Discuz!官方漫游论坛搜索跨站漏洞

简要描述： 过滤转义......可盗COOKIE；挂马，等等。 详细说明： 过滤转义......可盗COOKIE；挂马，等等。 漏洞证明： http://search.discuz.net/f/search?q=%5C%5C&sId=1000&ts=1295648016&mySign=3492ca46&qs=client@￥@"@&menu=1&isAdv=&menu=1&rfh=1&searchLevel=3&author=&threadScope=all&timeLength=0&orderField=default...

Discuz Xss 0day exploit method-vulnerability warning-the black bar safety net

Made it last year using discuz tastelessxssone of the ideas and specific code. discuz x Series on all of the following version of the personal information provided in the personal signature of a presence of a persistent type byXSSvulnerability: for example, in the Modify personal signature, and...

discuz登陆页存在跨站弱点

简要描述： 版本。7.2.7.1都可以X。。只是试了几个站。 其他版本没测试。 详细说明： 文件出在faq.php。。faq.php?action="alert'XSS'search& 提交到本页面。然后登陆 。。跨站形成。 漏洞证明： 测试站点：...

Discuz x 1.5 小松鼠(Discuz! X1.5 xss)

简要描述： 开发人员疏忽. 详细说明： 在发帖时输入imgjavascript:alert/sogili//img 漏洞证明： 自己去看咯...

Discuz non-founder administrator code execution-vulnerability warning-the black bar safety net

| by:alibaba global.func.php function sendpm$toid, $subject, $message, $fromid = " 0 2 if$fromid === " 0 3 requireonce DISCUZROOT.'./ ucclient/client.php'; 0 4 $fromid = $discuzuid; 0 5 0 6 if$fromid 0 7 ucpmsend$fromid, $toid, $subject, $message; 0 8 else 0 9 global $promptkeys; 1 0...

Discuz 7.2 存储型XSS

简要描述： Discuz 7.2 存储型XSS，可编写蠕虫传播。 详细说明： discuz 7.2 个人空间发表博客，默认管理员可编辑源码，但管理员可在后台设置权限允许普通用户编辑。 该处存在XSS弱点，可编写蠕虫进行传播。每个用户的表单hash值可在html获得，不需要考虑salt，获得cookie即可。 漏洞证明： discuz 7.2 进行表单提交时每个用户的表单hash值不一样，但是固定的，该值可在访问用户的html中获得。如图： 然后将hash代入组包，编写蠕虫即可。 var...

Discuz! 7.2 the following versions and various uc products api interface to Get webshell vulnerability-vulnerability warning-the black bar safety net

For dz, we are more concerned about is to get the shell, but the dz stuff want to take the shell too hard too difficult, on an article at the end of the bedding the next, so this article is also not on the horse after cannon....this vulnerability has been in the discuz! x1 version quietly give up...

Discuz! 7.1 & 7.2 back office remote code execution vulnerabilities and fixes-vulnerability warning-the black bar safety net

Beginning with the reception code is executed together with the see, this clear the code execution, see the estimates also a lot of good adhere to for so long has no one posted this half a year also used a lot of times, but...but eventually someone couldn't resist to publish, you know, published ...

Discuz! 体验站点跨站漏洞(2)

简要描述： sorry 两次提交 这个是刚刚登录后发现的。。 详细说明： 漏洞证明： http://www.discuz.org/forum.php?mod=viewthread&tid=1055&extra=%22%3E%3Cscript%3Ealert%28/%D6%ED%B8%E7%F6%A6/%29%3C/script%3E...

Discuz! 体验站点跨站漏洞

简要描述： 去年就存在 一直未修复。。。杯具。。。 详细说明： 漏洞证明： http://www.discuz.org/ucserver/admin.php?m=user&a=login&iframe=%22%3E%3Cscript%3Ealert%28/insafe/%29%3C/script%3E...

Discuz!漫游插件API本地包含漏洞

简要描述： Discuz!漫游插件API本地包含漏洞,该插件默认不安装,并且服务默认不开启. 详细说明： manyou/api/class/MyBase.php 128: function parseRequest 131: $request = $POST; 132: $module = $request'module'; 133: $method = $request'method'; ... 174: return $this-callback$module, $method, $params; 175: 177: function callback$module, $method...

Discuz! X1某页面存在XSS漏洞

简要描述： 页面对取到的参数没有过滤，直接echo到了html里。 详细说明： api/db/dbbak.php页面，对$apptype缺少必要的过滤，调用apimsg函数时直接将$apptype echo到了html中。 漏洞证明： http://www.discuz.net/api/db/dbbak.php?apptype=1%22%3E%3Cscript%3Ealert1%3C/script%3E%3C%22...

Discuz！7.2/X1 第三方插件SQL注入及持久型XSS漏洞

简要描述： Discuz！7.2/X1 第三方插件SQL注入及持久型XSS漏洞。 SQL注入比较鸡肋，要求GPC为off（目前这样的网站几乎绝版了） XSS因为是持久型的，只要管理员打开此应用即会触发。利用XSS怎么操作就见仁见智了。 详细说明： 由Discuz！认证的（http://addons.discuz.com/workroom.php）第三方开发团队“潮流少年工作室 Teen Studio”出品的心情墙插件（http://www.discuz.net/forum.php?mod=viewthread&tid=1632898），因变量未初始化及过滤不严导致SQL注入及跨站脚本漏洞...

Discuz! 7.x/6.x论坛绕过全局变量防御漏洞

Discuz!是一款华人地区非常流行的Web论坛程序。 由于php5.3.x版本php.ini的设置中requestorder默认值为GP，导致Discuz! 6.x/7.x中可以绕过全局变量防御。 在include/global.func.php代码中： function daddslashes$string, $force = 0 !defined'MAGICQUOTESGPC' && define'MAGICQUOTESGPC', getmagicquotesgpc; if!MAGICQUOTESGPC || $force ifisarray$string foreach$stri...

Discuz! 6. x/7. x a global variable Defense bypass vulnerability-vulnerability warning-the black bar safety net

Due to php5. 3. x version php. ini settings requestorder the default value for the GP, resulting in Discuz! 6. x/7. x a global variable Defense bypass vulnerability include/global. func. php code: function daddslashes$string, $force = 0 ! defined'MAGICQUOTESGPC' && define'MAGICQUOTESGPC',...

Discuz! 6.x/7.x 全局变量防御绕过漏洞

No description provided by source...

Discuz!NT 3.1.0 多处持久性跨站漏洞

Discuz!NT，是康盛创想北京科技有限公司旗下的一款功能强大的基于 ASP.net 平台的社区软件，包括论坛、Space 个人空 间、相册、聚合等功能，后台自由选择开启。 1.论坛相册空间日志发表评论，插入跨站语句即可： demo:http://nt.discuz.net/showphoto.aspx?photoid=42 2. 在论坛板块版面出随意选择一种浏览方式，然后修改或添加加入跨站语句，获得地址：...

PowerEasy 2006 Cross Site Scripting

PowerEasy is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the...

discuz X demo experience package XSS cross-site vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability file: source\function\directory most of the files filter is not strict Vulnerability testing:scriptalert/qing DISCUZ x test vulnerability/ Non-secure test the demo: http://fabu.coffly.com/home.php?mod=space&uid=1&do=profile...

Discuz! NT 3.0.0 background get WEBSHELL-vulnerability warning-the black bar safety net

http://test.com/admin/global/globaltemplatesedit.aspx?path=../&filename=index. aspx&templateid=1&templatename=Default Directly put your horse written in the forum index. aspx Or is the other file. path=../&filename=index. aspx But remember to get the SHELL to put the family file to restore it. Th...