2595 matches found
EGroupware 1.8.006 - Multiple Vulnerabilities
No description provided by source. 1）简单的CSRF利用下面创建新的管理员登录“ImmuniWeb”和密码“ImmuniWeb”： 2）利用CSRF 写入php文件 1.php"...
EasyDynamicPages 1.0 config_page.php Remote PHP File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9338/info EasyDynamicPages is prone to a remote file include vulnerability in a configuration script. This will permit a remote attack to include malicious PHP scripts from remote servers, which will then be executed by t...
LoveCMS 1.4 install/index.php step Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issue. An attacker ca...
S8Forum 3.0 - Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6547/info S8Forum is prone to a remote command execution vulnerability. When a user registers with the forum, a file is created locally with the specified username. The contents of this file will be the data entered by th...
minb 0.1.0 - Remote Code Execution Exploit
No description provided by source. !/usr/bin/python minb Remote Code Execution Exploit AUTHOR : IRCRASH R3d.W0rm Sina Yazdanmehr Discovered by : IRCRASH R3d.W0rm Sina Yazdanmehr Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Sina Yazdanmehr Site : http://minb.sf.net...
Libra PHP File Manager <= 1.18 Insecure Cookie Handling Vulnerability
No description provided by source. + Libra PHP File Manager Insecure Cookie Handling Vulnerability + Discovered By Stack + Greetz : All my freind --- exploit: javascript:document.cookie = user=1; path=/; document.cookie = pass=1; path=/; milw0rm.com 2008-09-26...
BabyGekko 1.2.2e Multiple Vulnerabilities
No description provided by source. Advisory ID: HTB23122 Product: BabyGekko Vendor: babygekko.com Vulnerable Versions: 1.2.2e and probably prior Tested Version: 1.2.2e Vendor Notification: October 24, 2012 Vendor Patch: November 4, 2012 Public Disclosure: November 14, 2012 Vulnerability Type: SQL...
PHP 4.x/5.0.1 PHP_Variables Remote Memory Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11334/info A vulnerability is reported to present itself in the array parsing functions of the 'phpvariables.c' PHP source file. The vulnerability occurs when a PHP script is being used to print URI parameters or data, th...
WordPress image-symlinks Plugin Arbitrary File Upload Vulnerability
Author = X-Bruno E-mail = email protected Facebook = http://fb.me/Inj3ct.Bruno Google Dork = inurl:/wp-content/plugins/image-symlinks/ Usage Info = Exploit Info : The attacker can uplaod file/shell.php "php" // Allowed file extensions "/uploadify/"; // The path were we will save the file getcwd m...
ecmall后台某处任意文件读取
简要描述： 很高兴看到shopex团队终于扛起了这个烂摊子发布了部分的ecmall补丁，可喜可贺的同时再提个醒，前台注射还没有修复完毕，在此先不表。 ecmall后台某处存在任意文件读取漏洞，可以读取服务器系统文件等。 详细说明： 文件admin\app\db.app.php line:198 function download $file = isset$GET'file' ? trim$GET'file' : ''; $backupname = isset$GET'backupname' ? trim$GET'backupname' : ''; if !$file...
Localize: A Serious Bug on SIGNUP Process!
Hello, I found a bug on your registration/Sign UP process.. You should fix this one soon as Possible! With This bug, Attacker will able to create thousands of ID's on you application.. POC ------ it can be done in three 3 ways.. 1 By CSRF .. Copy You Registration FORM source only form code is...
AlienVault Authenticated SQL Injection Arbitrary File Read
AlienVault 4.5.0 is susceptible to an authenticated SQL injection attack via a PNG generation PHP file. This module exploits this to read an arbitrary file from the file system. Any authenticated user is able to exploit it, as administrator privileges aren't required. This module requires...
CVE-2014-2089
ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain clientid pathname...
Joomla ofc_upload_image.php Unrestricted File Upload (CVE-2009-4140)
A remote code execution vulnerability has been reported in Joomla. The vulnerability is due to improper validation. A remote attacker can exploit this issue by uploading a specially crafted php file to the target...
ILIAS 4.4.1 Cross Site Scripting / Shell Upload Vulnerabilities
ILIAS version 4.4.1 suffers from cross site scripting and remote shell upload vulnerabilities. ============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias....
ILIAS 4.4.1 - Multiple Vulnerabilities
============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias.de ============================================================== First from admin user logged...
Imageview 6.x Shell Upload
Author: TUNISIAN CYBER + Exploit Title: Imageview File Upload vulnerability + Date: 20-01-2014 + Category: WebApp + Google Dork: : + Tested on: KaliLinux + Friendly Sites: na3il.com,th3-creative.com +Exploit: Imageview Suffers from a File Upload Vulnerability which allows the attacker to upload a...
ecshop 2.73 lib_transaction. php file to secondary SQL injection vulnerability analysis-vulnerability warning-the black bar safety net
A secondary injection, insert type, can be directly read from the database administrator information Use of process: find a product to purchase, modify the color of the radio buttons value2','6', 'c4598c0015367d28cfcb267fffc750fd', '1 3', 'ECS000013', midloadfile'C:/wamp/www/ec/data/config.php',7...
NAS4Free version 9.1.0.1 contains a remote command execution vulnerability
Overview NAS4Free version 9.1.0.1.804 and possibly earlier versions contain a remote code execution vulnerability CWE-94. Description CWE-94: Improper Control of Generation of Code 'Code Injection' NAS4Free version 9.1.0.1.804 and possibly earlier versions contain a remote code execution...
WordPress Theme SAICO 1.0 < 1.0.2 - Arbitrary File Upload
. . . \ \ | / \ \ \ | || / \ / / \ / |/ \ / | / \ / / /| | |/ \ \ \ // \ / / | \ /\ / | \ \ \ / \ //\ |\ | /\ // | /|\ / / / / / / / Exploit Title: WordPress SAICO theme Arbitrary File Upload Vulnerability Author: Byakuya Date: 10/19/2013 Vendor Homepage: http://themeforest.net/...