PHPMyWind后台管理界面的SQL注入漏洞

简要描述： 后台管理界面因为过滤不严格导致SQL注入漏洞，可以使权限较低的管理员取得较高权限，以及获取并修改超级管理员的用户名密码。 详细说明： 存在问题的代码，adminsave.php 59-101行，SQL语句中的$id存在注入 else if$action == 'update' //创始人账号不允许更改状态 if$id == 1 and $checkadmin != 'true' or $levelname != '1' ShowMsg'抱歉，不能更改创始账号状态！','-1'; exit; //只有超级管理员才有权修改超级管理员 if$cfgadminlevel 1 and...

KPPW Sql 最新版 可修改管理密码

简要描述： 更新日期: 2014-05-19 12:17:29 。。可以修改管理密码 但是修改的密码是不可控的。 还是老老实实注入把。 详细说明： 在api/uc.php中 if!defined'INUC' requireonce '../appcomm.php'; requireonce SROOT.'/config/configucenter.php'; $get = $post = array; $code = @$GET'code'; parsestrauthcode$code, 'DECODE', UCKEY, $get; ifDEBUGUC==TRUE...

mcms手机建站之星任意用户信息(包括密码)修改(不包括管理员)

简要描述： mcms手机建站之星任意用户信息包括密码修改，可惜不能改管理员。 详细说明： 文件 plugin/gov.user/index.php 188行 function medit global $dbm; $params = array; if !isnumeric$POST'userid' die'"code":"210","msg":"会员UID必须是数字"'; // 验证会员信息是否合法 if empty$POST'uname' die'"code":"210","msg":"会员名不能为空"'; //if empty$POST'pro'...

SOL15229 - BIG-IQ / BIG-IP privilege escalation vulnerability CVE-2014-3220

If the BIG-IQ 4.1 system is used to discover a BIG-IP 11.3.0 or 11.4.0 system, an authenticated user on the BIG-IP system may be able to modify the password of another user, including an administrator. Recommended Action If the previous table lists a version in the Versions known to be not...

逐浪CMS任意SQL游走CMS2 V1.4 V1.5、 CMS6.0均受影响（其他版本死链未测）

简要描述： 问题出现在详细说明中 详细说明： 问题出现在 User\Develop\ashx\UserTage.ashx 代码片段： try MZoneNode MZN = new MZoneNode; BEditPage BEP = new BEditPage; MZN.NodeID = Convert.ToInt32nodeid; MZN.UserID = BU.GetLogin.UserID; string strTemp = style; string strStyle = strTemp.Split'|'; if strStyle != null foreach string...

A.sopCMS 4.8 /loadUserAttrAction.do 远程密码修改漏洞

No description provided by source...

程氏舞曲CMS最新版可csrf劫持任意用户（管理员除外）

简要描述： 操蛋捏... 详细说明： 用户会员中心修改密码处，无任何验证， 无需原来密码也没hidden字段导致可以csrf 漏洞证明： 本地构造表单测试成功 None 跳转太快无法截图！...

STRUTS2 exploit ROOT permissions to add a user-vulnerability warning-the black bar safety net

Recent in use struts2 vulnerability check the site, hit the root permissions, but to add account time to forget a lot of instruction. Are not added. One is to use parameters to add, the other one is to modify the passwd and shadow re-upload added. The first is directly using the command line to a...

cmseasy 5.5 lib/default/user_act.php 远程密码修改漏洞

No description provided by source...

Ecmall 2 /app/find_password.php 远程密码修改漏洞

No description provided by source...

CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4962

The CVE-2013-4962 entry concerns Puppet Enterprise prior to 3.0.1 where the reset password page does not require the current password. This can let an attacker modify user passwords by exploiting session hijacking, an unattended workstation, or other vectors. The description consistently states t...

Tipask 2.0 加密函数破解导致任意用户密码修改

简要描述： Tipask问答系统是一款开放源码的PHP仿百度知道程序。以国人的使用习惯为设计理念，采用MVC构架，系统具有速度快，SEO友好，界面操作简洁明快等特点。 但是Tipask中使用的加密算法存在被破解的可能性，因此将导致包括任意用户密码修改等漏洞的发生。 详细说明： 在核心加密算法strcode函数中： / 通用加密解密函数，phpwind、phpcms、dedecms都用此函数 / function strcode$string, $authkey, $action= 'ENCODE' $key = substrmd5$SERVER "HTTPUSERAGENT"...

Chengdu provident arbitrary account password modification vulnerability-vulnerability warning-the black bar safety net

Detailed description: Vulnerability one:modify any account password. csrf vulnerabilities+logic vulnerabilities. On the site, if you need to change the password is required to enter the original password. But not at all, Plus is the get value will cause the vulnerability to... As long as that oth...

Network fun shopping system landing any of the account Bugs(except admin)-vulnerability warning-the black bar safety net

Run into a lot of asp shopping Station is network fun kernel change, but without a column outside of both the existence of this vulnerability, including the latest and most older network fun, relatively tasteless, can't get webshell to. But the harm is relatively large, you can login and modify a...

PhpcmsV9 SQL injection 2 0 1 3-year New Year second-vulnerability warning-the black bar safety net

Brief description: Second, such as about came, Thank you for your attention, the second sent using an unrestricted SQL injection, the final object you can modify any user's password, the recommendations confirm the safety hazard rating of high. Tomorrow then update the next vulnerability. Detaile...

Alt-N MDaemon WebAdmin Remote Code Execution

================================================================== Alt-N MDaemon's WebAdmin Remote Code Execution Vulnerability ================================================================== Software: Alt-N MDaemon v13.0.3 and prior versions Vendor: http://www.altn.com/ Vuln Type: Remote Code...

Design/Logic Flaw

ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to 1 user/indexinlineeditorsubmit.php or 2 coursecategory/indexinlineeditorsubmit.php...

Design/Logic Flaw

user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168...

CVE-2012-5454

CVE-2012-5454 affects ATutor AContent 1.2-1 where user/index_inline_editor_submit.php does not properly restrict access, enabling remote authenticated users to modify arbitrary user passwords via a crafted request. This vulnerability is noted as potentially related to an incomplete fix for CVE-20...