Uebimiau 3.2.0 /admin/editor.php 代码执行漏洞

No description provided by source...

YXcmsApp某处xss导致getshell

简要描述： xss到后台导致getshell一条龙服务不过略鸡肋。 详细说明： YXCMS是一款面向企业的内容管理系统，采用三级缓存，MVC架构以BSD协议开源。 注册了用户以后来到用户管理页面，点击信息发布 - 增加咨询，发现是一个富文本编辑器，kindeditor。不管是什么编辑器，既然给了一个用户这么大的权限，这种情况下很容易出现xss。 随便输入点什么东西，抓包，修改content字段内容，写你的xss代码，什么都行。 好了。管理员在后台就能看到我提交的文章： 然后编辑的话就能触发xss：...

yxcms sql注入漏洞

简要描述： yxcms注入漏洞 详细说明： protected/apps/members/conttoller/photocontroller.php 343行 else if'del'!=$POST'dotype' $this-error'操作类型错误',url'photo/index'; ifempty$POST'delid' $this-error'您没有选择',url'photo/index'; $delid=implode',',$POST'delid'; $photos=model'photo'-select'id in...

Cisco EPC3925 - Persistent Cross-Site Scripting

Exploit Title: Cisco EPC3925 - Persistent Cross Site Scripting Google Dork: N/A Date: 12-11-2013 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.cisco.com Software Link: Not public Version: epc3925-E10-5-v302r125572-130520c Tested on: Cisco EPC3925 CVE: N/A Description The paramet...

RealPlayer 'RMP'文件处理远程堆缓冲区溢出漏洞

BUGTRAQ ID: 64398 CVECAN ID: CVE-2013-6877 RealPlayer是网上收听收看实时音频、视频和Flash的工具。 RealPlayer 16.0.2.32、16.0.3.51版本处理RMP文件时存在安全漏洞，远程攻击者可诱使客户端用户打开特制的RMP文件，利用此漏洞执行任意代码。 0 Real Networks RealPlayer 16.0.3.51 Real Networks RealPlayer 16.0.2.32 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Cisco EPC3925 Cross Site Request Forgery

Exploit Title: Cisco EPC3925 � Cross Site Request Forgery Google Dork: N/A Date: 12-11-2013 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.cisco.com Software Link: Not public Version: epc3925-E10-5-v302r125572-130520c Tested on: Cisco EPC3925 CVE: N/A Description: This proof of...

Cisco WebEx Multiple Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in Cisco WebEx Business Suite could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by convincing a user ...

ShopEx 最新版后台getshell

简要描述： 最新版shopex-single-4.8.5.81518 后台某处设计缺陷，可以绕过限制，导致可以操作任意文件，最终getshell。 详细说明： 现在流传的拿shell的方法好像都失效了，最新版的getshell。 在后台页面管理——模版列表——模板文件管理中，编辑任意文件： 然后在文件的内容中写入php木马，然后保存，截包： 在修改截获的数据包，修改name的值为php后缀的，这里直接输入php后缀是不行的，可以使用%00绕过： 保存成功。模板文件列表中已经生产了xiaoma.php文件。 最后连接一下：...

TCCMS全版本COOKIE注入（已演示证明）

简要描述： TCCMS teamcen.com Cookie Injection 具体请见详细说明 证明处使用SQLMAP注射成功 详细说明： /public/Class/Authen.class.php 省略无关代码 请注意添加注释处代码，下同 public static function checkUserLogin $Obj = M"user"; if empty$COOKIE'userId' || empty$COOKIE'AuthenId' return false; //下面的语句直接使用$COOKIE'userId'没有过滤 $sql="select password fr...

cmseasy xss+csrf getshell

简要描述： 第一次XSS处就给了你了。 详细说明： lib/tool/frontclass.php None 访问http://localhost/template/default/test.php 漏洞证明： 第一次XSS处就给了你了。...

destoon 后门漏洞

No description provided by source...

FlashChat Arbitrary File Upload

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "FlashChat Arbitra...

CVE-2013-1439

The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service NULL pointer dereference via a crafted photo file...

Router ONO Hitron CDE-30364 - CSRF Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Router ONO Hitron CDE-30364 - CSRF Vulnerability Date: 14-9-2013 Exploit Author: Matias Mingorance Svensson - matias.msatowasp.org Vendor Homepage:...

Router ONO Hitron CDE-30364 - Cross-Site Request Forgery

Router ONO Hitron CDE-30364 - Cross-Site Request Forgery Exploit Title: Router ONO Hitron CDE-30364 - CSRF Vulnerability Date: 14-9-2013 Exploit Author: Matias Mingorance Svensson - matias.msatowasp.org Vendor Homepage:...

金蝶一个反射xss可全国钓鱼

简要描述： 无意简单发现的。 详细说明： 一开始就发现，本来觉得没危害的。但是看见所有城市的金蝶都有，果断发了。 说说我怎么发现的吧。 首先随便进入一个地址，如:binhai.kingdee.com 然后看见框框果断注入，无果。 然后正常输入的时候，看见这个。 按照经验，我闭合了title，于是效果就来了。 漏洞证明： binhai.kingdee.com/search/result.html?Submit=搜索&keyword=location.href="//www.eisoft.cc" 更好的利用方法，请自行想象。 .kingdee.com/search/result.html /...

CVE-2013-4339

WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string...

Schneider Electric PLC ETY Series Ethernet Controller - Denial of Service

Telnet server of Schenider Electric ETY Series Controllers have a security problem. We noticed that while we are connected to the PLC through telnet, if we call telnet instance inside VxWorks again it can cause the device to crash. The telnet instance name is tTelnetd which you can see in the...

SocialEngine 4.5 Shell Upload Vulnerability

SocialEngine version 4.5 suffers from a remote shell upload vulnerability. + INTRODUCTION ------------------------------------------------------------- The plugin has the objective give you a better visual for the user profile, allowed the addition of cover image keeping the layout closest to the...

StarUML - 'WinGraphviz.dll' ActiveX Buffer Overflow

Exploit Title: StarUML WinGraphviz.dll ActiveX buffer overflow vulnerability Date: 03.8.2013 Exploit Author: d3b4g Vendor Homepage:http://staruml.sourceforge.net/en/ Software Link: http://staruml.sourceforge.net/en/ Tested on: Windows XP SP3 About StarUML -------------- StarUML is an open source...