用友NC-IUFO系统通用SQL注入(三)

简要描述： ... 详细说明： 该系统“忘记密码”模块存在sql注入漏洞 链接地址为：/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234 说明：输入用户名和邮箱后提交，程序会提交给 /epp/core（可从抓取的数据包中看到）， 漏洞参数：userid 数据库系统：oracle 注入类型：AND/OR time-based blind 这里直接给出证明案例（列出数据库实例名称即可、不深入）： 0x01; http://nc.xhlbdc.com/epp/ POST /epp/core HTTP/1.1 Host: nc.xhlbdc.co...

President Proposes National Breach Notification Standard

Lacking precious detail, President Obama today proposed a national data breach notification standard, legislation that would mandate breached companies notify affected consumers inside of 30 days. The national law would supersede the current collection of state laws that govern notification...

PHPYun v3.2 /model/ajax.class.php SQL注入漏洞

/model/index.class.phpfunction exchangesaction $GET'page'=$POST'page'; $where=$POST'jobwhere'." ORDER BY lastupdate DESC"; $urlarr'page'="page"; $pageurl=$this-url"index","index",$urlarr; $rows=$this-getpage"companyjob",$where,$pageurl,6,"id,name,uid,salary,edu,lastupdate"; if$rows&&isarray$rows...

Zappos Settles with Nine States Following Data Breach

Online retailer Zappos this week settled with attorneys general in nine states, agreeing to pay out $106,000 stemming from a data breach in 2012 that exposed 24 million customers’ information. Massachusetts Attorney General Martha Coakley filed the settlement in Suffolk Superior Court on Wednesda...

Phone to grab votes APP“train up”to the presence of high-risk vulnerabilities in the user's personal information and other data leaks-bug warning-the black bar safety net

Data 3 6 0 patch-day vulnerability response platform shows that the domestic popular mobile phone to grab votes APP“train up”to the presence of high-risk vulnerabilities, including millions of tickets, ticket orders user ID number, username, plaintext password, detailed ticket information and oth...

NAFCU Dismisses Data Encryption Rule Idea

Even after suffering a data breach, the organization in charge of overseeing the needs of credit unions has cast off the idea of implementing a rule mandating the use of encryption for data transfers. Despite the breach, the National Association of Federal Credit Unions, or NAFCU, is insisting th...

phpmps某处漏洞导致官网沦陷

简要描述： phpmps某处漏洞导致官网沦陷 详细说明： phpmps某处漏洞导致官网沦陷 漏洞证明： phpmps某处漏洞导致官网沦陷 该处泄露了官网密码 WooYun: phpmps通用SQL注入（demo测试成功） admin/gxy123123 进入后台-首页flash处任意上传 shell地址：http://www.phpmps.com/demo/data\com\thumb/20150104iaoydj.php 密码：cai...

Moonpig API Vulnerability Exposes Payment Card Data

Moonpig, a U.K.-based company that sells personalized greeting cards, mugs, t-shirts and other novelties, has been taken to the woodshed for poor security practices by a researcher who claims it’s simple to pilfer user and payment card data through a wonky mobile app API. The company this morning...

Payment Cards Exposed in Possible Chik-fil-A Data Breach

It’s been the year of the data breach, so it only makes sense that reports alleging a data breach at the popular fast food chain, Chik-fil-A, would emerge in the final days of 2014. Late yesterday security journalist Brian Krebs reported that an anonymous source at an unnamed financial institutio...

某通用型大学生管理系统非授权访问

简要描述： 1操作手册泄漏测试用户及密码 2非授权访问，可直接获取系统内所有用户关键信息 3一枚任意文件上传漏洞 详细说明： 注意与其不同 WooYun: 某通用型创新管理系统普通帐号可越权查看及修改任意用户（影响多所高等院校） 官网：http://www.changedu.com/ 由南京先极科技有限公司开发的大学生创新创业训练项目智能管理系统 关键字：大学生创新创业项目智能管理系统 影响案例： http://desktop.nju.edu.cn/cx/ 南京大学大学生创新创业训练智能管理系统 http://dxscx.forestpolice.net/...

Hackers leak 13,000 Passwords Of Amazon, Walmart and Brazzers Users

Hackers claiming affiliation with the hacktivist group "Anonymous" have allegedly leaked more than 13,000 username and password combinations for some of the worlds most popular websites, including Amazon, Xbox Live and Playstation Network. The stolen personal information was released in a massive...

Missing Two-Factor Authentication Led to JPMorgan Breach

The biggest U.S. banking breach of all time came down to the smallest of details. The New York Times, citing sources close to the ongoing investigation of the JPMorgan data breach, said hackers found a server unprotected by two-factor authentication to break in using a stolen user name and passwo...

1.2 Million Credit Cards Lost in Staples Data Breach

Retailer Staples has confirmed that point-of-sale malware had been used at 115 of its retail locations in the United States and criminals were able to access 1.16 million payment card numbers during a six-month-long intrusion. Staples said it removed the malware in September from the affected...

DHS Releases Destover Wiper Malware Indicators of Compromise

US-CERT released a not-so-cryptic advisory this weekend providing enterprises with indicators of compromise and detailed descriptions of the malware used against “a major entertainment company,” the Department of Homeland Security’s description of Sony Pictures Entertainment. DHS describes in gre...

Global Internet Authority ICANN Has Been Hacked

The Internet Corporation for Assigned Names and Numbers ICANN has been hacked by unknown attackers that allowed them to gain administrative access to some of the organization's systems, the organization confirmed. The attackers used "spear phishing" campaign to target sensitive systems operated b...

Built-In Backdoor Found in Popular Chinese Android Smartphones

Chinese smartphone manufacturers have been criticized many times for suspected backdoors in its products, the popular Chinese smartphone brands, Xiaomi and Star N9500 smartphones are the top examples. Now, the China's third-largest mobile and world's sixth-largest phone manufacturer 'Coolpad', ha...

Quantum Encryption Makes Credit Cards Fraud-Proof

Credit card frauds are very common these days – today a data breach occurs in retailer’s shop, online shopping site or banking site and at the next moment millions of cards appears in the underground black market – how simple is that for cyber criminals nowadays. But imagine if there is no possib...

Sony Hackers Threaten 9/11 Type Attack at Theaters Showing 'The Interview' Movie

The massive hacking attack against Sony Pictures Entertainment has yet exposed about 200 gigabytes of confidential data belonging to the company from upcoming movie scripts to sensitive employees data, celebrities phone numbers and their travel aliases, and also the high-quality versions of five...

Sony Warns Employees Health Information May Have Been Compromised

Sony Pictures Entertainment has sent a letter to employees warning them that, along with huge amounts of corporate and employee information, some personal health data belonging to SPE employees may also have been compromised in the attack that hit the company in late November. The letter, which...

CHARGE Anywhere Breached, Plain Text Data Accessed

CHARGE Anywhere, a New Jersey-based developer of payment gateway and mobile payment applications, on Tuesday disclosed that it had been breached and that hackers had access to transactions leaving its network, perhaps going back as far as 2009. Most of the traffic was encrypted, the company said ...