360 Web Manager 3.0 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Multiple vulnerabilities in 360 Web Manager 3.0 Google Dork: Powered by 360 Web Manager 3.0 Date: 15/04/2011 Author: Ignacio Garrido Contact: [email protected] Software Link: www.360webmanager.com Version: v3.0 Tested on: Linux 2.6.18 Vulnerabilit...

WordPress image-symlinks Plugin Arbitrary File Upload Vulnerability

Author = X-Bruno E-mail = email protected Facebook = http://fb.me/Inj3ct.Bruno Google Dork = inurl:/wp-content/plugins/image-symlinks/ Usage Info = Exploit Info : The attacker can uplaod file/shell.php "php" // Allowed file extensions "/uploadify/"; // The path were we will save the file getcwd m...

ecmall后台某处任意文件读取

简要描述： 很高兴看到shopex团队终于扛起了这个烂摊子发布了部分的ecmall补丁，可喜可贺的同时再提个醒，前台注射还没有修复完毕，在此先不表。 ecmall后台某处存在任意文件读取漏洞，可以读取服务器系统文件等。 详细说明： 文件admin\app\db.app.php line:198 function download $file = isset$GET'file' ? trim$GET'file' : ''; $backupname = isset$GET'backupname' ? trim$GET'backupname' : ''; if !$file...

Localize: A Serious Bug on SIGNUP Process!

Hello, I found a bug on your registration/Sign UP process.. You should fix this one soon as Possible! With This bug, Attacker will able to create thousands of ID's on you application.. POC ------ it can be done in three 3 ways.. 1 By CSRF .. Copy You Registration FORM source only form code is...

AlienVault Authenticated SQL Injection Arbitrary File Read

AlienVault 4.5.0 is susceptible to an authenticated SQL injection attack via a PNG generation PHP file. This module exploits this to read an arbitrary file from the file system. Any authenticated user is able to exploit it, as administrator privileges aren't required. This module requires...

CVE-2014-2089

ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain clientid pathname...

Joomla ofc_upload_image.php Unrestricted File Upload (CVE-2009-4140)

A remote code execution vulnerability has been reported in Joomla. The vulnerability is due to improper validation. A remote attacker can exploit this issue by uploading a specially crafted php file to the target...

ILIAS 4.4.1 - Multiple Vulnerabilities

============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias.de ============================================================== First from admin user logged...

ILIAS 4.4.1 Cross Site Scripting / Shell Upload Vulnerabilities

ILIAS version 4.4.1 suffers from cross site scripting and remote shell upload vulnerabilities. ============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias....

Imageview 6.x Shell Upload

Author: TUNISIAN CYBER + Exploit Title: Imageview File Upload vulnerability + Date: 20-01-2014 + Category: WebApp + Google Dork: : + Tested on: KaliLinux + Friendly Sites: na3il.com,th3-creative.com +Exploit: Imageview Suffers from a File Upload Vulnerability which allows the attacker to upload a...

ecshop 2.73 lib_transaction. php file to secondary SQL injection vulnerability analysis-vulnerability warning-the black bar safety net

A secondary injection, insert type, can be directly read from the database administrator information Use of process: find a product to purchase, modify the color of the radio buttons value2','6', 'c4598c0015367d28cfcb267fffc750fd', '1 3', 'ECS000013', midloadfile'C:/wamp/www/ec/data/config.php',7...

NAS4Free version 9.1.0.1 contains a remote command execution vulnerability

Overview NAS4Free version 9.1.0.1.804 and possibly earlier versions contain a remote code execution vulnerability CWE-94. Description CWE-94: Improper Control of Generation of Code 'Code Injection' NAS4Free version 9.1.0.1.804 and possibly earlier versions contain a remote code execution...

WordPress Theme SAICO 1.0 < 1.0.2 - Arbitrary File Upload

. . . \ \ | / \ \ \ | || / \ / / \ / |/ \ / | / \ / / /| | |/ \ \ \ // \ / / | \ /\ / | \ \ \ / \ //\ |\ | /\ // | /|\ / / / / / / / Exploit Title: WordPress SAICO theme Arbitrary File Upload Vulnerability Author: Byakuya Date: 10/19/2013 Vendor Homepage: http://themeforest.net/...

Empire cms 7.0 background to get shell-vulnerability warning-the black bar safety net

Empire CMS7. 0 background can upload the mod suffix PHP file and execute inside php code. Into the backgroundit! Method a: system data tables with the system model-management data table and then randomly selected one data table, open the corresponding data table of the“management system model”as...

Gnew 2013.1 PHP File Inclusion / SQL Injection

Advisory ID: HTB23171 Product: Gnew Vendor: Raoul Proença Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure: October 2, 2013 Vulnerability Type: PHP File...

Multiple Vulnerabilities in Gnew

Advisory ID: HTB23171 Product: Gnew Vendor: Raoul Proenca Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure: October 2, 2013 Vulnerability Type: PHP File...

Gnew 2013.1 - Multiple Vulnerabilities (2)

Advisory ID: HTB23171 Product: Gnew Vendor: Raoul Proença Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure: October 2, 2013 Vulnerability Type: PHP File...

Gnew 2013.1 - Multiple Vulnerabilities

Gnew version 2013.1 suffers from file inclusion and remote SQL injection vulnerabilities. Product: Gnew Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure:...

Multiple Vulnerabilities in X2CRM

Advisory ID: HTB23172 Product: X2CRM Vendor: X2Engine Inc. Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Advisory Published: September 4, 2013 Vendor Notification: September 4, 2013 Vendor Patch: September 10, 2013 Public Disclosure: September 25, 2013 Vulnerability Type: PH...

Gnew 2013.1 - Multiple Vulnerabilities (2)

Gnew 2013.1 - Multiple Vulnerabilities 2 Advisory ID: HTB23171 Product: Gnew Vendor: Raoul Proença Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure: October...