TinyShop v1.0.1 SQL注射 可致数据库信息泄露

简要描述： TinyShop v1.0.1 SQL注射 可致数据库信息泄露（官网演示+源码分析） 无视gpc 详细说明： /protected/controllers/ajax.php //团购结束更新 public function groupbuyend $id = Req::args'id'; //取得id if$id $item = $this-model-table"groupbuy"-where"id=$id"-find; //无视GPC，直接带入查询 $enddiff = time-strtotime$item'endtime'; if$enddiff0...

74cms某功能注入漏洞（有条件）

简要描述： 略鸡肋,分享出来。 详细说明： 最新版v3.4，更新时间20140310 文件/plus/weixin.php responseMsg函数，使用 $postStr = $GLOBALS"HTTPRAWPOSTDATA"; 获得了post数据。所以，可以无视GPC。 获得的数据是XML格式，我们一会发送数据包即可。 继续看该函数： if !empty$postStr $postObj = simplexmlloadstring$postStr, 'SimpleXMLElement', LIBXMLNOCDATA; $fromUsername =...

DEDECMS full version disregard for GPC injection exp-vulnerability warning-the black bar safety net

? php printr " +------------------------------------+ DEDECMS full version disregard for GPC injection code by :Sunshie Usage:$argv0 domain Example: php.exe$argv0 www.phpinfo.me +------------------------------------+ " ; if$argv1=="" exit"do not tease than we're still good friends"; else...

Ecmall 2.3.0本地文件包含漏洞

简要描述： 文件包含，受到gpc和php版本限制 详细说明： 漏洞文件：admin/app/plugin.app.php 思路来源于： WooYun: Ecmall 2.3 File Inclusion Vulnerability（鸡肋） function getplugininfo$id //id参数存在文件包含漏洞 $plugininfopath = ROOTPATH . '/external/plugins/' . $id . '/plugin.info.php'; return include$plugininfopath;...

RHEL 5 : php53 (RHSA-2013:1307)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1307 advisory. - php: paths with NULL character were considered valid CVE-2006-7243 - PHP: sapiheaderop %0D sequence handling security bypass CVE-2011-1398...

php: PG(magic_quote_gpc) was not restored on shutdown

PHP before 5.3.10 does not properly perform a temporary change to the magicquotesgpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/phpvariables.c, sapi/cgi/cgimain.c, and...

织梦内容管理系统(DedeCms) 小说模块insert注入漏洞

DedeCms是免费的PHP网站内容管理系统。 织梦内容管理系统DedeCms 以简单、实用、开源而闻名，是国内最知名的PHP开源网站管理系统，也是使用用户最多的PHP类CMS系统。 在gpc=off的情况下，小说模块添加章节insert注入漏洞。 0 Dedecms 厂商补丁： dedecms ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.dedecms.com/products/dedecms/...

PHPCMS v9.3.4 content.php SQL注入漏洞

PHPCMS全版本通杀SQL注入漏洞,测试版本为V9.5.3版本，2014-05-12之前的 存在漏洞的文件/phpcms/modules/member/content.php 202行 edit函数 $info = array; foreach$POST'info' as $k=$v ifinarray$k, $fields $POST'info'$k = newhtmlspecialcharstrimscript$v; $POST'linkurl' = strreplacearray'"','','',",",'...

ShopEx4. 8 5 the latest version SQL injection-vulnerability warning-the black bar safety net

ShopEx4. 8 5 the latest versionof SQL injection, no need to login, through the GPC, you can directly query the administrator password and echo What not to say, directly on the use of the code, The following html is saved as a html file, change the localhost portion of the site's real address: for...

Destoon B2B建站软件最新版SQL盲注漏洞

简要描述： Destoon B2B建站存在SQL注入漏洞（已经打了20130703补丁） 详细说明： /module/mall/buy.inc.php 这个文件，除了已经修复了的知道创宇上报的那个注入点，还存在其他注入点。 if$submit require DTROOT.'/module/'.$module.'/cart.class.php'; $do = new cart; $cart = $do-get; if$post $add = arraymap'trim', $add; $add'address' = areapos$add'areaid', ''.$add'address...

phpcms 2007 onunload.inc.php update SQL注入漏洞

code!--?php defined'INPHPCMS' or exit'Access Denied'; $serverid ? 1 : showmessage$LANG'illegaloperation'; $db---query"UPDATE ".TABLEMOVIESERVER." SET num = num-1 WHERE serverid = $serverid AND num 0 "; 2 ?/code $serverid没有进行任何过滤也没有用单引号括起来，所以无视gpc。 核心文件include\common.inc.php里大概80左右变量覆盖漏洞。...

ecshop最新2.7.3版本后台本地包含漏洞

简要描述： ecshop最新2.7.3版本后台本地包含漏洞 详细说明： admin/integrate.php文件，110行 $code = empty$GET'code' ? '' : trim$GET'code'; if empty$code || fileexistsROOTPATH . DATADIR . '/integrate' . $code . 'log.php' sysmsg$LANG'lostintalllog', 1; includeROOTPATH . DATADIR . '/integrate' . $code . 'log.php'; 1. $code 未过滤 ...

PHP-Fusion Authenticate.class.php Multiple Cookie SQL Injection

The version of the PHP-Fusion installed on the remote host is affected by a SQL injection vulnerability because it fails to properly sanitize user input to the 'user' and 'admin' cookies upon submission to the application. An unauthenticated, remote attacker could leverage this issue to launch a...

ClipShare 4.1.4 SQL Injection / Plaintext Password Vulnerabilities

ClipShare version 4.1.4 suffers from remote blind SQL injection and plaintext password vulnerabilities. ===================================================================== Vulnerable Software: ClipShare - Video Sharing Community Script 4.1.4 Official site: http://www.clip-share.com Software...

Espcms 通杀 SQL注入漏洞

漏洞在interface/search.php 文件和interface/3gwapsearch.php文件intaglist函数都存在，一样的问题，以 interface/search.php为例说明： codefunction intaglist parent::startpagetemplate; includeonce adminROOT . 'public/classpagebotton.php'; $page = $this-fun-accept'page', 'G'; $page = isset$page ? intval$page : 1; $lng = adminLNG...

DedeCMS member center classification management SQL injection 0day vulnerabilities can be obtained the administrator password-vulnerability warning-the black bar safety net

Need magicquotesgpc = Off,so that is tasteless. Occurs in the array key where the injection vulnerability,a little mean. Here is blind,is the trouble point can also use,you can write a tool,automated attendant ran about http://www.xxx.com /dede/member/mtypes. php? dopost=save Trojan: mtypename7'...

Newscoop 4.0.2 Blind SQLi & Path Disclosure Vulnerabilities

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Newscoop 4.0.2 Path Disclosure / SQL Injection

================================================================================ Vulnerable Software: Newscoop 4.0.2 Official site: sourcefabric.org Vulnerabilities: Blind SQLi & Path Disclosure Condition to exploit this vulnerability: GPC must be set OFF. Discovered by: AkaStep && KASIBOGLAN...

CVE-2010-5281

CMScout 2.09 IBrowser TinyMCE Plugin 1.4.1 is affected by a directory traversal in ibrowser.php. When magic_quotes_gpc is disabled, an attacker can read arbitrary files by injecting a .. into the lang parameter. This is a true vulnerability with CVE-2010-5281 documented by NVD (base score 6.8, ve...

dedecms5. 7 latest sql injection exploit guestbook. php-vulnerability warning-the black bar safety net

Impact version 5. 7 Vulnerability file edit. inc. php specific code: ExecuteNoneQuery" DELETE FROM @guestbook WHERE id='$id' "; ShowMsg"successfully deleted a message!", $GUESTBOOKPOS; exit; else if$job=='check' && $gisadmin $dsql-ExecuteNoneQuery" UPDATE @guestbook SET ischeck=1 WHERE id='$id' "...