博云非书资料管理系统SQL注入

简要描述： JSP+MSSQL，能搜到的使用该系统的网站不多，但多为大学学院使用 详细说明： 注入点: http://211.68.196.67:808/poweb/asearch.do?LanguageType=0&status=showpage 参数:LanguageType C:\Python27\sqlmapsqlmap.py -u "http://211.68.196.67:808/poweb/asearch.do?Langu ageType=0&status=showpage" --dbms=mssql sqlmap/1.0-dev - automatic SQL...

IBM WebSphere Portal Unspecified JSP XSS (PI16040)

The version of IBM WebSphere Portal on the remote host is affected by an unspecified cross-site scripting vulnerability due to improper user input validation by a JSP script. An attacker can exploit this issue to execute code in the security context of a user's browser to steal authentication...

IBM WebSphere Portal Web Content Viewer Portlet Privilege Escalation (PI15723)

The version of IBM WebSphere Portal on the remote host is affected by a privilege escalation vulnerability in the Web Content Viewer portlet due to improper handling of JSP includes. A remote attacker is able to obtain sensitive information, cause a denial of service, or control the request...

CVE-2014-0954

CVE-2014-0954 affects IBM WebSphere Portal versions 6.1.0.x (6.1.0.6 CF27 and 6.1.5.x CF27), 7.0.x (up to 7.0.0.2 CF28), and 8.0 prior to 8.0.0.1 CF12. The issue is that JSP includes are not validated, which can let remote attackers obtain sensitive information, bypass request-dispatcher access r...

大汉版通政府信息公开系统SQL注射2

简要描述： SQL 详细说明： 政府信息公开系统 某处sql注射漏洞 另一个文件里的参数 注入点 zfxxgk/serviceobjectinfo.jsp?servicebm= servicebm过滤不严存在注射 政府网站案例 sqlmap.py -u "http://xxgk.sihong.gov.cn/zfxxgk/serviceobjectinfo.jsp?s ervicebm=" --is-dba --dbs --- Place: GET Parameter: servicebm Type: boolean-based blind Title: AND boolean-based...

大汉版通政府信息公开系统SQL注射

简要描述： 政府信息公开系统 详细说明： 政府信息公开系统 某处sql注射漏洞 注入点 zfxxgk/subjectinfo.jsp?subjectbm= subjectbm参数过滤不严，导致注入 政府网站案例 sqlmap.py -u "http://xxgk.sihong.gov.cn/zfxxgk/subjectinfo.jsp?subjectbm=" --is-dba --dbs payload Place: GET Parameter: subjectbm Type: boolean-based blind Title: AND boolean-based blind -...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[ANN] Struts 2.3.16.2 GA release available - security fix

The Apache Struts group is pleased to announce that Struts 2.3.16.2 is available as a "General Availability" release.The GA designation is our highest quality grade. Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework is designed ...

Apache Struts ClassLoader Manipulation Remote Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Apache Struts ClassLoader Manipulation Remote Code Execution', 'Description' = %q This module exploits a remote command execution...

RHEL 6 : tomcat6 (RHSA-2014:0429)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0429 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was found that when Tomcat processed a...

PT-2014-4798 · Sonicwall · Sonicwall Network Security Appliance

Name of the Vulnerable Software and Affected Versions: SonicWall Network Security Appliance NSA 2400 Description: The issue is related to a cross-site scripting XSS vulnerability in the Dashboard Backend service, specifically in the stats/dashboard.jsp component. This vulnerability allows remote...

金蝶官网两处SQL盲注漏洞

简要描述： SQL注入 详细说明： 1.http://cms.kingdee.com/solutions/business/manufacture/manufactureCaseList.jsp?columnId=150201301401,150202301401,150202302401,150202303401 2.http://cms.kingdee.com/solutions/business/scm/scmCaseList.jsp?columnId=151201301,151202301 漏洞证明： Place: GET Parameter: columnId Type:...

Ganib 2.3 SQL Injection

Exploit title: Ganib 2.x SQLi Date: 02/02/2014 Exploit author: drone @dronesec More information: http://hatriot.github.io/blog/2014/02/24/ganib-project-management-2.3-sqli/ Vendor homepage: http://www.ganib.com/ Software link:...

HP LoadRunner Virtual User Generator EmulationAdmin Directory Traversal (CVE-2013-4837)

Multiple directory traversal vulnerabilities exist in HP LoadRunner. These vulnerabilities are due to a lack of input validation on SOAP requests, specifically, the copyFileToServer and the getFileContentAsLines operations of the EmulationAdmin web service. Unauthenticated remote attackers could...

Ganib Project Management 2.3 - SQL Injection

Exploit title: Ganib 2.x SQLi Date: 02/02/2014 Exploit author: drone @dronesec More information: http://forelsec.blogspot.com/2014/02/ganib-project-management-23-multiple.html Vendor homepage: http://www.ganib.com/ Software link:...

Apache Commons FileUpload and Apache Tomcat - Denial of Service

Apache Commons FileUpload and Apache Tomcat - Denial of Service CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service Author: Oren Hafif, Trustwave SpiderLabs Research This is a Proof of Concept code that was created for the sole purpose of assisting system administrators in...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

大汉版通JIS统一身份认证系统后台文件另一处上传漏洞

简要描述： 一处有点奇葩的文件上传……………… 详细说明： 关键点：找到路径、绕过某个无聊的if判断。需要管理员权限 漏洞证明： jis/manage/sys/oprlogo.jsp String strLoadPath = request.getSession.getServletContext.getRealPath"/front"; Convert.createDirectory strLoadPath + "/tmp/" ; CommonUploadFile upload = new CommonUploadFile strLoadPath +"/tmp", "";...