Unrestricted file upload

Unrestricted file upload vulnerability in attachement.php in HDWiki 5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in image directory...

CVE-2011-5076

SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php. NOTE: some of these details are obtained from third party information...

CVE-2011-5076

SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php. NOTE: some of these details are obtained from third party information...

CVE-2011-5077

Vulnerability : HDWiki 5.0 contains an unrestricted file upload in attachement.php that lets remote attackers execute arbitrary code by uploading a file with an executable extension and retrieving it from the image directory. Root cause : improper validation/handling of uploaded files enabling ar...

CVE-2011-5076

The CVE-2011-5076 entry describes an SQL injection in HDWiki’s model/comment.class.php for HDWiki 5.0/5.1 (and possibly other versions), exploitable via PATH_INFO to index.php, allowing remote execution of arbitrary SQL commands. Root cause: unsafe SQL construction in the affected file. Documents...

Hudong HDWiki 5.1 URI SQL注入漏洞

hdwiki是互动百科开发的一款免费建站，自助建站程序 HDWIKI V5.0 基本上没有对输入的变量进行过滤,存在多个sql注入漏洞，如发表评论的地方存在代码注入问题 另外HDwiki中某些上传功能存在安全漏洞，通过一些数据即可绕过上传限制，最终获得shell 0 HDWiki 5.1 厂商解决方案 目前没有详细解决方案提供： http://kaiyuan.hudong.com/ POST /hdwiki/index.php?attachment-uploadimg HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg,...

HDWIKI tasteless 0day-vulnerability warning-the black bar safety net

Author: thanks Blog: http://hi.baidu.com/thanks4sec Release date: 2011-10-10 HDWIKI official website: http://kaiyuan.hudong.com/ Affected versions: HDWIKI all ----------------------------------- Looking for a long did not find echo, but tasteless so made a Have thought better of using the method...

HDwiki文件上传导致远程代码执行漏洞

简要描述： 互动维客开源系统（HDwiki）作为中国第一家拥有自主知识产权的中文维基（Wiki）系统，由互动在线（北京）科技有限公司于2006 年11月28日正式推出，力争为给国内外众多的维基（Wiki）爱好者提供一个免费、易用、功能强大的维基（Wiki）建站系统。HDwiki的推出，填补了中文维基（Wiki）建站系统的空白 但是HDwiki中某些上传功能存在安全漏洞，通过一些数据即可绕过上传限制，最终控制远程站点 详细说明： lib/file.class.php中 function uploadfile$attachment,$target,$maxsize=1024,$isimage...

HDWiKi V 5.0 local include vulnerability 0Day-vulnerability warning-the black bar safety net

Release date: 2011-01. 2 3 Publishing author: HYrz Affected versions: HDWiKi V 5.0 Official website: http://kaiyuan.hudong.com Vulnerability type: a file that contains Vulnerability description: From the source code see there is indeed a problem,we just Upload a picture of the Trojan can be norma...

HDWiKi V 5.0 local contains 0Day-vulnerability warning-the black bar safety net

| 漏洞 文件 :\install\install.php Key code: ? php errorreportingEERROR | EWARNING | EPARSE; define'INHDWIKI', TRUE; define'HDWIKIROOT', '../'; $langname=$COOKIE'langname';/langname without any filter,direct from the Cookies deposited in langname/ ifisset$REQUEST'lang' / Detect whether the variable is...

HDWiki Encyclopedia program background Getshell vulnerabilities-vulnerability warning-the black bar safety net

HDWiki using the template mechanism, the template is compiled will be saved to the data/view directory for php files, after the show template and the include it, Cause you can get a webshell Vulnerability code in lib/template. class. php file: function display$file//show the template by...

HDWiki-V4. 0. 5 proof 0day cross site vulnerability-vulnerability warning-the black bar safety net

Effects: the HDWiki-V4. 0. 5 Degree of harm: high-risk Vulnerability description: Ann-day lab Safety research and Emergency Response Center of Antiy CERT by penetration testing found the HDWiki-V4. 0. 5 This version in the Create and edit entries, for inside the HTML element does not have very go...

Quick search hdwiki a code execution vulnerability-vulnerability warning-the black bar safety net

By q1ur3n http://www.wolvez.org/ 2008-11-14 Talk about the process now,of course,such a hole is very low, is purely for everyone's entertainment.: Installed hdwiki after I registered for a named testtest to the user, and then cmd next cd to hdwiki directory, execute findstr /s /i /n "testtest"...