157 matches found
SiteServer cms系统modal_UserView.aspx页面 sql注入漏洞
1.漏洞代码。 在Bin\UserCenter.Pages.dll文件中，UserCenter.BackgroundPages.Modal.UserView类的PageLoad方法中，可以见到如下代码： public void PageLoadobject sender, EventArgs e string text = base.Request.QueryString"UserName"; //获取UserName bool flag2; bool flag = flag2 ? 1u : 0u 4294967295u; ArrayList arrayList; if !flag if...
SiteServer XSS+background uploading(the chicken help combination still very adorable)-vulnerability warning-the black bar safety net
Siteserver XSS+background randomly generated webshell Test version: SiteServer V3. 4. 3 1, The storage-typeXSS, www.xxx.com/UserCenter/main.aspx website content submission, click published,to edit click on the source-insert a periodXSSS,such as”scriptalert2 2 2 2 2 2 2 2 2 2 2/script,click on...
siteserver 4.0 /Beta/dialog/forget.aspx SQL注入漏洞
No description provided by source...
SiteServer 3.6.4 /siteserver/cms/console_logSite.aspx SQL注入漏洞
No description provided by source...
SiteServer 3.6.4 /siteserver/bbs/background_user.aspx SQL注入漏洞
SiteServer 3.6.4 /siteserver/bbs/backgrounduser.aspx 文件keyword使用了位于/Bin/SiteServer.BBS.dll代码，在接收参数没有合适过滤，导致SQL注入漏洞。 SiteServer 3.6.4...
SiteServer 3.6.4 /siteserver/cms/background_nodeGroup.aspx SQL注入漏洞
No description provided by source...
SiteServer 3.6.4 /siteserver/bbs/background_post.aspx SQL注入漏洞
SiteServer 3.6.4 /siteserver/bbs/backgroundpost.aspx文件Tile参数没有合适过滤，导致SQL注入漏洞。 SiteServer 3.6.4...
SiteServer 3.6.4 /SiteServer/cms/console_user.aspx SQL注入漏洞
No description provided by source...
SiteServer 3.6.4 安全模式绕过漏洞
No description provided by source...
SiteServer 3.6.4 /ask/search.aspx SQL注入漏洞
No description provided by source...
SiteServer 3.6.4 /siteserver/cms/modal_contentGroupAdd.aspx SQL注入漏洞
No description provided by source...
SiteServer 3.6.4 /siteserver/UserRole/background_userAdd.aspx SQL注入漏洞
No description provided by source...
SiteServer 3.6.4 /siteserver/cms/modal_contentTagAdd.aspx SQL注入漏洞
No description provided by source...
SiteServer 3.6.4 /siteserver/cms/background_channelsGroup.aspx SQL注入漏洞
No description provided by source...
siteserver latest version 3. 6. 4 sql inject-vulnerability warning-the black bar safety net
http://xxx.com/siteserver/service/backgroundtaskLog.aspx?Keyword=test%' and @@version=1 and 2='1&DateFrom=&DateTo=&IsSuccess=All The injection point is present in the Keyword, completely without any filtering. VariousSQL injectiontype, you can execute os cmd, off pants 2. The second injection...
SiteServer 3.6.4 background_taskLog.aspx SQL注入漏洞
SiteServer 3.6.4 /siteserver/service/backgroundtaskLog.aspx文件使用了位于/Bin/BaiRong.BackgroundPages.dll代码，在接收keyword参数没有合适过滤，导致SQL注入漏洞。 0 SiteServer 3.6.4 升级到官方最新版： http://www.siteserver.cn...
SiteServer 3.6.4 background_mailSubscribe.aspx SQL注入漏洞
注入存在/siteserver/cms/backgroundmailSubscribe.aspx 用.NET Reflector 反编译SiteServer.CMS.dll这个文件 查看代码如下： if uint isPostBack - uint isPostBack = 0 && isPostBack this.spContents.SelectCommand = DataProvider.MailSubscribeDAO.GetSelectCommendbase.PublishmentSystemID, base.Request.QueryString"Keyword",...
siteserver latest version 3. 6. 4 background_log. aspx page sql injection vulnerability-vulnerability warning-the black bar safety net
There siteserver/platform/backgroundlog. aspx 用 .NET Reflector decompile BaiRong. BackgroundPages. dll this file View Code is as follows: this. spContents. ConnectionString = BaiRongDataProvider. ConnectionString; flag = base. Request. QueryString"UserName" != null; if ! flag this. spContents...