easytalk两枚sql盲注

简要描述： easytalk两枚sql盲注 详细说明： 1.Home\Lib\Action\SearchAction.class.php第22行代码中 $keyword=urldecodetrimhtmlspecialchars$REQUEST'keyword'; keyword参数进行了urldecode操作。绕过全局gpc的过滤，导致注入。由于字符限制导致注入较为鸡肋 http://127.0.0.1/easytalk/?m=search&type=user&keyword=%2527and%20mid%28VERSION%28%29,1,1%29=5%23 可输出数据...

MODX Evolution 1.0.5 (and prior) Remote Script Execution Vulnerability

Product: MODX Evolution Risk: Very High Severity: Critical Versions: 1.0.5 and all previous releases Vunerability type: Remote Script Execution Report Date: 2012-Feb-16 Fixed Date: 2012-Feb-20 Description A vigilant community member sent us a security notice to let us know that he found a securit...