Discuz 7.2 /post.php 跨站脚本漏洞

No description provided by source...

Discuz <= 7.2 SQL injection vulnerability details-vulnerability warning-the black bar safety net

Is said to be a digital company of the emergency response to the release out. The group inside the small partners are shocked, the specific vulnerability analysis see this article Wherein the In the senior PHP application vulnerability auditing techniques of1an article in the"magic quotes brought...

Discuz! 7.2 SQL injection exp（getshell Edition-vulnerability warning-the black bar safety net

? php / @author: xiaoma @blog : www.i0day.com @date : 2014.7.2 2 3:1 / errorreporting0; settimelimit3 0 0 0; $host=$argv1; $path=$argv2; $js=$argv3; $timestamp = time+1 03 6 0 0; $table=”cdb”;//table name if $argc 2 printr‘ Discuz faq.php SQL Injection Exp ---By: A Www.i0day.com---- Usage: php ‘....

建站之星Sitestar官方注入漏洞

简要描述： 注入 详细说明： http://bbs.sitestar.cn/faq.php?action=grouppermission&gids99='&gids1000=%20and%20select%201%20from%20select%20count,concatversion,floorrand02x%20from%20informationschema.tables%20group%20by%20xa%23 漏洞证明： Discuz! info: MySQL Query Error Time: 2014-7-2 4:59pm Script: /faq.php SQL:...

Discuz 7.2 /faq.php SQL注入漏洞

elseif$action == 'grouppermission' ... ... ksort$gids; $groupids = array; foreach$gids as $row $groupids = $row0; $query = $db-query"SELECT FROM $tablepreusergroups u LEFT JOIN $tablepreadmingroups a ON u.groupid=a.admingid WHERE u.groupid IN ".implodeids$groupids."";...

Discuz 7.2 /faq.php SQL注入漏洞 + UC_Key getshell exp

No description provided by source...

Discuz! 1.0 'referer' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37562/info Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Discuz! 2.0 Multiple Cross Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/37573/info Discuz! is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the...

Discuz <= 1.03 SQL Injection Exploit Vulnerability

No description provided by source...

Discuz! 6.0 'tid' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37982/info Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Discuz! 6.0 '2fly_gift.php' SQL Injection Vulnerability

No description provided by source...

Discuz! Plugin Crazy Star <= 2.0 (fmid) SQL Injection Vulnerability

============================================================ Discuz! Plugin Crazy Star = 2.0 Sql injection Vulnerability ============================================================ ========================Author============================ + Founded : ZhaoHuAn + Contact :...

Crossday Discuz! 2.0/3.0 Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9584/info It has been reported that Discuz! is prone to an Cross Site Scripting vulnerability. This issue is caused by the application failing to properly sanitize links embedded within user messages. Upon successful...

Discuz! Plugin JiangHu <= 1.1 (id) SQL Injection Vulnerability

No description provided by source. ========================================================= Discuz! Plugin JiangHu = 1.1 Sql injection Vulnerability ========================================================= ========================Author========================= + Founded : ZhaoHuAn + Contact :...

Discuz! 某验证设计不当可能导致会话重放（设计缺陷）

简要描述： 看详情 详细说明： https://images.seebug.org/upload/201406/2012510860ea0721760f7c0bdaabb0f93abab9...

Discuz3.2后台文件包含漏洞可后台拿shell

简要描述： 最新版本：Discuz! X3.2 Release 20140618 包括以前版本 详细说明： 由于创建专题时未对 静态化名称 做任何限制引发此漏洞 1.全局-站点信息 网站 URL: http://www.comsenz.com/ 2.工具-更新缓存 3.门户-HTML管理 静态文件扩展名: htm 专题HTML存放目录:data/cache 4.创建专题 静态化名称此处未做任何限制：../../template/default/portal/portaltopictest 5.专题管理 对刚添加的专题 开启 并生成 img...

Discuz某默认插件存在本地文件包含漏洞（需后台配置权限可拿shell）

简要描述： 18号更新了程序 所以我们首当其冲的先来检测检测 详细说明： 看见木有有个微信登陆功能 漏洞也出现在这里 无截断 所以不鸡肋 接下来看代码 文件在source\plugin\wechat\wechat.class.php static public function redirect$type global $G; $hook = unserialize$G'setting''wechatredirect'; if !$hook || !inarray$hook'plugin', $G'setting''plugins''available' return;...

Discuz CSRF删除群组分类

简要描述： 详细说明： admingroup.php elseif$operation == 'deletetype' //没有验证fromhash导致可以csrf删除 $fid = $GET'fid'; $ajax = $GET'ajax'; $confirmed = $GET'confirmed'; $finished = $GET'finished'; $total = intval$GET'total'; $pp = intval$GET'pp'; $currow = intval$GET'currow'; if$ajax obendclean; requireonce...

Discuz跨域数据劫持＋附件类型限制绕过

简要描述： 两个凑一块发了 详细说明： 1 跨域数据劫持（csrf token formhash盗取） 下载远程附件功能不会对文件内容（文件格式）进行检测导致可以上传恶意的swf文件（扩展名还是图片扩展名），进而进行跨域数据劫持： 伪造图片CrossDomainDataHijack.jpg相关代码： package com.powerflasher.SampleApp import flash.external.ExternalInterface; import flash.display.Sprite; import flash.display.Sprite; import...

Discuz可CSRF脱裤

简要描述： Discuz CSRF脱裤！ 广告位 承接代码审计 codescan.cn codescanyeah.net 详细说明： admindb.php if!$backupdir $backupdir = random6; @mkdir'./data/backup'.$backupdir, 0777;//文件夹名是六位随机数 C::t'commonsetting'-update'backupdir',$backupdir;/ else //这边也没有做fromhash的验证 估计是方便AJAX请求 DB::query'SET SQLQUOTESHOWCREATE=0',...