Mail.ru: [my.mail.ru] CRLF Injection

Сценарий перенаправления с /folder/ на /folder уязвим к атаке типа CRLF Injection. PoC Установка cookie crlf=inj на .mail.ru Подвержены все браузеры, кроме FireFox http://my.mail.ru/crlftest%0dSet-Cookie:crlf=inj6;domain=.mail.ru;path=/;/...

AKCMS 6.0 /akcms/login.php 登录绕过漏洞

该漏洞的问题出现在login.php中，由于编码采用GBK，而对$postusername变量没有进行严格的过滤和转义，导致可以绕过SQL防护，实现注入，下面针对此漏洞进行详细分析。 首先在login.php中第4行 ifisset$postloginsubmit if$editor = $db-getby'', 'admins', "editor='".$db-addslashes$postusername."'" ifakmd5$postpassword, 0, 2 == $editor'password' if$editor'freeze' == 1...

Cookies Manager - Simple Cookie Stealer

A simple program in PHP to help with XSS vulnerability in this program are the following: + Cookie Stealer with TinyURL Generator + Can you see the cookies that brings back a page + Can create cookies with information they want + Hidden to login to enter Panel use ?poraca to find the login A vide...

Live off the mobile phone client xss comfortably into the background-bug warning-the black bar safety net

Brief description: Live off the mobile phone client sidexsscomfortably, you can log in the background Detailed description: 0x00 keywords code area Live off to find room Android App, user feedback, comfortably, the storage-typexss, the'" 0x02 process User feedback directly inserted into the !...

LebiShop商城系统最新版任意用户登陆

简要描述： LebiShop商城系统最新版任意用户登陆 详细说明： LebiShop商城系统最新版Powered by LebiShop V3.1.01，存在任意用户登陆 官方demo测试 http://plus.demo.lebi.cn/——可注册普通用户和商家用户 http://demo.lebi.cn/——可注册普通用户 我们使用http://plus.demo.lebi.cn/进行测试 首先我们注册一个普通用户222222，并登陆 注意这里的COOKIE中user的值，id=37，这里是用户222222的用户userid...

Mobile Vikings: Stored XSS in Direct debit name

Make new or edit old Direct debit for example https://mobilevikings.be/en/account/easypay/correct-direct-debit-mandate/111366/ 2. Fill owners name with payload asdf'"alertdocument.cookie 3. Save form. We got Stored XSS in pages: https://mobilevikings.be/en/account/easypay/...

PageAdmin多处设计缺陷可getshell

简要描述： rt 详细说明： text3 = now.AddSecondsdoublerandom.Next3600, 86164.ToString"yyyyMMddHHmmss"; masterlogin.imMAPgbr7QUplCu6n3ehttpCookie.Add"Valicate", masterlogin.sxW4jRbFsutFEAxed8Smd, text3; 管理员登陆成功，SetCookie 登陆时间+（3600，86164）之间随机的秒数，进行GetMd5运算。 public string GetMd5string s MD5 mD = new...

用友NC-IUFO报表系统部分安全问题（影响多个大客户）

简要描述： 用友NC-IUFO报表系统存在用户信息泄漏，存在暴力破解的风险，另登录的验证码形同虚设，弱口令，登录之后利用系统功能获取webshell； 详细说明： 我们这里以wooyun厂商的忽略大王，中粮集团的报表平台为例； link： http://iufo.cofco.com/service/iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.login.LoginAction 1. 用户信息泄漏 link：...

ecshop过滤不严导致上万网店可被getshell（需一定条件）

简要描述： 我这里测试的是v2.7.3 和v2.7.4版本,都成功,目测其他版本也可以getshell 详细说明： 1.includes/libmain.php过滤不严导致XSS 看代码 function visitstats if isset$GLOBALS'CFG''visitstats' && $GLOBALS'CFG''visitstats' == 'off' return; $time = gmtime; / 检查客户端是否存在访问统计的cookie / $visittimes = !empty$COOKIE'ECS''visittimes' ?...

YidaCms_X3.2逻辑错误造成越权访问,可修改管理密码

简要描述： 因代码逻辑错误,可以构造语句绕过,直接修改管理员密码 详细说明： 最新版的3.2下的 admin\CheckAdmin.asp username = request.Cookies"username" password = request.Cookies"password" cookiesmd5 = request.Cookies"cookiesmd5" dim adminname,adminpass,adminqx,adminaqx set rs = server.createobject"adodb.recordset" sql="select from...

AssetMan 2.5-b - SQL Injection using Session Fixation Attack

No description provided by source. ============================================================ AssetMan v2.5-b SQL Injection using Session Fixation Attack ============================================================ ; , ,; '. ;: :; :: :: :: :: ': : :. : ;' :: :: ' .' '; ;' '. :: :; ;: :: ; :;. ,...

RakhiSoftware Shopping Cart PHPSESSID Cookie Manipulation Path Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/32563/info RakhiSoftware Shopping Cart is prone to multiple remote vulnerabilities. Exploiting these issues can allow attackers to obtain sensitive information, steal cookie data, access or modify data, or exploit latent...

mutiple timesheets <= 5.0 - Multiple Vulnerabilities

No description provided by source. --==+=================== Spanish Hackers Team www.spanish-hackers.com =================+==-- --==+ Mutiple Timesheets = 5.0 - Multiple Remote Vulnerabilities +==-- --==+====================================================================================+==-- +...

symphony 2.0.7 - Multiple Vulnerabilities

No description provided by source. Symphony 2.0.7 Multiple Vulnerabilities bug found by Jose Luis Gongora Fernandez a.k.a JosS contact: sys-projectathotmail.com website: http://www.hack0wn.com/ - download: http://downloads.symphony-cms.com/symphony-package/36030/symphony-2.0.7.zip - CMS:...

logoshows bbs 2.0 (dd/ich) Multiple Vulnerabilities

No description provided by source. Logoshows BBS 2.0 DD ZoRLu yildirimordulari.com - z0rlu.blogspot.com - turkguvenligi.info ref: http://www.milw0rm.com/exploits/9389 vuln: http://www.logoshows.com/bbs/database/globepersonnel.mdb Logoshows BBS 2.0 ICH yildirimordulari.com - z0rlu.blogspot.com -...

JAWS 0.2/0.3 Cookie Manipulation Authentication Bypass

No description provided by source. source: http://www.securityfocus.com/bid/10670/info JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: JAWS is prone to a cross-sit...

pointter php content management system 1.2 - Multiple Vulnerabilities

No description provided by source. Pointter PHP Content Management System 1.2 Multiple Vulnerabilities Vendor: PangramSoft GmbH Product web page: http://www.pointter.com Affected version: 1.2 Summary: Pointter PHP Content Management System is an advanced, fast and user friendly CMS script that ca...

RCBlog 1.03 - Authentication Bypass Vulnerability

No description provided by source. Vendor: http://noahmedling.com Versions: RCBlog 1.03 May also affect earlier versions Credit: Danny Moules Critical: Yes See PUSH 55 Advisory at https://www.push55.co.uk/index.php?s=ad&id=4 ---- By default, the application provides public access to the text file...

fresh email script 1.0 - Multiple Vulnerabilities

No description provided by source. 1. +-----------------+-----------------+-----------------+ 2. +-----------------+Fresh Email Script+----------------+ 3. +-----------------versions: 1.0 to 1.11 - all 4. +-----------------exploits: file inclusion & cookie manipulation 5. +-----------------founde...

pligg cms 1.1.3 - Multiple Vulnerabilities

漏洞一名称: Pligg CMS file existence exploration/shared hosting privilege escalation Vulnerable version 1.1.3 在config.php文件第80行代码出存在如下代码： ifisset$COOKIE'template' $thetemp = sanit$COOKIE'template'; 往下6行代码如下： $file = dirnameFILE . '/templates/' . $thetemp . "/pligg.tpl"; unset$errors; if !fileexists$fi...