Code Execution Vulnerability in ESPCMS

ESPCMS is an enterprise website management system built on LAMP development. A code execution vulnerability exists in ESPCMS. An attacker can exploit this vulnerability to execute arbitrary php statements...

ESPCMS csrf vulnerability to cause the arbitrary administrator to add

No description provided by source...

ESPcms latest version has http header XSS vulnerability

ESSENCE ESPCMS website management system based on LAMP development and construction of the website management system. An http header XSS vulnerability exists in the latest version of ESPcms. The attacker triggers the cross-site vulnerability by modifying the Referer value to cross-site code...

Reflective Cross-site Scripting Vulnerability in ESPCMS Enterprise Web Management System V6.7.17.04.05

ESPCMS enterprise website management system is based on LAMP development and construction of enterprise website management system. A reflective cross-site scripting vulnerability exists in the search box of the ESPCMS enterprise website management system. The vulnerability allows attackers to...

ESPCMS has a database file download vulnerability

ESSENCE ESPCMS website management system based on LAMP development and construction of the website management system. ESPCMS has a database file download vulnerability. Due to logging into the background and clicking upgrade, the system will automatically backup the database data, the backup file...

ESPCMS File Download information disclosure vulnerability

No description provided by source...

ESPCMS V6 Backend SQL Injection Vulnerability

ESPCMS enterprise website management system based on LAMP development and construction of enterprise website management system, it is simple, powerful, stability, scalability and security, secondary development and late maintenance is convenient, can help you quickly and easily build a powerful a...

ESPCMS在adminsoft\control\citylist.php 存在SQL注入漏洞

No description provided by source...

espcms最新版V6.4.15.08.25任意用户登录漏洞

No description provided by source...

Seemingly tasteless ESPCMS background injected, can actually be a lot of fun-vulnerability warning-the black bar safety net

Yesterday, the black bar safety net loophole platform exposes a ESPCMS of injection vulnerabilities, Ali cloud computing security attack and defense against a team of friends first time on the vulnerability to do an impact assessment. Did not think need to login to the backend before it can be...

Espcms v5.0 /index.php SQL注入漏洞

构造www.xxx.cc/index.php?ac=search&at=taglist&tagkey=%2527,tags orselect 1 fromselect count,concatselect select concat0x7e,0x27,tablename,0x27,0x7e from informationschema.tables where tableschema=database limit 0,1,floorrand02x from informationschema.tables group by xa%23...

espcms最新版两处高危SQL注入漏洞附分析(遗漏未修复)

简要描述： 绝对是最新版本！ 版本信息：V6.4.15.08.25 UTF8 正式版 更新时间：2015-08-25 12:29:04 软件大小：7.67MB 25号更新的，有两处高危注入没有修复 详细说明： 第一处在 在enquiry.php中 $ptitle = $this-fun-accept'ptitle', 'P'; $tsn = $this-fun-accept'tsn', 'P'; $did = $this-fun-accept'did', 'P'; if empty$did || empty$amount || empty$ptitle $enquirylink =...

espcms最新版sql注入漏洞附分析

简要描述： 版本信息：V6.4.15.05.20 UTF8 正式版 更新时间：2015-05-21 00:05:12 软件大小：7.67MB 详细说明： 在enquiry.php中 $ptitle = $this-fun-accept'ptitle', 'P'; $tsn = $this-fun-accept'tsn', 'P'; $did = $this-fun-accept'did', 'P'; if empty$did || empty$amount || empty$ptitle $enquirylink = $this-getlink'enquiry', array,...

ESPCMS V6 /interface/memebermain.php 登录绕过漏洞

No description provided by source...

espcms sql注入漏洞

简要描述： 刚刚看了 espcms的官网 发现2014-09-16 16:58:17更新了,下了份看下，发现这上面的几个漏洞完全没修复啊..上次提交了个漏洞只给了5rank..敢给多点么.这次和上次那个相似,怕你们只修复一处,这处也提交下。 详细说明： 在order.php inordersave中 365-367行附近 foreach $did as $key = $value $value = intval$value; $oprice$key = floatval$oprice$key; $bprice$key = floatval$bprice$key;...

espcms最新版本CSRF直接getshell

简要描述： espcms 最新版本csrf 直接getshell 详细说明： 这里我们首先看看，存在的代码问题 management.php:lines:711-741: function onsetsave $dbtable = dbprefix . 'config'; $commandfile = adminROOT . 'datacache/command.php'; if !$this-fun-filemode$commandfile exit'false'; $oldishtml = $this-CON'ishtml'; $sql = 'SELECT FROM '...

ESPCMS 全版验证码破解验证码等于虚设（可导致爆破等附解密exp）

简要描述： ESPCMS 全版！验证码破解！验证码等于虚设（可导致爆破等） 详细说明： 先看验证码生成的方法！只是生成了一个6位随机数 然后加密保存到cookie中！关键点在于加密函数eccode 竟然采用的是默认的key $fun = new functioninc; $seccode = rand100000, 999999; $secode = $fun-accept'secode', 'R'; if $secode == 'ecispseccode' $secodename = 'ecispseccode'; else $secodename =...

ESPCMS_csrf利用后台sql注射getshell

简要描述： 这两天再写csrf的一些东西，所以拿了ESPCMS做了一个演示，这里只是其中一个意外发现，后续还有csrf更狠的地方，总之一句话漏洞利用是一门艺术，我会提供一个csrf另外一种思路去让管理员只交互一次，然后轻松拿下站点shell，就我分析应该各大cms，都可以按照这个思路去做！！！ 详细说明： 好了 废话不多说了 首先我们安装完毕espcms 然后登录到后台 问题就出在了，上传证书这一块，直接看代码， adminsoft/control/management.php:lines:802-815 if !fileexists$filetmpname $isupfiletrue ...

ESPCMS 6.0 /interface/enquiry.php SQL注入漏洞

No description provided by source...

易思ESPCMS sql注入（demo成功）

简要描述： rt V6.0.14.07.07 UTF8 详细说明： 看了大牛们提交的 WooYun: ESPCMS最新 V5.8.14.03.03 UTF8 正式版暴力注入 下了最新版来看看，发现 加密函数 还是老样子啊- - 不过 ，查询换成 了 id 而不是 username了， 但是 id 是 intval的。 function membercookieview$keyword = false $retrunstr = array; $retrunstr'username' = $this-fun-eccode$this-fun-accept'ecispmemberusername...