Stored Cross-Site Scripting Vulnerability in Ocean CMS

Ocean Movie Management System seacms, ocean cms is a video-on-demand system designed for webmasters with different needs. Ocean CMS has a stored cross-site scripting vulnerability, attackers can use the vulnerability to implant cross-site code, launch cross-site attacks, and realize the...

DevOps: Vagrant with AWS EC2 & Digital Ocean

The Benefits of Vagrant Plugins Following on from my recent DevOps blog posts, The DevOps Tools We Use & How We Use Them and Vagrant with Chef-Server, we will take another step forward and look into provisioning our servers in the cloud. There are many cloud providers out there, most who provide...

CSRF Vulnerability in Ocean CMS V6.48

Ocean Movie System aka Ocean CMS seacms is a PHP movie system. There is a CSRF vulnerability in the back-end SQL execution form of Ocean CMS, which can be exploited by attackers to trick administrators into clicking on malicious links to execute SQL statements and write webshell to gain server...

CSRF Vulnerability in Ocean CMS V6.48 Add Administrator Backend

Ocean Movie System aka Ocean CMS seacms is a PHP movie system. Ocean CMS V6.48 CSRF vulnerability exists in the background add administrator. Allows attackers to exploit the vulnerability to forge form links and induce administrators to click to add background accounts...

Multiple SQL Injection Vulnerabilities in Ocean CMS V6.48 Backend

Ocean Movie System aka Ocean CMS seacms is a PHP movie system. Ocean CMS V6.48 backend user search, backend user edit admin\adminmembers.php page id parameter, backend admin\adminmembersgroup.php page $id parameter and admin\admindatarelate.php page $vfield SQL injection vulnerability exists. The...

Ocean CMS V6.48 File Traversal and Arbitrary File Deletion Vulnerabilities

Ocean Movie System aka Ocean CMS seacms is a PHP movie system. Ocean CMS version 6.48 \admin\admintemplate.php page file traversal and arbitrary file deletion vulnerability, allowing attackers to exploit the vulnerability to obtain, delete arbitrary files, can lead to system reinstallation...

SQL injection vulnerability in the uid parameter in the admin_members.php page of the Ocean CMS website builder system

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the /admin/adminmembers.php page of the Ocean CMS system. The lack of filtering of the "uid" parameter allows attackers to exploit the vulnerability to obtain sensitive database information...

SQL injection vulnerability in the type parameter of admin_news.php page in Ocean CMS system

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the adminnews.php page of Ocean CMS. The lack of filtering of the "type" parameter allows attackers to exploit the vulnerability to obtain sensitive database information...

SQL injection vulnerability in the climit parameter of the admin_pay.php page of the Ocean CMS system

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the Ocean CMS adminpay.php page. The lack of filtering of the climit parameter allows attackers to exploit the vulnerability to obtain sensitive database information...

SQL injection vulnerability in type parameter of Ocean CMS admin_collect_news.php page

Ocean CMS is an open source website builder. An SQL injection vulnerability exists in the admincollectnews.php page in the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'type' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about...

SQL Injection Vulnerability in Ocean CMS ckey Parameter

Ocean CMS is an open source website builder. An SQL injection vulnerability exists in the adminpay.php page of the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'ckey' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the...

SQL Injection Vulnerability in Ocean CMS v_field Parameter

Ocean CMS is an open source website builder. An SQL injection vulnerability exists in the admindatarelate.php page in the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'vfield' parameter allows attackers to exploit the vulnerability to obtain sensitive database informatio...

SQL Injection Vulnerability in Ocean CMS uesMode Parameter

Ocean CMS is an open source website builder. An SQL injection vulnerability exists in the admincollect.php page in the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'uesMode' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about t...

SQL Injection Vulnerability in Ocean CMS Order Parameter

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the adminnews.php page in the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'order' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the...

SQL Injection Vulnerability in Ocean CMS tid Parameter

Ocean CMS is an open source website builder. An SQL injection vulnerability exists in the admintopicvod.php page of Ocean CMS 6.46 utf-8 official. The lack of filtering of the 'tid' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the database...

SQL Injection Vulnerability in Ocean CMS v_name Parameter

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the adminajax.php page of Ocean CMS 6.46 utf-8 official version. The lack of filtering of the 'vname' parameter allows an attacker to exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in Ocean CMS zyapi.php Page

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the Ocean CMS zyapi.php page. The lack of filtering of the '$ids' parameter allows attackers to exploit the vulnerability to obtain sensitive information about the database...

Through AWS, Google Cloud and Digital Ocean DNS vulnerability take over nearly 12 million domain names-bug warning-the black bar safety net

Shortly before, I was at cloud hosting provider Digital Ocean domain into the system found a security vulnerability, an attacker or may exploit this vulnerability to take over two million of the plurality of domain names in the report of the transfer gate on. If you have not read this report whil...

The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability in AWS, Google Cloud, Rackspace and Digital Ocean

Recently, I found that Digital Ocean suffered from a security vulnerability in their domain import system which allowed for the takeover of 20K domain names. If you haven't given that post a read I recommend doing so before going through this write up. Originally I had assumed that this issue was...

Stored XSS cross-site scripting vulnerability in Ocean CMS version 6.33 (CNVD-2016-10763)

Ocean CMS is an open source website builder. Ocean CMS 6.33 version exists stored XSS cross-site scripting vulnerability. A stored XSS cross-site scripting vulnerability exists in Ocean CMS version 6.33. An attacker can exploit the vulnerability to inject arbitrary Web script or HTML...