169 matches found
PHPWIND XSS跨站漏洞
简要描述： 详细说明： 漏洞证明： http://www.phpwind.com/certificate.php?host='"alert88668066;"...
phpwind （manage.php）SQL injection exploit-vulnerability warning-the black bar safety net
PHPWind is a set of used php+mysql database running and can generate a html page of new and perfect of powerful system. We hope that as an open source. Sharing software,PHPWind can to its smooth speed and high load capacity aroused you to join PHPWind camp enthusiasm! Together to create a...
PHPWind v7. 5 / v8. 0 vulnerability EXP-vulnerability warning-the black bar safety net
PHPWind v7. 5 / v8. 0 vulnerability EXP theme keywords: phpwind7. 5 Affected version: PHPWind v7. 5 / v8. 0 Command :php pking.php user passhttp://www. xxxx. com/ pking.php: Copy the contents to the clipboard the program code ? php echo" Info: Poc for Phpwind remote command execution Test:...
phpwind multiple remote code execution vulnerabilities(phpwind sql injection vulnerability)-vulnerability warning-the black bar safety net
| The impact of the system phpwind 7 phpwind 8 Detailed description phpwind 7 and 8 version there is an input validationvulnerability, an attacker successfully exploited thevulnerabilityto remotely execute arbitrary php code. The problem exists in pwajax. php, because the user submitted to the...
Phpwind远程任意代码执行漏洞
简要描述： Phpwind对于某些用户提交的参数过滤不严，导致可能的一个远程代码执行，普通前台恶意用户可以取得使用phpwind站点的权限 详细说明： ./phpwind7.2/thread.php中 InitGParray'page','type','search','orderway','asc','special'; …… //此处省略X行 $dbmaxpage && $page $dbmaxpage && $page = $dbmaxpage; int$page $numofpage $page = $numofpage;...
phpwind v8.0敏感信息泄露漏洞
简要描述： 这个漏洞一直存在，包含6.x---8.x版本。 程序员该打pp咯 详细说明： 漏洞证明：...
phpwind pw_ajax.php和class_other.php页面远程代码执行漏洞
phpwind较高版本论坛中存在一个严重的漏洞，成功利用该漏洞可以远程执行任意php代码 pwajax.php中的 elseif $action == 'pcdelimg' InitGParray'fieldname','pctype'; InitGParray'tid','id',2; if !$tid || !$id || !$fieldname || !$pctype echo 'fail'; $id = int$id; if $pctype == 'topic' $tablename = GetTopcitable$id; elseif $pctype == 'postcate'...
phpwind远程代码执行漏洞
简要描述： phpwind较高版本论坛中存在一个严重的漏洞，成功利用该漏洞可以远程执行任意php代码，影响phpwind 7和phpwind 8 详细说明： pwajax.php中的 elseif $action == 'pcdelimg' InitGParray'fieldname','pctype'; InitGParray'tid','id',2; if !$tid || !$id || !$fieldname || !$pctype echo 'fail'; $id = int$id; if $pctype == 'topic' $tablename =...
PHPWind 6.0 multiple cross-site scripting vulnerability-vulnerability warning-the black bar safety net
PHPWind is a domestic of the more popular PHP-based Web forum application. PHPWind 在 访客 注销 时 没有 正确 的 过滤 提交 给 hack.php and search.php and read.php and post.php and thread.php and profile.php and sort.php and message.php and userpay. php, etc. page of request parameters, a remote attacker can submi...
PHPWind 6.0多个跨站脚本漏洞
PHPWind是一款国内比较流行的基于PHP的Web论坛程序。 PHPWind在访客注销时没有正确的过滤提交给hack.php、search.php、read.php、post.php、thread.php、 profile.php、sort.php、message.php、userpay.php等页面的请求参数，远程攻击者可以提交恶意请求执行跨站脚本攻击。 PHPWind 6.0 厂商补丁： PHPWind ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phpwind.net/...
There are lost of xss vul in PHPWind v6.0 !
I found the PHPWind v6.0 just filter the xss code when the visitors login in, but it doesnt do it when login off. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This flaw makes its all the parameters...
PHPWind version 6.0 Cross Site Scripting Vulnerability
Exploit for unknown platform in category web applications ====================================================== PHPWind version 6.0 Cross Site Scripting Vulnerability ====================================================== I found the PHPWind v6.0 just filter the xss code when the visitors login...
PHPWind 6.0 Cross Site Scripting
I found the PHPWind v6.0 just filter the xss code when the visitors login in, but it doesnt do it when login off. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This flaw makes its all the parameters...
PHPWind 6.0 - Multiple Cross-Site Scripting Vulnerabilities
PHPWind 6.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/38867/info PHPWind is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execu...
PHPWind 6.0 - Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/38867/info PHPWind is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting...
Phpwind 7.5 多个本地文件包含漏洞
No description provided by source...
phpwind 7.5 apps/groups/index.php远程包含漏洞
apps/groups/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码 ?php if $route == "groups" requireonce $basePath . '/action/mgroups.php'; elseif $route == "group" requireonce $basePath . '/action/mgroup.php'; elseif $route == "galbum" requireonce $basePath . '/action/mgalbum.php';...
phpwind 7.5 api/class_base.php Include Vulnerabilities
PHPWind 论坛系统 是一套采用 php+mysql 数据库 方式运行并可生成 html 页面的全新且完善的强大系统。因具有非凡的访问速度和卓越的负载能力而深受国内外朋友的喜爱。 api/classbase.php文件里callback函数里$mode变量没有过滤导致任意包含本地文件,从而可以执行任意PHP命令. api/classbase.php文件里: function callback$mode, $method, $params if !isset$this-classdb$mode if !fileexistsRP.'api/class' . $mode . '.php'...
phpwind 7.5 apps/share/index.php远程包含漏洞
PHPWind 论坛系统 是一套采用 php+mysql 数据库 方式运行并可生成 html 页面的全新且完善的强大系统。因具有非凡的访问速度和卓越的负载能力而深受国内外朋友的喜爱。 Zoomeye Dork apps/share/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码 ?php if $route == "share" requireonce $basePath . '/action/mshare.php'; elseif $route == "sharelink" requireonce...