153 matches found
SiteServer CMS 代码注入漏洞
SiteServer CMS is an open-source content management system CMS from China's Bairong Thousand Domains Software Technology Development Company. A code injection vulnerability exists in SiteServer CMS version 7.x. The vulnerability stems from improper input validation in a plug-in feature...
Arbitrary File Download Vulnerability in SiteServer CMS
SiteServer CMS is open source, cross-platform, enterprise-class CMS content management system. SiteServer CMS suffers from an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...
SQL Injection Vulnerability in SiteServer CMS Backend
SiteServer CMS is an open source and free enterprise-level CMS system developed by Beijing Baiyong Qianwei Software Technology Development Co. A SQL injection vulnerability exists in the backend of SiteServer CMS. An attacker can exploit the vulnerability to obtain sensitive information in the...
SQL Injection Vulnerability in SiteServer CMS
SiteServer CMS is an open source and free enterprise-level CMS system developed by Beijing Baiyong Qianwei Software Technology Development Co. SiteServer CMS suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...
SQL Injection Vulnerability in SiteServer CMS
SiteServer CMS is an open source, free, enterprise-class CMS content management system. SiteServer CMS suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...
Arbitrary Code Execution
siteserver cms is vulnerable to arbitrary code execution. Improper validation of the file extension allows an administrator to upload a file with extension .aassp, which would be converted to .asp after the .as substring is removed. The code in the file will be executed in the context of the serv...
CVE-2019-11401
A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted...
CVE-2019-11401
A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted...
Code injection
A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted...
SiteServer CMS Arbitrary Code Execution Vulnerability
SiteServer CMS is an open source, free, enterprise-class CMS content management system. An arbitrary code execution vulnerability exists in SiteServer CMS 6.9.0. The vulnerability stems from the fact that administrators can add a permitted file extension .aassp, which is converted to .asp due to...
CVE-2019-11401
A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted...
CVE-2019-11401
SiteServer CMS 6.9.0 is affected. The issue allows remote code execution when an administrator can add the permitted file extension .aassp, which is converted to .asp after the substring “as” is deleted. This bypasses file-extension filtering and enables an attacker to execute arbitrary code on t...
Override Access Vulnerability in SiteServer CMS Administration Backend
SiteServer CMS is a web content management system developed by Beijing Billion Software Technology Development Co. A vulnerability exists in the management background of SiteServer CMS. The vulnerability is due to the background access control using JWT technology for identity authentication, HTT...
Siteserver CMS userlist. aspx parameter userName SQL injection vulnerability
No description provided by source...
Siteserver a SQL injection vulnerability-vulnerability warning-the black bar safety net
In the space on the module there is an injection vulnerability SQL injectionvulnerability file: code area /livefiles/pages/inner/userlist.aspx?ModuleType=Friends&RelatedUserType=Friends&UserModuleClientID=ctl00ctl00TemplateHolderContentHolderctl06&userName=1%27and%20@@version%3E0-- Case: code are...
Siteserver 内容管理系统 /livefiles/pages/inner/userlist.aspx SQL 注入
No description provided by source...
SiteServer cms系统modal_UserView.aspx页面 sql注入漏洞
1.漏洞代码。 在Bin\UserCenter.Pages.dll文件中，UserCenter.BackgroundPages.Modal.UserView类的PageLoad方法中，可以见到如下代码： public void PageLoadobject sender, EventArgs e string text = base.Request.QueryString"UserName"; //获取UserName bool flag2; bool flag = flag2 ? 1u : 0u 4294967295u; ArrayList arrayList; if !flag if...
SiteServer XSS+background uploading(the chicken help combination still very adorable)-vulnerability warning-the black bar safety net
Siteserver XSS+background randomly generated webshell Test version: SiteServer V3. 4. 3 1, The storage-typeXSS, www.xxx.com/UserCenter/main.aspx website content submission, click published,to edit click on the source-insert a periodXSSS,such as”scriptalert2 2 2 2 2 2 2 2 2 2 2/script,click on...