DeDeCMS 5.5 '_SESSION[dede_admin_id]' Parameter Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/38469/info DeDeCMS is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input. Attackers can exploit this issue to gain unauthorized access to the affected application...

DedeCMS 5.1 - SQL Injection

No description provided by source. Securitylab.ir Application Info: Name: DEDECMS Version: 5.1 Discoverd By: Securitylab.ir Website: http://securitylab.ir Contacts: adminatsecuritylab.ir & info@securitylabdotir Vulnerability Info: Type: Sql Injection Vulnerability Risk: Medium...

DedeCMS 5.7 /plus/recommend.php SQL注入漏洞

No description provided by source...

DedeCMS 5.7SP1 /plus/download.php URL重定向漏洞

/plus/download.php中代码59行传入base64加密之后的参数link，经过代码的解码之后，再经过代码67行header函数就会重定向到任意网站。 DedeCMS 5.7SP1...

DedeCMS 5.7 /wap.php SQL注入漏洞

No description provided by source...

PHPMYWIND 后台Getshell的一种方法

简要描述： 过滤不严。 详细说明： phpmywind 和 dedecms 都挺像的。 在修改配置文件的时候 过滤掉了单引号 防止闭合单引号 Getshell。 $cfgwebname = '我的网站'; $cfgweburl = 'http://127.0.0.1'; $cfgwebpath = '/phpmywind'; $cfgauthor = ''; $cfggenerator = 'PHPMyWind CMS'; $cfgkeyword = ''; $cfgdescription = ''; 配置文件 单引号保护。 然后过滤掉单引号。 看似无法从配置文件这里下手 其实还是可以的...

DEDECMS full version disregard for GPC injection exp-vulnerability warning-the black bar safety net

? php printr " +------------------------------------+ DEDECMS full version disregard for GPC injection code by :Sunshie Usage:$argv0 domain Example: php.exe$argv0 www.phpinfo.me +------------------------------------+ " ; if$argv1=="" exit"do not tease than we're still good friends"; else...

DedeCMS latest through the kill injection(buy_action.php)vulnerability analysis-vulnerability warning-the black bar safety net

0x00 Preface Two days ago, dark clouds white hat submitted two DedeCMS through killing injection vulnerabilities, much noise uproar, 2, No. 5, weaving dreams official release of the patch, so you download the latest code back to do a comparison, here is a simple analysis under the one injection...

DedeCMS full version through the kill SQL injection exploit code and tools-vulnerability warning-the black bar safety net

dedecms that weave the dream of PHP open source website content management system is. Woven dream content management systemDedeCms in a simple, practical, open-source and famous, is domestic most well-known PHP open source website management system, is also using most users of PHP class CMS syste...

DedeCMS 5.7 /plus/recommend.php SQL注入漏洞

No description provided by source...

DEDECMS members of the center injection member/pm. php-vulnerability warning-the black bar safety net

漏洞 文件 member/pm.php the official has been patched http://127.0.0.1/dede/member/pm.php?dopost=read&id=1' and char@ and 1=2+UniOn+SelEct 1,2,3,4,5,6,7,8,9,10,11,12%2 0% 2 3 Safe Alert: Request Error step 1 ! http://127.0.0.1/dede/member/pm.php?dopost=read&id=1'and char@ and 1=2+/! 50000Union/ +/!...

DedeCMS 5.7 /images/swfupload/swfupload.swf 跨站脚本漏洞

No description provided by source...

Dedecms members of the center injection vulnerability-vulnerability warning-the black bar safety net

Brief description: Dedecms members of the center injection vulnerability Detailed description: member/buyaction.php requireoncedirnameFILE."/ config.php"; CheckRank0,0; $menutype = 'mydede'; $menutypeson = 'op'; requireonce DEDEINC.'/ dedetemplate.class.php'; $product = isset$product ? trim$produ...

Dedecms SQL injection vulnerabilities lead to can modify any user's password-vulnerability warning-the black bar safety net

Brief description: DEDEcms SQL injectionvulnerabilities lead to can modify any user's password Detailed description: DEDEcms SQL injectionvulnerabilities lead to can modify any user's password Need to open the membership module /member/resetpassword.php else if$dopost == "getpasswd" //Change the...

dedecms xss 0day pass to kill all versions can be getshell-a vulnerability warning-the black bar safety net

The hole reason: DEDECMS since the editor filter is not strict, will cause the malicious script to run. Can getshell obtain permission. Why say it is a 0Day? Can getshell of all 0Day（tasteless play together also can become the Phoenix is currently just a test over 5. 3 to 5. 7 version. Other...

DedeCMS 5.7 config.php 跨站脚本漏洞

dedecms 5.7 config.php 跨站脚本漏洞 \include\dialog\config.php $cuserLogin = new userLogin; if$cuserLogin-getUserID 提示：需输入后台管理目录才能登录请输入后台管理目录名：", "javascript:;"; exit; $gurl = "../../$adminDirHand/login.php?gotopage=".urlencode$dedeNowurl; echo "location='$gurl';"; exit; 对用户提交的$adminDirHand...

DedeCMS 5.7 /include/dialog/config.php 跨站脚本漏洞

No description provided by source...

DedeCMS 5.7 后门漏洞

No description provided by source...

DedeCms 5.7友情链接模块注入漏洞

No description provided by source...

DEDECMS website management system template execution vulnerability-vulnerability warning-the black bar safety net

DEDECMS website management system template execution vulnerability One not careful, your server will be hacked, such as database password is too simple, the server password is too simple, or CMS system vulnerabilities. The following is a DEDE of the template execution vulnerability. Vulnerability...