ewebeditor php&asp版本后台跳过认证漏洞

eWebEditor是一个所见即所得的在线编辑器。顾名思义，就是能在网络上使用所见即所得的编辑方式进行编辑图文并茂的文章、新闻、讨论贴、通告、记事等多种文字处理应用。 ../ewebeditor/admin/config.php文件 用户认证方式存在严重的安全漏洞，可以直接跳过认证获取到管理员权限。 php v3.8 asp v2.8 暂无 请参考官方补丁 首先当然要找到登陆后台,默认是../eWebEditor/admin/login.php,进入后台后随便输入一个用户和密码,当然会提示出错了. 这时候你清空浏览器的url,然后输入...

CVE-2008-6636: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the diredgeskins parameter. NOTE: the provenance of this information is unknown; the...

CVE-2009-0763

Cross-site scripting XSS vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web script or HTML via the charm parameter...

CVE-2009-0763: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web script or HTML via the charm parameter...

CVE-2009-0766: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in default.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the configfile parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

1024 CMS <= 1.4.4 Multiple Remote/Local File Inclusion Vulnerabilities

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-027 Application: 1024 CMS Versions Affected: 1.4.3, 1.4.4 RFC Vendor URL: http://www.1024cms.com/...

CVE-2008-0400: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in header.tpl.php in the modern template for Singapore 0.10.1 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter to default.php...

Sql injection

SQL injection vulnerability in default.php in MMSLamp allows remote attackers to execute arbitrary SQL commands via the idpro parameter in a prodottidettaglio action...

CVE-2007-6575

CVE-2007-6575 covers an SQL injection in MMSLamp’s default.php, exploitable via the idpro parameter in a prodotti_dettaglio action. The vulnerability allows remote attackers to craft SQL commands that may affect the database; the NVD metrics indicate a high impact with network access, low attack ...

CVE-2007-6575: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in default.php in MMSLamp allows remote attackers to execute arbitrary SQL commands via the idpro parameter in a prodottidettaglio action...

mmslamp-sql.txt

Name : mmsLamp SQL Injection Vulnerability. Author : x0kster Email : [email protected] Script Page : http://www.brand039.com/?service=prodottidettaglio&idpro=4 Date : 22/12/2007 Bug in : default.php PoC : http://site.com/default.php?service=prodottidettaglio&idpro=SQL Example:...

MMSLamp (idpro) Remote SQL Injection Vulnerability

No description provided by source. Name : mmsLamp SQL Injection Vulnerability. Author : x0kster Email : [email protected] Script Page : http://www.brand039.com/?service=prodottidettaglio&idpro=4 Date : 22/12/2007 Bug in : default.php PoC :...

MMSLamp (idpro) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================== MMSLamp idpro Remote SQL Injection Vulnerability ================================================== Name : mmsLamp SQL Injection Vulnerability. Author : x0kster Date : 22/12/2007 Bug in :...

MMSLamp - 'idpro' SQL Injection

Name : mmsLamp SQL Injection Vulnerability. Author : x0kster Email : [email protected] Script Page : http://www.brand039.com/?service=prodottidettaglio&idpro=4 Date : 22/12/2007 Bug in : default.php PoC : http://site.com/default.php?service=prodottidettaglio&idpro=SQL Example:...

MMSLamp - idpro SQL Injection

MMSLamp - idpro SQL Injection Name : mmsLamp SQL Injection Vulnerability. Author : x0kster Email : [email protected] Script Page : http://www.brand039.com/?service=prodottidettaglio&idpro=4 Date : 22/12/2007 Bug in : default.php PoC : http://site.com/default.php?service=prodottidettaglio&idpro=SQ...

Unfixed XSS vulnerability at b-naturals.com

Security researcher MaXWeL, has submitted on 08/03/2007 a cross-site-scripting XSS vulnerability affecting b-naturals.com, which at the time of submission ranked 1641639 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/03/2007. It is currentl...

ppalCart.txt

+-------------------------------------------------------------------- + + ppalCart V2.5 EE Remote File Inclusion + +------------------------------------------------------------------- + + Affected Software .: Software + Version .............: ppalCart 2.5 EE + Venedor ...........:...

CVE-2006-0796: Undefined Security Weakness

Cross-site scripting XSS vulnerability in default.php in Clever Copy 3.0 allows remote attackers to inject arbitrary web script or HTML via the Subject field when sending private messages privatemessages.php. NOTE: the provenance of this information is unknown; the details are obtained solely fro...

CVE-2006-0099: Undefined Security Weakness

PHP remote file include vulnerability in 1 include/templates/categories/default.php and 2 certain other include/templates/categories/ PHP scripts in Valdersoft Shopping Cart 3.0 allows remote attackers to execute arbitrary code via a URL in the catalogDocumentRoot parameter...