dayucms v1.527 File Upload Vulnerability

DayuCMS is a free, open source, flexible and simple CMS system. dayucms v1.527 in the file upload vulnerability , the attacker vulnerability by uploading a zip file containing a Trojan horse , the system will automatically decompress , so as to obtain the webshell...

Arbitrary File Download Vulnerability in DayuCMS

DayuCMS is a marketing-centered CMS system that incorporates search engine algorithms to facilitate businesses and individual webmasters. DayuCMS has an arbitrary file download vulnerability. The vulnerability is caused by the function of the download file module does not filter the download file...

CSRF Vulnerability in DayuCMS

DayuCMS is a marketing-centered CMS system that incorporates search engine algorithms to facilitate businesses and individual webmasters. CSRF vulnerability exists in DayuCMS. An attacker can exploit the vulnerability to complete automatic database backup, further explode the database path and...

SQL injection vulnerability in DayuCMS backend content.inc.php page

DayuCMS is a marketing-centered CMS system that incorporates search engine algorithms to facilitate businesses and individual webmasters. A SQL injection vulnerability exists in the content.inc.php page of DayuCMS backend. An attacker can exploit the vulnerability to obtain sensitive database...

DayuCMS 1.526 and DirCMS front any code to perform the analysis and POC-vulnerability warning-the black bar safety net

DayuCMS in converting the string to array function in the direct use of eval, and presence of control variables, leading to arbitrary code execution. DayuCMS may reference the DirCMS code, The two CMS code is almost similar. This article only analysis DayuCMS 0x01. Vulnerability description DayuC...

DayuCMS 1.525 /pay/order.php 代码执行漏洞

No description provided by source...

DayuCMS 1.525 /member/include/tag.class.php SQL注入漏洞

/member/include/member.class.phpfunction exists$field, $value return $this-db-fetchone"SELECT id FROM $this-table WHERE $this-table.$field='$value' LIMIT 0, 1"; 传入的$field和$value未经过过滤直接带入SQL语句中。 /member/include/msg.class.php function send$msgs global $userid,$username,$member;...