oBlog - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin Brute Force

------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip Author of this full disclosure: Milos Zivanovic Vulnerabilities: Persistant XSS, CSRF,...

oBlog Persistant XSS, CSRF, Admin Bruteforce

Exploit for unknown platform in category web applications ============================================ oBlog Persistant XSS, CSRF, Admin Bruteforce ============================================ -------------------------------------------------------------------------------------------------...

oBlog - Persistent Cross-Site Scripting Cross-Site Request Forgery Admin Brute Force

oBlog - Persistent Cross-Site Scripting Cross-Site Request Forgery Admin Brute Force ------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip...

oBlog Cross Site Scripting / Request Forgery

------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip Author of this full disclosure: Milos Zivanovic Vulnerabilities: Persistant XSS, CSRF,...

Oblog多用户博客程序strMonth变量过滤不严导致SQL注入漏洞

文件In/ClassUserCommand.asp : 1. strMonth=Request"month" //第63行 2. 3. strDay=Request"day" 4. 5. …… 6. 7. Case "month" //第84行 8. 9. Dim LastDay 10. 11. GPFileName = GPFileName & "month&month=" & strMonth 12. 13. strDay=LeftstrMonth,4 & "-" & RightstrMonth,2 & "-01" 14. 15. mYear=LeftstrMonth,4 16. 1...

Oblog多用户博客程序attachment.asp页面越权漏洞

oBlog多用户博客程序是目前国内应用最广泛的博客程序。OBLOG程序已经广泛应用在国内数万家网站，覆盖国内上千万上网人群，并经过上千家知名网站的严格检测，被称为国内博客建站第一程序oBlog多用户博客程序”是目前国内应用最广泛的博客程序。 漏洞文件：attachment.asp 1. !-- include file= inc/incsyssite.asp -- 2. % 3. Dim Path,rs,FileID,ShowDownErr,uid,fileext 4. Dim SQL 5. Path = TrimRequest path 6. FileID = TrimRequest...

CVE-2009-0283

Cross-site scripting XSS vulnerability in err.asp in Oblog allows remote attackers to inject arbitrary web script or HTML via the message parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in err.asp in Oblog allows remote attackers to inject arbitrary web script or HTML via the message parameter...

CVE-2009-0283

Cross-site scripting XSS vulnerability in err.asp in Oblog allows remote attackers to inject arbitrary web script or HTML via the message parameter...

CVE-2009-0283

The CVE-2009-0283 entry documents a Cross-site scripting (XSS) vulnerability in Oblog’s err.asp, exploitable through the message parameter to inject arbitrary web script or HTML. The vulnerability affects the err.asp path within Oblog, enabling remote attackers to execute script in a victim’s bro...

CVE-2009-0283: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in err.asp in Oblog allows remote attackers to inject arbitrary web script or HTML via the message parameter...

Oblog XSS valnerability

Product Name : Oblog System Vendor : www.oblog.cn Oblog XSS valnerability in err.asp page example : http://example/oblog/err.asp?message=XSS...

Oblog Cross Site Scripting

Product Name : Oblog System Vendor : www.oblog.cn Oblog XSS valnerability in err.asp page example : http://example/oblog/err.asp?message=XSS...

OBLOG - 'err.asp' Cross-Site Scripting

source: https://www.securityfocus.com/bid/33416/info OBLOG is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...

OBLOG - err.asp Cross-Site Scripting

OBLOG - err.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/33416/info OBLOG is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Oblog some finishing-vulnerability warning-the black bar safety net

1, Display, help/hmain. htm content, format: http://test/blog/userhelp.asp?file=help/hwhatblog.htm if replaced with asp files not be displayed? From the code can be seen, not allowed to read the extension of the asp file, but the extension is not limited, we only want the asp file content, window...

Oblog多用户博客程序Api/API_Response.asp页面过滤不严导致SQL注入漏洞

OBlog是国内多用户博客使用度最多最广的多用户博客解决方案。 漏洞文件:api/APIResponse.asp 打开api/APIResponse.asp看开头处=================省略部分代码============================ if request.querystring"syskey""" then syskey=lcaserequest.querystring"syskey" username=oblog.filtbadstrtrimrequest"username" if chksyskey then dim truepassword...

Oblog多用户博客程序AjaxServer.asp页面过滤不严导致SQL注入漏洞

通过构造特定的语句，可以更改任何用户的密码，包括管理员，严重级漏洞。 漏洞文件：AjaxServer.asp 变量：logfiles 语句：logfiles=Replacelogfiles," ","" If Leftlogfiles,1="," Then logfiles=Rightlogfiles,Lenlogfiles-1 rs"logpics" = logfiles '附加文件处理 If logfiles "" Then oblog.Execute "Update oblogupfile Set logid=" & tid & " Where fileid In " &...

Oblog 4.6多用户博客程序AjaxServer.asp页面过滤不严导致SQL注入漏洞

漏洞文件AjaxServer.asp: Sub digglog //第691行If Not lcaseRequest.ServerVariables"REQUESTMETHOD"="post" Then Response.End 。。。。。。 If request"ptrue"=1 Then //第703行 pdigg=oblog.checkuserlogineddiggunescapeTrimrequest"puser",Trimrequest"ppass" oblog.checkuserlogineddigg在/inc/ classsys.asp文件下： Public Functio...

Oblog 4.6 User_Address.asp注入漏洞

漏洞文件UserAddress.asp： If oblog.lGroup17,0=0 Then //第4行 有等级限制 oblog.AddErrStr "您目前所属的等级不允许使用通讯录功能" oblog.showUserErr Response.End End if 。。。。。。 addrId=Request"id" //第15行 If addrId"" And InStraddrid,","=0 Then addrId=IntaddrId 。。。。。。 Case "add","edit" //第23行 Call EditForm 。。。。。。 Sub EditForm //第90行 ...