Command Execution Vulnerability in Kingdee KIS Flagship Edition of Kingdee Software Ltd.

Kingdee KIS is an ERP software. A command execution vulnerability exists in Kingdee KIS Flagship Edition of Kingdee Software Limited, which can be exploited by an attacker to gain server control privileges...

Kingdee KIS Professional Edition has a power lifting vulnerability

Kingdee KIS is an ERP software, ERP system integrates supply chain management, financial management, human resource management, customer relationship management, office automation, business analysis, mobile commerce, integrated interfaces and industry plug-ins and other business management...

openSIS 7.4 Local File Inclusion

-------------------------------------------------------------- openSIS = 7.4 Bottom.php Local File Inclusion Vulnerability -------------------------------------------------------------- - Software Link: https://opensis.com/ - Affected Versions: Version 7.4 and prior versions. - Vulnerability...

openSIS 7.4 Incorrect Access Control

------------------------------------------------------- openSIS = 7.4 Incorrect Access Control Vulnerabilities ------------------------------------------------------- - Software Link: https://opensis.com/ - Affected Versions: Version 7.4 and prior versions. - Vulnerabilities Description: The...

SuiteCRM 7.11.11 Broken Access Control / Local File Inclusion

------------------------------------------------------------------------------ SuiteCRM = 7.11.11 addtoprospectlist Broken Access Control Vulnerability ------------------------------------------------------------------------------ - Software Link: https://suitecrm.com/ - Affected Versions: Versio...

SuiteCRM 7.11.11 Bean Manipulation

-------------------------------------------------------------------------- SuiteCRM = 7.11.11 actionsaveHTMLField Bean Manipulation Vulnerability -------------------------------------------------------------------------- - Software Link: https://suitecrm.com/ - Affected Versions: Version 7.11.11...

SuiteCRM 7.11.11 Phar Deserialization

----------------------------------------------------------------- SuiteCRM = 7.11.11 Multiple Phar Deserialization Vulnerabilities ----------------------------------------------------------------- - Software Link: https://suitecrm.com/ - Affected Versions: Version 7.11.11 and prior versions. -...

SuiteCRM 7.11.10 SQL Injection

---------------------------------------------------------- SuiteCRM = 7.11.10 Multiple SQL Injection Vulnerabilities ---------------------------------------------------------- - Software Link: https://suitecrm.com/ - Affected Versions: Version 7.11.10 and prior versions. - Vulnerabilities...

SugarCRM WorkFlow PHP Code Injection

----------------------------------------------------------- SugarCRM WorkFlow module PHP Code Injection Vulnerability ----------------------------------------------------------- - Software Link: http://www.sugarcrm.com - Affected Versions: All versions prior to 7.9.4.0 and 7.11.0.0. - Vulnerabili...

Important: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

An update is now available for CloudForms Management Engine 5.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

PEAR HTML_AJAX <= 0.5.7 (PHP Serializer) PHP object injection vulnerability

Software Link: https://pear.php.net/package/HTMLAJAX Affected Versions: All versions from 0.3.0 to 0.5.7. Vulnerability Description: The vulnerable code is located within the HTMLAJAXSerializerPHP class defined into the /AJAX/Serializer/PHP.php script. Such a class uses the unserialize PHP functi...

SugarCRM 6.5.23 - REST PHP Object Injection Exploit (Metasploit)

Exploit for php platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'SugarCRM REST Unserialize PHP Code Execution', 'Description' = %q This...

IPS Community Suite 4.1.12.3 - PHP Code Injection

IPS Community Suite 4.1.12.3 - PHP Code Injection --------------------------------------------------------------------------- IPS Community Suite contentclass ; 39. 40. if ! classexists $class or ! inarray 'IPS\Content', classparents $class 41. 42. \IPS\Output::i-error 'nodeerror', '2S226/2', 404...

SugarCRM 6.5.18 PHP Code Injection

--------------------------------------------------------- SugarCRM $val 104. $str.= overridevaluetostringrecursive2$newArrayName, $key, $val, $saveempty; 105. 106. return $str; 107. else 108. if!$saveempty && empty$value 109. return; 110. else 111. return "$$arrayname" . "'$valuename' = "...

ATutor 2.2 PHP Code Injection

--------------------------------------------------------------- ATutor "name" 186. 187. $sort = '$grades'.$ordercol.', SORT'.strtoupper$order.', $selectedstudents ... 188. 189. foreach$selectedtests as $test 190. 191. if $test"gradebooktestid" $ordercol 192. $sort .= ',...

Piwik 2.14.3 PHP Object Injection

----------------------------------------------------------------------- Piwik = 2.14.3 DisplayTopKeywords PHP Object Injection Vulnerability ----------------------------------------------------------------------- - Software Link: https://piwik.org/ - Affected Versions: Version 2.14.3 and prior...

Piwik 2.14.3 Local File Inclusion

----------------------------------------------------------------------- Piwik = 2.14.3 viewDataTable Autoloaded File Inclusion Vulnerability ----------------------------------------------------------------------- - Software Link: https://piwik.org/ - Affected Versions: Version 2.14.3 and prior...

GetSimple CMS 3.3.4 XML External Entity Injection

------------------------------------------------------------------ GetSimple CMS adddata$in; User input passed via the "data" POST parameter is not properly sanitized before being used in a call to the "simplexmlloadstring" function at line 23. This can be exploited to carry out XML External Enti...

Mantis Bug Tracker 1.2.17 PHP Code Injection

----------------------------------------------------------------------------- Mantis Bug Tracker $newId 108. $bugData = bugget $newId, true ; 109. 110. $bugLinkRegexp = '/^|^\w' . pregquote $this-source-issuelink, '/' . '\d+\b/e'; 111. $replacement = '"\1" . $this-getReplacementString "\2", "\3"...

Tuleap PHP Unserialize Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Tuleap PHP Unserialize Code Execution', 'Description' = %q This module exploits a PHP object injection vulnerability in Tuelap...