Discuz! 1.5 跨站脚本攻击

简要描述： UC登陆页面存在跨站漏洞 详细说明： http://www.eisdl.com/bbs/ucserver/admin.php?m=user&a=login&iframe=&sid='%22%3E%3Ciframe%20src=http://www.pker.in%3E 漏洞证明： http://www.eisdl.com/bbs/ucserver/admin.php?m=user&a=login&iframe=&sid='%22%3E%3Ciframe%20src=http://www.pker.in%3E...

Discuz! NT 3.1.0 后台拿webshell

简要描述： 通过后台写入aspx木马，直接拿到webshell，然后获取整个服务器权限。 详细说明： 1、访问http://127.0.0.1/admin/global/globaltemplatesedit.aspx?path=../tools/&filename=rss.aspx&templateid=1&templatename=Default，写入aspx木马。 2、写入aspx木马后，访问http://127.0.0.1/tools/rss.aspx就可以了。 漏洞证明：...

Discuz! NT 3.1.0 后台拿webshell

简要描述： 通过后台写入执行代码，直接拿到webshell，从而掌握服务器权限。 详细说明： 1、访问http://127.0.0.1/admin/global/globaltemplatesedit.aspx?path=../tools/&filename=rss.aspx&templateid=1&templatename=Default，写入aspx木马。 2、写入aspx木马后，访问http://127.0.0.1/tools/rss.aspx就可以了。 漏洞证明：...

Discuz!NT 2.*-3.5.2 SQL注入漏洞

Discuz!NT 是康盛创想Comsenz旗下的一款功能强大的基于 ASP.NET 平台的社区软件。ajaxtopicinfo.ascx用户控件 poster SQL注入漏洞。结合ajax.aspx调用任意用户控件漏洞 admin/UserControls/ ajaxtopicinfo.ascx 函数 GetCondition WebsiteManage.cs //62 行 if posterlist != "" string poster = posterlist.Split','; condition += " AND poster in "; string tempposerli...

Discuz! NT 2.* -3.5.2 SQL injection vulnerability 0day-vulnerability warning-the black bar safety net

| Vulnerability description: Discuz! NT is the Kang Sheng Chong thinkComsenzits a powerful based on ASP.NET platform community software. ajaxtopicinfo. ascx user control poster SQL injectionvulnerabilities. Combined with ajax. aspx call any user control vulnerability Vulnerability file:...

Discuz!NT 2.x - 3.5.2 SQL注入

简要描述： Discuz!NT 是康盛创想Comsenz旗下的一款功能强大的基于 ASP.NET 平台的社区软件。 详细说明： ajaxtopicinfo.ascx用户控件 poster SQL注入漏洞 漏洞证明： 文件 admin/UserControls/ ajaxtopicinfo.ascx 中 转到函数 GetCondition WebsiteManage.cs //62 行 if posterlist != "" string poster = posterlist.Split','; condition += " AND poster in "; string...

Discuz! X2 Beta 存储型XSS

简要描述： Discuz! X2 Beta 存储型XSS 详细说明： Discuz! X2 Beta 【家园】相册描述 存储型XSS漏洞。 漏洞证明：...

Discuz! 6.0 存储型XSS

简要描述： Discuz! 6.0 存储型XSS 详细说明： Discuz! 6.0 【店铺介绍】存在XSS漏洞 不知道如何访问店铺（没找到这功能！？），所以不知道这个XSS是只跨自己还是跨任何访问店铺的人。 因为这个地方的xss（alert（/Liscker/;）跟去年发的那个【个性签名】 的xss一样，所以个人极度认为这个也是只能跨自己的，只能结合其它漏洞一起来用了。 漏洞证明：...

DZ-X1. 5 Forum latest backstage get WebShell-vulnerability warning-the black bar safety net

Discuz! X is Kang Sheng Chong want Comsenz launch of a community-based professional jianzhan platform, Forum, BBS, the personal space of SNS, the portal（Portal）, group Group, application of open platform the Open Platform for full integration in one, help website realize one-stop service. Look...

DISCUZ X1. 5 vulnerability-vulnerability warning-the black bar safety net

DISCUZ X1. 5 local file inclusion vulnerability Affected versions: DISCUZ X1. 5 other version unknown Vulnerability type: local file inclusion vulnerability Vulnerability analysis: DISCUZX1. 5 local file inclusion, of course, is conditional, is to use a file as a cache. configglobal.php...

discuz x1.5 discuz 7.2 后台getshell 0day通杀版

简要描述： xml过滤不严导致漏洞产生 详细说明： 方法为： 后台：插件--添加插件--请选择导入方式:上传本帖附件中的XML文件 并同时勾选上 允许导入不同版本 Discuz! 的插件易产生错误!! 然后确认 不懂的可以看演示动画。。 shell地址就为：data/plugindata/shell.lang.php discuz x1.5 shell地址就为：data/plugin/data/shell.lang.php discuz 7.2 漏洞证明：...

Discuz! 2 0 1 1 All version background get Webshell 0day-vulnerability warning-the black bar safety net

From Discuz! Ancient 6. 0 version, the vulnerabilities are present in the extensions, use differently, the following start. A Discuz! 6.0 and Discuz! 7.0 Since you want the background to take the Shell, the file is written to Must-see. /include/cache.func.php ! To turn on,find the calling functio...

Discuz X Series Xss vulnerability small collection-vulnerability warning-the black bar safety net

/ Title:Discuz X Series Xssvulnerability small collection Author:sogili@0xsec From:0xsec.org Website:0xsec.org & amp; sogili.com / Discuz X version series smallXssthe vulnerability of the collection. Relates to the Discuz x1. 0 & x1. 5 version. Plus QQ bookmarkXssone. sogili whine when you Tinker...

Discuz entertainment Hall plug-in V1. 0 injection vulnerability and fix-vulnerability warning-the black bar safety net

| Author:0x0F From:0xsec.org Vulnerability Details: sid variable without filtration generated SQL injection. Exploits:http://site/plugin. php? id=huxhall:huxhall&sid=1 You know. KeyWords:inurl:huxhall:huxhall Related companies:Le tour network HappyYux.com Repair Methods:filtration Has a patch:No...

discuz 7.2 code execution vulnerability using the method of two-vulnerability and early warning-the black bar safety net

Use the exp while only the machine testing, and other purposes at your own risk! The first method: First register a user and then put form method="post" action=" http://www.xxx.com/bbs/misc.php" enctype="multipart/form-data" Post ID, specify the presence of a post:input type="text" name="tid"...

Discuz!官方漫游论坛搜索跨站漏洞

简要描述： 过滤转义......可盗COOKIE；挂马，等等。 详细说明： 过滤转义......可盗COOKIE；挂马，等等。 漏洞证明： http://search.discuz.net/f/search?q=%5C%5C&sId=1000&ts=1295648016&mySign=3492ca46&qs=client@￥@"@&menu=1&isAdv=&menu=1&rfh=1&searchLevel=3&author=&threadScope=all&timeLength=0&orderField=default...

Discuz Xss 0day exploit method-vulnerability warning-the black bar safety net

Made it last year using discuz tastelessxssone of the ideas and specific code. discuz x Series on all of the following version of the personal information provided in the personal signature of a presence of a persistent type byXSSvulnerability: for example, in the Modify personal signature, and...

discuz登陆页存在跨站弱点

简要描述： 版本。7.2.7.1都可以X。。只是试了几个站。 其他版本没测试。 详细说明： 文件出在faq.php。。faq.php?action="alert'XSS'search& 提交到本页面。然后登陆 。。跨站形成。 漏洞证明： 测试站点：...

Discuz x 1.5 小松鼠(Discuz! X1.5 xss)

简要描述： 开发人员疏忽. 详细说明： 在发帖时输入imgjavascript:alert/sogili//img 漏洞证明： 自己去看咯...

Discuz non-founder administrator code execution-vulnerability warning-the black bar safety net

| by:alibaba global.func.php function sendpm$toid, $subject, $message, $fromid = " 0 2 if$fromid === " 0 3 requireonce DISCUZROOT.'./ ucclient/client.php'; 0 4 $fromid = $discuzuid; 0 5 0 6 if$fromid 0 7 ucpmsend$fromid, $toid, $subject, $message; 0 8 else 0 9 global $promptkeys; 1 0...