phpcms 2008 /ads/include/ads_place.class.php sql注入漏洞

漏洞产生位置： /ads/include/adsplace.class.php function show$placeid …………............. else $ads = $this-db-getone"SELECT FROM ".DBPRE."ads a, $this-table p WHERE a.placeid=p.placeid AND p.placeid=$placeid AND a.fromdate=UNIXTIMESTAMP AND a.passed=1 AND a.status=1 ORDER BY rand LIMIT 1"; $contents =...

PHPCMS 9 index.php 本地文件包含漏洞

phpcms/modules/search/index.php 代码如下： public function publicgetsuggestkeyword $url = $GET'url'.'&q='.$GET'q'; $res = @filegetcontents$url; ifCHARSET != 'gbk' $res = iconv'gbk', CHARSET, $res; echo $res;...

phpcms 9 index.php sql注入漏洞

No description provided by source...

PHPCMS_V9 (get_linkage.php) 本地文件包含漏洞

由于文件getlinkage.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。 相关代码如下： /api/ getlinkage.php codecase 'ajaxselect': $parentid = $GET'parentid' ? intval$GET'parentid' : 0; $keyid = $GET'keyid'; ajaxselect$parentid,$keyid; 函数ajaxselect在相同文件中有定义 function ajaxselect$parentid,$keyid $datas = getcache$keyid,'linkage';...

PHPCMS 9 plugin.php 本地文件包含漏洞

No description provided by source...

PHPCMS V9 (plugin.php)本地文件包含漏洞

由于文件/plugin.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。 相关代码如下： 文件plugin.php ifisset$GET'id' list$identification, $filename,$action = explode'-', $GET'id'; $filename = !empty$filename ? $filename : $identification; $action = !empty$action ? $action : 'init'; $cache = getcache$identification,'plugins';...

phpcms 2008 index.php 跨站脚本攻击漏洞

No description provided by source...

phpcms V9 BLind SQL 注入漏洞

No description provided by source. http://eidelweiss-advisories.blogspot.com/2011/01/phpcms-v9-blind-sql-injection.html ! index.php?m=content&c=rss&catid=valid catid Example p0c ! http://host/index.php?m=content&c=rss&catid=10 = True ! http://host/index.php?m=content&c=rss&catid=-10 = False +...

phpcms 2008 广告模块注入漏洞

No description provided by source...

phpcms 2 0 0 8 product.php the pagesize parameter code injection vulnerability-vulnerability warning-the black bar safety net

SSV-Appdir: phpcms Published: 2011-10-12 Affected version: phpcms 2 0 0 8 Vulnerability description: phpcms 2 0 0 8 of the code due to the template parameter improper handling can lead to arbitrary execution of arbitrary code file. The specific code triggering the path is this: phpcms/yp/product...

phpcms 2 0 0 8 latest 0day added bulk EXP-vulnerability warning-the black bar safety net

Play the junk, throw it to everyone to play it. Now the hit rate is also good Oh. Direct GETSHELL it. Word password is c EXP: !/ usr/bin/php ? php printr' +---------------------------------------------------------------------------+ PHPCMS Remote Code Inject GetShell Trojan Google Dork:Powered by...

phpcms 2008 product.php pagesize参数代码注射漏洞

PHPCMS是国内领先的网站管理系统，同时也是一个开源的PHP开发框架。 PHPCMS 2008在处理某些模板参数时存在安全漏洞，其yp/product.php页面的pagesize参数没有正确进行检查过滤，导致可以提交任意字符，远程攻击者可利用此漏洞执行任意命令 具体的代码触发路径是这样的： phpcms/yp/product.php中获取pagesize参数，拼接为$urlrule变量。随后将之带入yp目录下的product.html模板之中。在模板执行后，进入到get函数处理中，最后经过get-pages-pageurl函数，最终触发pageurl的如下代码： eval"$url ...

phpcms 2008 c.php 跨站脚本漏洞

前言： phpcms目前已经退出v9版本，2008版已经停止更新，但仍有少数网站使用phpcms2008框架。 漏洞描述： 该漏洞主要由referer地址未进行过滤，直接插入数据库导致的注入漏洞。 代码： $info'referer' = HTTPREFERER; //这里为进行字符串过滤 $year = date'ym',TIME; $table = DBPRE.'ads'.$year; $tablestatus = $db-tablestatus$table; if!$tablestatus include MODROOT.'include/create.table.php';...

phpcms 2008 /yp/product.php 代码注入漏洞

phpcms 2008的代码中由于对模板参数处理不当，导致可以任意执行任意代码文件。 具体的代码触发路径是这样的： phpcms/yp/product.php中获取pagesize参数，拼接为$urlrule变量。随后将之带入yp目录下的product.html模板之中。在模板执行后，进入到get函数处理中，最后经过get-pages-pageurl函数，最终触发pageurl的如下代码： eval"$url = "$urlrule";";...

PHPCMS V9 sys_auth() 设计缺陷导致多个SQL注入漏洞

No description provided by source...

phpcms v9 backend(sql inj)2(code exec)vulnerability-vulnerability warning-the black bar safety net

Author: sdk original: Google looking to go. phpcms v9 backendsql inj2code execvulnerability - low-key development 0 T6 X F: V j: e6 i by flyh4t - Low profile development 7 K c' j. K g/ \ i r phpcms v9 string2arrayfunction using the eval function,in more than one place may cause code execution...

phpcms 2 0 0 8 sp4 comment. php page SQL injection vulnerability analysis-vulnerability warning-the black bar safety net

phpcms 2 0 0 8 sp4 comment. the php pageSQL injectionvulnerability analysis Published date: 2010-08. 1 4 Published date: 2010-08. 1 4 Publishing author: failure Aberdeen Affected versions: phpcms 2 0 0 8 sp4 Official address: www.phpcms.cn Vulnerability description: The...

PHPCMS V9 Cross-Station 2 and repair-vulnerability warning-the black bar safety net

Some place it with the filter, the Server environment registerglobals = On time directly toXSS and... Fishing fishing. Nothing. In order to rank before the issue. Well well to. Detail:/install/header. tpl. php? step=b&stepsb=cc/titlescriptalert1 1 1;/scriptyou fuck your own test to go. In order t...

PHPCMS V9 Cross-Station 2 and repair-vulnerability warning-the black bar safety net

Some place it with the filter, the Server environment registerglobals = On time directly toXSS and... Fishing fishing. Nothing. In order to rank before the issue. Well well to. Detail:/install/header. tpl. php? step=b&stepsb=cc/titlescriptalert1 1 1;/script You fuck your own test to go. In order ...

phpcms2008 & phpcms2007 GBK版ask/search_ajax.php SQL注射漏洞

PHPCMS 是国内领先的网站管理系统，同时也是一个开源的PHP开发框架 漏洞文件：ask/searchajax.php code： ?php require './include/common.inc.php'; requireonce MODROOT.'include/ask.class.php'; $ask = new ask; header'Content-type: text/html; charset=utf-8'; ifstrtolowerCHARSET != 'utf-8' $q = iconvCHARSET, 'utf-8', $q; if$q $where = "...