580 matches found
Discuz! x the use of SSRF remote command execution vulnerability
Content source: security think tank 0X01 ready to work jannock issued by Discuz conditional remote command execution,a lot of big stations affected, the online hasn't published details, in a safe public number to see on the jannock simple to say about the principle, is ssrf+redis/memcache issues,...
金蝶某系统存在远程命令执行
简要描述： 金蝶某系统存在远程命令执行 详细说明： http://118.194.40.105/ 为discuz，且服务器存在redis服务，通过ssrf WooYun: Discuz!另一处SSRF无须登陆无须条件 可以更改discuz缓存代码，从而实现远程命令执行。 设置 还原 漏洞证明：...
Discuz! source\function\function_discuzcode.php 存储型xss漏洞
No description provided by source...
AppCan vulnerability spree(AppCan weak password\XSS\SQL injection\sensitive files leaked\weak password\file upload vulnerability collection)-vulnerability warning-the black bar safety net
Test yourself to write the discuz scan tool robustness of the time to find a backup file http://bbs. appcan. cn//config/configucenter. php. bak Use uckey getshell failure,the test has changed uckey. To continue testing,found a suspected injection point http://edu. appcan. cn/traindetailnew. html?...
Discuz! X2 X3多个版本无须登陆无须条件SSRF漏洞
No description provided by source...
Discuz! 后台开启广播条件下的存储型跨站脚本漏洞和ssrf漏洞
No description provided by source...
Discuz X2.5 /uc_server/control/admin/db.php 路径泄露漏洞
No description provided by source...
Discuz X3.2的milu_seotool插件存在本地文件包涵漏洞
0x01漏洞简介 Discuz X3.2的miluseotool插件存在本地文件包涵漏洞。 看见木有有个微信登陆功能，漏洞也出现在这里。无截断所以不鸡肋。 0x02漏洞分析 接下来看代码，文件在source\plugin\wechat\wechat.class.php： static public function redirect$type global $G; $hook = unserialize$G'setting''wechatredirect'; if !$hook || !inarray$hook'plugin', $G'setting''plugins''availabl...
Discuz问卷调查专业版插件参数orderby存在SQL注入漏洞
No description provided by source...
Discuz 2 0 1 5 0 6 0 9 version stored XSS vulnerability repair bypass report-vulnerability warning-the black bar safety net
Author: RickGray Date: 2015-12-09 Before 2015-03-07）the clouds had reported the Discuz full version storage-DOM XSS that can be hit, the administrator attached to the Discuz official development 4 pit&validation script on, but in the Discuz version 2015-06-09 of repair it because the repair is no...
Discuz! 链接格子插件 v2.5.1 存储型 XSS 漏洞
Discuz!X2.0,X2.5,X3.0,X3.1,X3.2版本的插件存储型XSS漏洞 0x1 背景 先看看这个图。。信息量好强大 0x2 过程 所有安装都是默认的。 然后在前台点击购买广告位 文字内容插入以下XSS payload看看 " 但是我抓包直接fuzz的时候。。。 看见了iframe标签没有过滤，那么在后台看了下广告记录 漏洞证明： 参考链接： http://www.wooyun.org/bugs/wooyun-2010-0115795/ 原创：泳少@乌云...
discuz 7.2 网站路径泄露漏洞
No description provided by source...
Discuz! X3.x 帖子正文处存储型 XSS 漏洞
No description provided by source...
Discuz!另一处SSRF无须登陆无须条件
简要描述： SSRF对于小程序来说，并不是什么问题，但对于大企业来说，这可能是极严重的。。。并且泄露了真实IP，这对于WAF来说算是严重的问题。 详细说明： 文件： source/module/forum/forumajax.php elseif$GET'action' == 'downremoteimg' $GET'message' = strreplacearray"\r", "\n", array$GET'wysiwyg' ? '' : '', "\n", $GET'message'; pregmatchall"/\img\s^\/ismUe", $GET'message',...
Discuz x3.2前台GET型SQL注入漏洞（绕过全局WAF）
/source/include/misc/miscstat.php 46行： if!empty$GET'xml' $xaxis = ''; $graph = array; $count = 1; $begin = dgmdate$beginunixstr, 'Ymd'; $end = dgmdate$endunixstr, 'Ymd'; $field = ''; if!empty$GET'merge' ifempty$GET'types' $GET'types' = arraymerge$cols'login', $cols'forum', $cols'tgroup',...
Discuz!3.2 利用UC_KEY登陆任意用户
几乎所有版本都可以吧（在得到uckey情况下）/api/uc.php里面有个synlogin方法function synlogin$get, $post global $G; if!APISYNLOGIN return APIRETURNFORBIDDEN; header'P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"'; $cookietime = 31536000; $uid = intval$get'uid'; if$member =...
Discuz 7.2 admincp.php 反射型 xss漏洞
漏洞描述：Discuz! 7.X系列一处问题引发大面积XSS，基本上全部页面和文件都能触发。Discuz! 7.2,7.1,7.0三个版本都受影响漏洞分析：这里拿Discuz! 7.2做分析比如Discuz! 7.2安装包里面的第二个文件就是ajax.php注意最后一行的showmessage函数，跟进include/global.func.php文件。...
Discuz! ychat插件 SQL注入
discuz ychat插件注入漏洞tableychatrooms.phpcode 区域 public function fetchallbycategory$categoryID,$start=0,$limit=0 if!$categoryID return null; $result=array; $result=DB::fetchall"select from ".DB::table$this-table." where categoryID=".$categoryID." order by cnum desc ". DB::limit$start, $limit;//直接带入查询...
X-Series Remote Code Execution Vulnerability
Discuz! is a popular web forum program. A remote code execution vulnerability exists in the updatebadwords method in the Discuz! X series api/uc.php file. An attacker can exploit the vulnerability to perform arbitrary code execution...
Discuz Full Version Stored DOM XSS Vulnerability
Discuz! is a forum program. A stored DOM XSS vulnerability exists in the full version of Discuz. Due to mishandling of the Discuz editor JS, the JS native method of fetching HTML content in ELEMENT reverses the single and double quoted entity codes that have been escaped on the server side...