by source. source: http://www.securityfocus.com/bid/10670/info JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: JAWS is prone to a cross-sit...

pligg cms 1.1.3 - Multiple Vulnerabilities

漏洞一名称: Pligg CMS file existence exploration/shared hosting privilege escalation Vulnerable version 1.1.3 在config.php文件第80行代码出存在如下代码： ifisset$COOKIE'template' $thetemp = sanit$COOKIE'template'; 往下6行代码如下： $file = dirnameFILE . '/templates/' . $thetemp . "/pligg.tpl"; unset$errors; if !fileexists$fi...

pointter php content management system 1.2 - Multiple Vulnerabilities

No description provided by source. Pointter PHP Content Management System 1.2 Multiple Vulnerabilities Vendor: PangramSoft GmbH Product web page: http://www.pointter.com Affected version: 1.2 Summary: Pointter PHP Content Management System is an advanced, fast and user friendly CMS script that ca...

fresh email script 1.0 - Multiple Vulnerabilities

No description provided by source. 1. +-----------------+-----------------+-----------------+ 2. +-----------------+Fresh Email Script+----------------+ 3. +-----------------versions: 1.0 to 1.11 - all 4. +-----------------exploits: file inclusion & cookie manipulation 5. +-----------------founde...

Portix-PHP 0.4 Cookie Manipulation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4041/info Portix-PHP is freely available web portal software. It is written in PHP and will run on most Unix and Linux variants. Portix-PHP uses non-expiring cookies for session management. It is possible for a malicious...

RCBlog 1.03 - Authentication Bypass Vulnerability

No description provided by source. Vendor: http://noahmedling.com Versions: RCBlog 1.03 May also affect earlier versions Credit: Danny Moules Critical: Yes See PUSH 55 Advisory at https://www.push55.co.uk/index.php?s=ad&id=4 ---- By default, the application provides public access to the text file...

Ektron CMS400.NET 7.5.2 Multiple Security Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/39679/info Ektron CMS400.NET is prone to multiple security vulnerabilities, including multiple cross-site scripting issues, an information-disclosure issue, a cookie-manipulation issue, a directory-traversal issue, a...

Flat PHP Board <= 1.2 - Multiple Vulnerabilities

No description provided by source. --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org...

BlogPHP 2.0 - index.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/29133/info BlogPHP is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue, an HTML-injection issue, and a cookie-manipulation issue. Attackers can exploit these issues to execute...

Fiyo CMS 1.5.7 Cross Site Scripting

Exploit Title: Fiyo CMS 1.5.7 XSS Vulnerability Date: 05/29/2014 Author: Mustafa ALTINKAYNAK Download URL :http://www.fiyo.org/ Software Link: http://www.fiyo.org/download Vuln Category: CWE-79 XSS Tested on: Fiyo CMS 1.5.7 Tested Local Platform : XAMP on Windows Patch/ Fix: Not published...

AllMyGuests 0.4.1 Insecure Cookie Handling Vulnerability

Exploit for php platform in category web applications ----------exploit Debut Insecure Cookie Handling Vulnerability ----------Script Info Author : JIKO ----------Script Info Site : http://www.voice-of-web.de/c-AllMyGuests-s38.html Version : 0.4.1 Download :...

Easy File Sharing Web Server 6.8 - Stack Buffer Overflow

Exploit for windows platform in category remote exploits Exploit Title: Easy File Sharing Web Server 6.8 stack buffer overflow Date: 10 May 2014 Exploit Author: superkojiman - http://www.techorganic.com Vendor Homepage: http://www.efssoft.com Software Link: http://www.sharing-file.com/efssetup.ex...

CVE-2014-0116

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists...

Localize: Information Disclosure (Directory Structure)

The /var/www/ directory structure is exposed if you add "" to the PHPSESSID in the cookie. Request: GET / HTTP/1.1 Host: www.localize.io Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Referer:...

PHPMYWIND sql 一枚 无视GPC

简要描述： 今天又去重新看了看phpmywind 在官网上下的 版本还是4.6.6 无需登录 无需单引号。 详细说明： 在order.php中 ifempty$COOKIE'shoppingcart' header'location:shoppingcart.php'; exit; //不允许游客下单跳转登陆 ifempty$COOKIE'username' header'location:member.php?c=login'; exit; 让这两个不为空就好。 $action = isset$action ? $action : ''; $datagroup =...

PHPYUN会员中心之外的模块可伪造任意用户登录

简要描述： 任意用户登录 详细说明： 之前看到一个cookie里面的uid 都可以做任意文件删除。 那么 肯定cookie没有效验合法性于是review代码 发现直接设置cookie可以登录用户 并且具有一定的权限（非member模块均有权限） 漏洞证明： 在网站提问区找一个ID 设置cookieuidcookieusernamecookieusertype 访问会员中心会提示登录 但是到提问板块 成功伪造用户提交一个问答 在测试一下邀请面试 可以邀请 不过没有分。。 其他地方应该还有 我就不一一列举了！...

Improper Authentication in Burden

Advisory ID: HTB23192 Product: Burden Vendor: Josh Fradley Vulnerable Versions: 1.8 and probably prior Tested Version: 1.8 Advisory Publication: December 18, 2013 without technical details Vendor Notification: December 18, 2013 Vendor Patch: December 18, 2013 Public Disclosure: January 8, 2014...

CVE-2013-5107

Directory traversal vulnerability in RockMongo 1.1.5 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the ROCKLANG cookie, as demonstrated in a login.index action to index.php...

11 Firefox Add-ons to Hack and PenTest

1. Tamper Data Tamper data is an great tool to to view and modify HTTP/HTTPS headers and post parameters. We can alter each request going from our machine to destination host with this. Thus it helps in security testing web application by modifying POST parameters. It can be used in performing XS...

CSDJCMS拿shell漏洞与PHP源码分析过程

简要描述： CSDJCMS漏洞后台拿shell 详细说明： includeonce"include/install.php"; ifSIsInstall==0 header"Location:install/install.php"; includeonce"include/label.php"; ifSWebmode==1 or !fileexists"index.html" //缓存区 $cacheid ='index'; if!$cacheopt-start$cacheid echo GetTemp"index.html",0; $cacheopt-end; else...