27 matches found
CVE-2015-20128
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/Cityajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sysCi...
EUVD-2015-9432
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/Cityajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sysCi...
CVE-2015-20128 FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/Cityajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sysCi...
CVE-2015-20128
FooSun DotNetCMS 1.0 and 2.0 are affected by an SQL injection vulnerability. The flaw resides in the CityId parameter, where unauthenticated attackers can send GET requests to /user/City_ajax.aspx containing UNION SELECT payloads. Because the input is concatenated unsanitized into the sys_City qu...
CVE-2015-20128: Improper Neutralization of Special Elements used in an SQL Command
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/Cityajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sysCi...
FooSun DotNetCMS SQL injection vulnerability
FooSun DotNetCMS versions 1.0 and 2.0 contain an SQL injection vulnerability. This vulnerability arises because the CityId parameter is concatenated into the sysCity query without proper sanitization, potentially allowing unauthenticated attackers to extract database information...
VulnCheck KEV: CVE-2015-20128
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/Cityajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sysCi...
PT-2026-118682
Name of the Vulnerable Software and Affected Versions FooSun DotNetCMS versions 1.0 through 2.0 Description An SQL injection flaw allows unauthenticated attackers to manipulate MSSQL queries. By sending GET requests to the '/user/City ajax.aspx' endpoint with UNION SELECT payloads in the CityId...
XSS Vulnerability in FoosunCMS
FoosunCMS content management system FoosunCMS is a content management software based on ASP + ACCESS/MSSQ framework, a domestic open source, integrated web2.0 elements, modular CMS station-building system. FoosunCMS has a stored cross-site scripting vulnerability. Attackers can insert malicious j...
FoosunCMS SQL Injection Vulnerability
FoosunCMS is a content management software based on ASP+ACCESS/MSSQ architecture. FoosunCMS version 1.0 to 2.0 has a SQL injection vulnerability, because the system does not filter the CityId parameter. Allow attackers to exploit the vulnerability to obtain sensitive information in the database...
Foosun CMS v4. 0 /user/SetNextOptions. asp parameters ReqSql SQL injection vulnerability
No description provided by source...
Foosun cms .net版本 City_ajax.aspx 参数 id SQL注入漏洞
0x01漏洞简介 Foosun cms .net版本在/user/Cityajax.aspx对参数Cityid过滤不严格，导致出现SQL注入漏洞。远程攻击者可以利用该漏洞执行SQL指令，获取敏感信息。 0x02漏洞详情 SQL注入漏洞：/user/Cityajax.aspx?Cityid=1 http://.../user/Cityajax.aspx?Cityid=1 数据和用户 0x03修复方案 过滤，或者使用参数化的SQL语句。...
风讯(foosun)CMS .net版本 /user/City_ajax.aspx 文件 Cityid 参数SQL注入漏洞
No description provided by source...
风讯(FooSun) stat.aspx页面存在SQL注入漏洞
No description provided by source...
FooSun Api_Response.ASP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/26552/info FooSun is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...
Foosun 4.0 user/setnextoption.asp SQL注入漏洞
No description provided by source...
风讯（FooSun）SetNextOptions.asp 注入漏洞
风讯网站内容管理系统,现代企业构建自己的门户信息网站将单一的展示转向多类型信息交互层面的web应用程序,自由、开源的设计理念能让你构架出任意风格的网络平台 风讯foosun的注册文件存在漏洞 可以自己读取到管理员帐号和密码。 漏洞文件：/user/SetNextOptions.asp FooSun 5.0 暂无 等待官方补丁 http://www.foosun.net/ 管理员帐号：...
foosun 0day latest injection vulnerability-vulnerability warning-the black bar safety net
Wind noise foosun of the registration document the presence of vulnerabilities. Hackers can storm the administrator account and password. Vulnerability file: www.xxx.com/user/SetNextOptions.asp Using a simple method: Storm administrator account:...
foosun the latest SQL injection vulnerability squib administrator account password-loophole warning-the black bar safety net
foosun latestSQL injectionvulnerability squib administrator account password Wind noise foosun of the registration document the presence of vulnerabilities. Hackers can storm the administrator account and password. Vulnerability file: http://www.xxxx.com/user/SetNextOptions.asp Using a simple...
风讯(FooSun)favorite.asp页面存在越权漏洞(2)
在文件\User\ favorite.asp中： Elseif Request"Action"="sort" Then //第21行 if Request"id"="" Or Request"classID"="" then strShowErr = "li错误的参数！/li" Response.Redirect"lib/error.asp?ErrCodes="&Server.URLEncodestrShowErr&"&ErrorUrl=" Response.end Else UserConn.execute"Update FSMEFavorite set...