Discuz 6.X [flash] xss bug

其实该漏洞在2007年就公布过了1,但是经过80vul-A测试改漏洞一直没有被修补。该漏洞的分析主要点如下： 第一:Discuz!把allowScriptAccess设置为sameDomain:param name="allowScriptAccess" value="sameDomain"我们只需要把swf文件上传到目标上就可以使用flash调用我们构造的swf了。 第二:由于html调用flash是不限制后缀的，所以攻击者可以用图片文件的后缀如gif通过论坛的上传功能上传，上传功能只是使用了getimagesize来判断，但是swf一样可以通过该函数。 Discuz 6.X...

The latest Discuz! NT2. 5 vulnerability to report! - Vulnerability warning-the black bar safety net

Title: the latest Discuz! NT2. 5 vulnerability to report! Author: hackest H. S. T. This article has been published in the hacker X-Files for 2 0 0 8 P 1 0 issue of the magazine on After the author published on the blog, such as reproduced please retain this information! Summer, passion in August,...

The latest Discuz! NT2. 5 vulnerability-vulnerability warning-the black bar safety net

Author: hackest H. S. T. This article has been published in the hacker X-Files for 2 0 0 8 P 1 0 issue of the magazine on After the author published on the blog, such as reproduced please retain this information! Summer, passion in August, so excited about the Beijing Olympic Games has finally...

Discuz! 6.0.1 (searchid) Remote SQL Injection Exploit-vulnerability warning-the black bar safety net

The following proceduresmethodsmay carry offensive,for security research and teaching purposes,at your own risk!& lt;? php errorreportingEALL&ENOTICE; printr" +------------------------------------------------------------------+ Exploit discuz6. 0. 1 Just work as php=5 & mysql=4.1 BY james...

Discuz!NT 2.5 showuser.aspx注入漏洞

No description provided by source...

Discuz Spache.php注射漏洞

discuz的空间功能 space.php $member = $db-fetchfirst"SELECT m., mf., u.grouptitle, u.type, u.creditshigher, u.creditslower, u.readaccess, u.color AS groupcolor, u.stars AS groupstars, u.allownickname, u.allowuseblog, r.ranktitle, r.color AS rankcolor, r.stars AS rankstars $oltimeadd1 FROM...

Discuz space. php injection vulnerability analysis-vulnerability warning-the black bar safety net

$member = $db-fetchfirst"SELECT m., mf., u. grouptitle, u. type, u. creditshigher, u. creditslower, u. readaccess, u. color AS groupcolor, u. stars AS groupstars, u. allownickname, u. allowuseblog, r. ranktitle, r. color AS rankcolor, r. stars AS rankstars $oltimeadd1 FROM $tablepremembers m LEFT...

discuz obtain any administrator password vulnerability-vulnerability warning-the black bar safety net

The author of the article: The Frozen prodigal son Information source: evil octal information security team www.eviloctal.com） Vulnerability description: Discuz Forum system is a set of used php+mysql database running,which found a security vulnerability, successful exploitation of this...

discuz obtain any administrator password exploit tools vbs-version-the vulnerability warning-the black bar safety net

Author: Safe3 Original link The intends to consider to write a python version of the, consider everyone for the machine environment or got a vbs version Also conducive to modify 以下 是 search.inc.php file the exploit code in the VBS version Dim strUrl,strSite,strPath,strUid showB Set Args = Wscript...

CVE-2008-3554

SQL injection vulnerability in index.php in Discuz! 6.0.1 allows remote attackers to execute arbitrary SQL commands via the searchid parameter in a search action...

Sql injection

SQL injection vulnerability in index.php in Discuz! 6.0.1 allows remote attackers to execute arbitrary SQL commands via the searchid parameter in a search action...

CVE-2008-3554

SQL injection vulnerability in index.php in Discuz! 6.0.1 allows remote attackers to execute arbitrary SQL commands via the searchid parameter in a search action...

CVE-2008-3554

Discuz! 6.0.1 is affected by a SQL injection in index.php via the searchid parameter in a search action. The vulnerability, caused by improper handling of the searchid input, allows remote attackers to execute arbitrary SQL commands. Public references indicate exploitable payloads exist (e.g., ex...

Discuz! Forum the wap function module coding injection vulnerability-vulnerability warning-the black bar safety net

Author: The Frozen prodigal son Due to the hair in a blog on the vulnerability information to a bit beef up. Official has out patch. Since PHP for multibyte character sets support the existence of problem in various coding conversion process, it is possible to initiate a program overflow and...

Discuz! 6.0.1 - searchid SQL Injection

Discuz! 6.0.1 - searchid SQL Injection =5 & mysql=4.1 BY james +------------------------------------------------------------------+ "; if$argc4 $host=$argv1; $port=$argv2; $path=$argv3; $uid=$argv4; else echo "Usage: php ".$argv0." host port path uid\n"; echo "host: target server \n"; echo "port:...

Discuz! 6.0.1 - 'searchid' SQL Injection

=5 & mysql=4.1 BY james +------------------------------------------------------------------+ "; if$argc4 $host=$argv1; $port=$argv2; $path=$argv3; $uid=$argv4; else echo "Usage: php ".$argv0." host port path uid\n"; echo "host: target server \n"; echo "port: the web port, usually 80\n"; echo "pat...

Discuz!论坛wap功能模块编码的注射漏洞

Discuz!论坛系统是一个采用 PHP 和 MySQL 等其他多种数据库构建的高效论坛解决方案。Discuz! 在代码质量，运行效率，负载能力，安全等级，功能可操控性和权限严密性等方面都在广大用户中有良好的口碑 由于 PHP 对 多字节字符集的支持存在问题，在各种编码相互转换过程中，有可能引发程序溢出和程序错误 提交一个 ' 转意成 ' 然后转成gbk的，\和'就变成两个字符了 '就可以成功的引入 Discuz!4.0.0 Discuz!4.1.0 Discuz!5.0.0 Discuz!5.5.0 Discuz!6.0.0 Discuz!6.1.0...

4 5 ways to get Webshell method-vulnerability warning-the black bar safety net

To GoogLe,search some keywords,edit. asp? Korean broiler chickens is more,the majority of MSSQL database! 2, To Google ,site:cq. cn inurl:asp 3, The use of mining chicken and an ASP Trojan. The file name is login. asp The path set is/manage/ The key word is went. asp 'Or'='or'to login 4, Keywords...

Discuz! 6 the background to get the Shell methods-vulnerability warning-the black bar safety net

Note: article first wolves（www.wolvez.org that post by the original author, please submit to the evil octal, reproduced please indicate the original author and source. If the background can online edit the template while following the method you can get the SHELL. 1. Background edit...

Discuz! "$_SERVER['PHP_SELF']" XSS Vulnerability

在common.inc.php文件的69行： $PHPSELF = $SERVER'PHPSELF' ? $SERVER'PHPSELF' : $SERVER'SCRIPTNAME'; $SCRIPTFILENAME = strreplace'\\', '/', isset$SERVER'PATHTRANSLATED' ? $SERVER'PATHTRANSLATED' : $SERVER'SCRIPTFILENAME'; $boardurl = 'http://'.$SERVER'HTTPHOST'.pregreplace"//+api|archiver|wap?/$/i",...