cmseasy官方演示站某漏洞获取webshell

简要描述： csrf+lfi拿下shell 详细说明： 1.这里直接进数据库了，没有判断路径是否跳出了templete目录的问题 2.然后利用这一点，我们可以构造如下页面，诱惑管理员访问： 3.官方演示站，我们可以直接用测试帐号登录，然后点击这个页面 当然也可以手动去后台添加 （官方下载的5.5版本，安装好之后自动带有两个自定义表单，无需管理员手动添加，我就利用了其中一个）： 4.其数据包如下： 5.提交后访问如下页面即可获得shell（无需登陆） test1站的shell...

FreeSMS - pagescrc_handler.php?scheduleid SQL Injection

FreeSMS - pagescrchandler.php?scheduleid SQL Injection source: https://www.securityfocus.com/bid/63004/info FreeSMS is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Attackers can exploit these...

Joomla! Component JVideoClip 1.5.1 - 'uid' SQL Injection

source: https://www.securityfocus.com/bid/62610/info The JVideoClip component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

B2Bbuilder website SQL injection vulnerability that can be drag library-vulnerability warning-the black bar safety net

Brief description: B2Bbuilder official websiteSQL injectionvulnerabilities that can be drag library There is also the message path. Detailed description: The presence of the injected url: http://www.b2b-builder.com/announcement.php?id=30 Reported an absolute path vulnerability: ! The official...

Bo-Blog 2.1.1 - Cross-Site Scripting SQL Injection

Bo-Blog 2.1.1 - Cross-Site Scripting SQL Injection source: https://www.securityfocus.com/bid/61880/info Bo-Blog is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to...

Bo-Blog 2.1.1 - Cross-Site Scripting / SQL Injection

source: https://www.securityfocus.com/bid/61880/info Bo-Blog is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary code in the context of the browser,...

vBulletin 4.0.2 - update_order SQL Injection

vBulletin 4.0.2 - updateorder SQL Injection source: https://www.securityfocus.com/bid/61449/info VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to...

WordPress Plugin miniBB - SQL Injection Multiple Cross-Site Scripting Vulnerabilities

WordPress Plugin miniBB - SQL Injection Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/61116/info miniBB is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities. Successful exploits could allow an attacker to steal...

Simple PHP Agenda 2.2.8 - edit_event.php?eventid SQL Injection

Simple PHP Agenda 2.2.8 - editevent.php?eventid SQL Injection ============================================= WEBERA ALERT ADVISORY 02 - Discovered by: Anthony Dubuissez - Severity: high - CVE Request – 05/06/2013 - CVE Assign – 06/06/2013 - CVE Number – CVE-2013-3961 - Vendor notification –...

ScriptCase - scelta_categoria.php SQL Injection

ScriptCase - sceltacategoria.php SQL Injection source: https://www.securityfocus.com/bid/60461/info ScriptCase is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

Weyal CMS - Multiple SQL Injections

Weyal CMS - Multiple SQL Injections source: https://www.securityfocus.com/bid/60089/info Weyal CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to...

Weyal CMS - Multiple SQL Injections

source: https://www.securityfocus.com/bid/60089/info Weyal CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or...

Espcms V5.6.13.04.22 UTF8 正式版注入漏洞之3/N

简要描述： 某文件对于从数据库中读取的变量未过滤，放入其他的sql语句中，造成二次sql注入 详细说明： 文件\interface\public.php中： $ecmemberusernameid = $this-membercookieview'userid'; if $ecmemberusernameid $rsMember = $this-getmemberattvalue$ecmemberusernameid; $userid = $ecmemberusernameid ? $ecmemberusernameid : 0; $name = $rsMember'alias' ?...

mysql: unspecified vulnerability related to Server (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors...

mysql: unspecified DoS related to Information Schema (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Information Schema...

Todoo Forum 2.0 - todooforum.php Multiple Cross-Site Scripting Vulnerabilities

Todoo Forum 2.0 - todooforum.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/59069/info Todoo Forum is prone to multiple SQL-injection and cross-site scripting vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based...

WordPress Plugin Spider Video Player - 'theme' SQL Injection

source: https://www.securityfocus.com/bid/59021/info Spider Video Player plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

PHP Address Book - '/addressbook/register/delete_user.php?id' SQL Injection

source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit laten...

PHP Address Book - '/addressbook/register/reset_password_save.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit laten...

PHP Address Book - addressbookregistertraffic.php?var SQL Injection

PHP Address Book - addressbookregistertraffic.php?var SQL Injection source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker to...