391 matches found
phpcms v9 目录穿越(遍历)漏洞
No description provided by source...
PHPCMS V9 phpsso/index.php authkey 泄露漏洞
No description provided by source...
PHPCMS /phpsso_server/phpcms/modules/phpsso/index.php任意代码执行
No description provided by source...
PHPCMS v9.6.0 SQL注入漏洞
No description provided by source...
Multiple vulnerabilities in phpcms
phpcms is an open source content management system. Multiple vulnerabilities exist in phpcms. Attackers use the vulnerabilities to log into the backend of phpssoserver to obtain sensitive information...
PHPCMS后台CSRF
No description provided by source...
PHPCMS v9.5.* vote模块 命令执行
No description provided by source...
PHPCMS V9 /api.php Authkey 信息泄漏
No description provided by source...
phpcms v9用户登录处存在sql注入漏洞
password字段如果存在特殊字符，在传入到程序时仍然会被转义，而且在phpsso的login中使用的是username做数据库查询，而不是password。针对第一个问题我们可以使用二次url编码的方法来搞定，在解码之后程序还是用了parsestr对字符串进行了拆解，而这个函数还附带了解url编码的功能。所以，我们只需要在传password内容时传递%2527就可以让单引号出现在phpsso的变量中了。第二个问题也用到parsestr的功能，parsestr在解析“username=123&password=456”这样的字符串，会把它解析为：Array username=123,...
phpcms v9 /modules/phpsso/index.php SQL注入漏洞
No description provided by source...
phpcms v9 latest high-risk sql injection exp-vulnerability warning-the black bar safety net
Get the current database http://192.168.1.139:8080/phpcms/index.php?m=member&c=index&a=login post: forward=http%253A%252F%252F192. 1 6 8. 1. 1 3 9%253A8080%252Fphpcms%252Findex. php%253Fm%253Dmember&username=phpcms&password=1 2 3 4 5 6%26username%3d%2 5 2 7%2bunion%2bselect%2b%2 5 2 7 2% 2 5 2...
用友政务官方网站存在漏洞导致authkey泄露
简要描述： 用友政务官方网站存在漏洞导致authkey泄露 详细说明： 同学在用友政务工作，闲着没事看了看他们的官方网站，顺便手贱摸了一下·· http://www.yonyougov.com/index.php?m=admin&c=index&a=login&pchash= PHPCMS V9的系统 authkey很重要，可注射拿shell...
PHPCMS latest version authkey leakage vulnerability
PHPCMS is a content management system. PHPCMS latest version authkey leak vulnerability, attackers use authkey and cms comes with the encryption and decryption function can be encrypted, you can change the password, but also can be injected...
用友某业务站敏感信息泄漏+sql注入
简要描述： 用友某业务站敏感信息泄漏+sql注入 详细说明： 用友新道： http://home.seentao.com/ http://seentao.yonyou.com/ phpcms搭建，存在爆authkey漏洞，拿到key，想干什么干什么。。 WooYun: PHPCMS最新版本authkey泄露可注射拿shell 漏洞证明： 仅测试： web server operating system: Windows web application technology: PHP 5.3.29, Apache 2.4.10 back-end DBMS: MySQL 5.0...
phpcms存在存储型Xss
简要描述： phpcms存在存储型Xss 详细说明： 我已经成功注册了 用户名Z4lx 密码qwe123 然后点击我的信息旁边发布，我这里已经随便写了个信息发布了 信息随便写就行了 发布好了后点击我的信息 然后点击编辑 手机号码那里写入代码 ';alert'Z4l 然后点击保存 然后点击查看归属地 成功弹窗 只要是访问了此页面的 查看归属都会谈http://demo.phpmps.com/view.php?id=110 漏洞证明： 已证明...
phpcms front Desk arbitrary code execution php must be less than 5. 3-the vulnerabilities and early warning-the black bar safety net
phpcms v9 string2arrayfunction using the eval function,in more than one place may cause code execution vulnerability /phpssoserver/phpcms/libs/functions/global.func.php | 1 2 3 4 5 6 7 8 9 1 0 1 1 | / Converts a string to an array @param string $data the string @return array returns the array...
PHPCMS V9 /phpsso_server/phpcms/modules/phpsso/index.php SQL注入漏洞
/api/getmenu.phpfunction ajaxgetlist $cachefile = $GET'cachefile'; $cachefile = strreplacearray'/', '//', '', $cachefile; //$cachefile = pregreplace'/\x00-\x08\x0B\x0C\x0E-\x1F\x7F+/S', '', $cachefile; $path = $GET'path'; $path = strreplacearray'/', '//', '', $path; //$path =...
PHPCMS V9 /phpcms/modules/vote/index.php 代码执行漏洞
漏洞影响版本：phpcms v9.5.8漏洞分析：hpsso/index.php文件所有的操作都存在严重的注入问题，这个类文件的构造函数最先调用它的父构造函数，通过authkey来解析POST传入的data内容，解析后data中的内容会作为注册、登陆、删除用户等操作的内容依据，而这些操作都会将这些数据作为数据库查询语句使用。这个问题其实在XXX的《PHPCMS V9...
PHPCMS Arbitrary Code Execution Vulnerability
PHPCMS is an open source content management system. An arbitrary code execution vulnerability exists in the front-end of PHPCMS, which allows attackers to exploit this vulnerability to execute arbitrary code...
phpcms background arbitrary code execution vulnerability
phpcms is an open source content management system. phpcms backend exists arbitrary code execution vulnerability , due to phpcms source code program in many places using the string2array function , the function's parameters are directly executed by eval , so as long as there is a call to the...