某管理系统通用型SQL注入

简要描述： 某管理系统通用型SQL注入 详细说明： 厂商：南京苏亚星资讯科技开发有限公司 资源库管理系统 搜索引擎关键字：帮助 正在读取数据... 注册用户 系统用户 用户名: 密码: 南京苏亚星资讯科技开发 有一部分是内网使用，好不容易找到5个案例。...

Microsoft IIS 7.5 Cross Site Scripting

Hello everyone, I found some weird HTML code injection in an IIS error message. IIS spits out some part of the user input that generated the error message, but will only display 20 characters at most. My question is: is it possible to actually exploit an XSS with this ? Here is an example: HTTP...

Microsoft IIS FTP Server Telnet IAC Buffer Overflow (CVE-2010-3972)

A heap buffer overflow vulnerability exists within the Microsoft Internet Information Services IIS FTP Service. The vulnerability is due to a memory corruption encountered when encoding Telnet IAC characters in a FTP response. A remote unauthenticated attacker may exploit this vulnerability by...

IIS discovered remote exploit code-exploit warning-the black bar safety net

IIS discovered remote exploit code. Yesterday Microsoft headquarters found to be APT hack Microsoft call engineer for overnight analysis, according to Microsoft trustworthy computing General Manager John revealed, a hacker may be by means of a Microsoft IIS server scored,the analysis may use...

Microsoft Internet Information Services Security Feature Bypass Vulnerability (2982998)

This host is missing an important security update according to Microsoft Bulletin MS14-076. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

CVE-2014-4078

The IP Security feature in Microsoft Internet Information Services IIS 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list, which makes it easier for remote attackers to bypass an intended rule set via an HTTP reques...

CVE-2014-4078

CVE-2014-4078 affects Microsoft Internet Information Services (IIS) 8.0 and 8.5. The vulnerability is in the IP Security feature, where wildcard rules in the IP Address and Domain Restrictions list are not properly processed, enabling a remote attacker to bypass the intended rule set via an HTTP ...

KLA10610 Security bypass vulnerability in Microsoft IIS

Improper wildcard processing was found in Microsoft IIS. By exploiting this vulnerability malicious users can bypass intended rules. This vulnerability can be exploited remotely via a specially designed HTTP request. Original advisories CVE-2014-4078 Related products...

某通用型校园校务系统SQL注入

简要描述： boom!!! 详细说明： 厂商：南京苏亚星资讯科技开发有限公司 校务系统输入任意用户名、密码，点击登录，报错的url存在注入漏洞 搜索引擎的案例如下： ErrorCode参数存在注入 http://www.sdwhys.com/SM2005/public/asp/ErrorMsg/ShowError.asp?ErrorCode=30004 http://www.zjnksyzx.com:8801/SM2005/public/asp/ErrorMsg/ShowError.asp?ErrorCode=30004...

Microsoft Exchange IIS HTTP Internal IP Address Disclosure

No description provided by source. Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange CAS 2007/2010/2013 Tested on: Exchan...

Microsoft Exchange IIS HTTP Internal IP Address Disclosure

Exploit for windows platform in category remote exploits Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange CAS...

Microsoft Exchange - IIS HTTP Internal IP Address Disclosure (Metasploit)

Microsoft Exchange - IIS HTTP Internal IP Address Disclosure Metasploit Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange...

Microsoft Exchange - IIS HTTP Internal IP Address Disclosure (Metasploit)

Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange CAS 2007/2010/2013 Tested on: Exchange OWA 2003, Exchange CAS...

Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure

Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange CAS 2007/2010/2013 Tested on: Exchange OWA 2003, Exchange CAS...

新云cms建站系统存在ewebeditor上传和iis解析漏洞可批量getshell

简要描述： 详细说明： 新云cms建站系统存在ewebeditor上传和iis解析漏洞，可批量getshell. 利用ewebeditor上传漏洞可以新建一个1.asp的文件夹，再配合iis的解析漏洞就可以成功的拿到shell. 可通过谷歌获得大量的漏洞网站，关键字如下： inurl:Showservices.asp?id= inurl:showkbxx.asp?id= None...

Kesion网校培训系统注入漏洞

简要描述： rt。 详细说明： kesion网校平台，商业收费版，不提供下载。 demo站点：http://e.kesion.com 注册登陆，http://e.kesion.com/user/course/MyCourseOrder.aspx，我的订单，3个框框都无过滤，可注入： 课程名称处search型注入：test%' and @@version0 and '%'=' SQL server 2000 起止时间也可以注入。 最新版应该是2.6，老版本的还有一处注入： 官网的一个案例：http://www.weekedu.com/...

方维团购4.3版本注射又一枚

简要描述： ..... 详细说明： ..... 漏洞证明： http://t1.fanwe.net:93/t1/index.php?m=Goods&a=showcate&id=46 Target: http://t1.fanwe.net:93/t1/index.php?m=Goods&a=showcate&id=46 Host IP: 112.124.32.200 Web Server: IIS Powered-by: WAF/2.0 Powered-by: WAF/2.0 DB Server: MySQL =5 Resp. Timeavg: 487 ms Compile OS: Win...

Shop7z sql注入1

简要描述： 详细说明： http://www.shop7z.com/Demo/orderprint.asp?id=1 17:09:55 INFO the back-end DBMS is Microsoft Access web server operating system: Windows 2003 or XP web application technology: ASP.NET, Microsoft IIS 6.0 back-end DBMS: Microsoft Access 17:09:55 INFO fetching tables for database:...

Netsparker v3.5 - Web Application Security Scanner

Netsparker Web Application Security Scanner can find and report web application vulnerabilities such as SQL Injection and Cross-site Scripting XSS and security issues on all web applications and websites regardless of the platform and the technology they are built on. Netsparker is very easy to u...

方维团购4.3版本注射 官方演示大量数据库泄露

简要描述： .......... 详细说明： ....... 漏洞证明： Target: http://t1.fanwe.net:93/t1/index.php?m=Ajax&a=gettypeattr&typeid=123 Host IP: 112.124.32.200 Web Server: IIS Powered-by: WAF/2.0 Powered-by: WAF/2.0 DB Server: MySQL Resp. Timeavg: 168 ms Current User: [email protected] Current DB: t1 Host Name:...