CVE-2022-28118

CVE-2022-28118 : SiteServer CMS v7.x is vulnerable to remote code execution via a crafted plug-in. The underlying issue is described as improper input validation in the plug-in feature, enabling an attacker to execute arbitrary code on affected systems. Multiple sources corroborate an RCE in Site...

SiteServer CMS 代码注入漏洞

SiteServer CMS is an open-source content management system CMS from China's Bairong Thousand Domains Software Technology Development Company. A code injection vulnerability exists in SiteServer CMS version 7.x. The vulnerability stems from improper input validation in a plug-in feature...

Arbitrary File Download Vulnerability in SiteServer CMS

SiteServer CMS is open source, cross-platform, enterprise-class CMS content management system. SiteServer CMS suffers from an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in SiteServer CMS

SiteServer CMS is an open source, free, enterprise-class CMS content management system. SiteServer CMS suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Arbitrary Code Execution

siteserver cms is vulnerable to arbitrary code execution. Improper validation of the file extension allows an administrator to upload a file with extension .aassp, which would be converted to .asp after the .as substring is removed. The code in the file will be executed in the context of the serv...

CVE-2019-11401

A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted...

CVE-2019-11401

A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted...

Code injection

A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted...

SiteServer CMS Arbitrary Code Execution Vulnerability

SiteServer CMS is an open source, free, enterprise-class CMS content management system. An arbitrary code execution vulnerability exists in SiteServer CMS 6.9.0. The vulnerability stems from the fact that administrators can add a permitted file extension .aassp, which is converted to .asp due to...

CVE-2019-11401

SiteServer CMS 6.9.0 is affected. The issue allows remote code execution when an administrator can add the permitted file extension .aassp, which is converted to .asp after the substring “as” is deleted. This bypasses file-extension filtering and enables an attacker to execute arbitrary code on t...

CVE-2019-11401

A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted...

Override Access Vulnerability in SiteServer CMS Administration Backend

SiteServer CMS is a web content management system developed by Beijing Billion Software Technology Development Co. A vulnerability exists in the management background of SiteServer CMS. The vulnerability is due to the background access control using JWT technology for identity authentication, HTT...

Siteserver CMS userlist. aspx parameter userName SQL injection vulnerability

No description provided by source...

Siteserver 内容管理系统 /livefiles/pages/inner/userlist.aspx SQL 注入

No description provided by source...

SiteServer 3.6.4 /siteserver/cms/modal_contentGroupAdd.aspx SQL注入漏洞

No description provided by source...

Siteserver CMS 3.6.3 SQL注入漏洞

SiteServer CMS 是基于微软.NET 平台开发的网站内容管理系统。 Siteserver 3.6.3版本存在SQL注入漏洞，由于ENName参数没有经过任何过滤，攻击者可以利用漏洞执行任意命令。 0 Siteserver CMS 3.6.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.siteserver.cn/...

SiteServer cms Cookie spoofing vulnerability-vulnerability warning-the black bar safety net

Brief description: . net platform SiteServer cms he the powerful is unquestionable, but the problem is also many, The discovery of the cookies tricking a gold after testing, 3.44 above version of the pass to kill Detailed description: ! Local set up an environment and then log in to grab the...

SiteServer CMS 3.5 background upload WEBSHELL-vulnerability warning-the black bar safety net

Version number: SiteServer CMS 3.5 Background,Upload a single GIF format Trojan. Then,through the site, file management,modify the file name,you can modify the picture Trojan horse in the format . aspx Version number: SiteServer CMS 3.5 http://demo2.siteserver.cn/siteserver/login.aspx Account:...

SiteServer CMS 0Day-vulnerability warning-the black bar safety net

After testing spike the latest of the 3. Version 5 stieserver official website:www. siteserver. cn EXP: Direct access to the UserCenter/login. aspx The username at the input: 1 2 3'insert into bairongAdministratorUserName,Password,PasswordFormat,PasswordSalt...

SiteServer CMS program upload filter is not strict can lead to get shell-vulnerability warning-the black bar safety net

A day with the Night chat, accidentally discovered SiteServer CMS upload vulnerability, the filter is not strictly http://demo2. siteserver. cn today to test under the main station of this presentation template Before this app also has pop user name is not filtered strictly to be used, update the...