14 matches found
MetInfo SQL Injection Vulnerability (CNVD-2021-51805)
Metinfo MetInfo is a content management system CMS developed by China Mito Metinfo using PHP and Mysql. A SQL injection vulnerability exists in getpassword.php in Metinfo 7.0.0beta, which arises from a database-based application that lacks validation of externally entered SQL statements. An...
CVE-2020-21133
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid...
Sql injection
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid...
CVE-2020-21133
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid...
CVE-2020-21133: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid...
CVE-2020-21342
Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php...
Default credentials
Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php...
CVE-2020-21342
CVE-2020-21342 affects the zzcms web application (version 201910). The issue is an insecure permissions weakness in the password reset flow, specifically via /one/getpassword.php, allowing an attacker to reset any user password. Root cause described as improperly designed or implemented code for ...
PT-2021-10612
Name of the Vulnerable Software and Affected Versions: zzcms version 201910 Description: The issue is related to insecure permissions, allowing the reset of any user's password via the /one/getpassword.php endpoint. Recommendations: For zzcms version 201910, consider restricting access to the...
CVE-2020-21342: Incorrect Default Permissions
Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php...
PT-2019-6265
Name of the Vulnerable Software and Affected Versions Metinfo version 7.0.0 beta Description The issue is related to a SQL Injection vulnerability in the member/getpassword.php file, specifically when the lang parameter is set to cn and the a parameter is set to dovalid. This vulnerability is due...
zzcms 8.2 任意用户密码修改
zzcms 8.2 任意用户密码修改 漏洞描述 zzcms是一款企业建站程序。 zzcms 8.2版本/one/getpassword.php文件存在漏洞，攻击者可利用该漏洞修改任意用户密码。 漏洞分析 /one/getpassword.php文件第 73行，触发漏洞的关键代码。 elseif$action=="step3" && @$SESSION'username'!='' $passwordtrue = isset$POST'password'?$POST'password':""; $password=md5trim$passwordtrue; query"update...