SQLMap Web Front End

PHP Front end to work with the SQLMAP JSON API Server sqlmapapi.py to allow for a Web GUI to drive near full functionality of SQLMAP! Windows 2003 Server, IIS/6.0 + ASP + MS-SQL 2005 SQLMap Web GUI Requirements: Linux, Apache, PHP check your favorite distro’s wiki or forum pages, or use google PH...

Web Security Dojo

Web Security Dojo is a preconfigured, stand-alone training environment for Web Application Security. Virtualbox and VMware versions are available for download. Dojo is an open source project intended to be used as a training environment, and shouldn’t be used as a pen-testing platform due to the...

White Way Systems SQL Injection

========================================================= + Title :- White Way Systems CMS - SQL Injection Vulnerability + Date :- 19 - June - 2015 + Vendor Homepage: :- http://whitewaysystems.co.za/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :-...

Why Web Developments SQL Injection

========================================================= + Title :- Why Web Developments CMS - SQL Injection Vulnerability + Date :- 19 - June - 2015 + Vendor Homepage: :- http://www.whyweb.co.za/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :-...

Easy2Map Photos <= 1.0.9 - SQL Injection

The code in Functions.php is vulnerable to SQL Injection because they are not parameterising or sanitising user input. PoC sqlmap -u 'http://www.example.com/wp-admin/admin-ajax.php' --data="mapID=11='+or+1%3D%3D1%3B=e2mimgsavemapname" --cookie=COOKIEHERE --level=5 --risk=3...

Pasworld - detail.php Blind SQL Injection

Pasworld - detail.php Blind SQL Injection ========================================================= + Title :- Pasworld detail.php Blind Sql Injection Vulnerability + Date :- 5 - June - 2015 + Vendor Homepage: :- http://main.pasworld.co.th/ + Version :- All Versions + Tested on :- Nginx/1.4.5,...

Pasworld - 'detail.php' Blind SQL Injection

========================================================= + Title :- Pasworld detail.php Blind Sql Injection Vulnerability + Date :- 5 - June - 2015 + Vendor Homepage: :- http://main.pasworld.co.th/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :-...

WordPress LeagueManager 3.9.11 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress LeagueManager SQLi Version: 3.9.11 Vendor: https://wordpress.org/plugins/leaguemanager Software Link: https://downloads.wordpress.org/plugin/leaguemanager.3.9.1.1.zip Author: javabudd Date: 06/01/2015 Tested on: Linux ...

WordPress Booking Calendar Contact Form Plugin 1.0.2 /dex_bccf.php SQL注入漏洞

/dexbccf.phpfunction dexbccfcaculateprice$startday, $enddate, $calendar, $defaultprice ... //$calendar is not sanitized in sql query $codes = $wpdb-getresults 'SELECT FROM '.$wpdb-prefix.DEXBCCFSEASONPRICESTABLENAMENOPREFIX.' WHERE calid='.$calendar; $mode =...

WordPress GigPress 2.3.8 SQL Injection Vulnerability

WordPress GigPress plugin version 2.3.8 suffers from a remote SQL injection vulnerability. Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+...

WordPress GigPress 2.3.8 SQL Injection

Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+ Vulnerable version: 2.3.8 Fixed version: 2.3.9 CVE: CVE-2015-4066 Vulnerabilities 2...

服务接口存在sql注射漏洞，泄漏全国渠道和用户信息

简要描述： 服务接口存在sql注射漏洞，泄漏全国渠道和用户信息 详细说明： 1、访问http://t.ufida.com.cn/，发现存在大量的开放接口，对其中的GetVerSionJSON进行测试，发现存在sql注射漏洞。 2、注入的请求内容如下： POST /Service.asmx HTTP/1.1 Host: t.ufida.com.cn Content-Type: text/xml; charset=utf-8 Content-Length: length SOAPAction: "http://tempuri.org/GetVerSionJSON" u8 执行 sqlmap ...

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1...

WordPress FeedWordPress Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1...

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection

Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1 Authenticated SQLi CWE-89 -------------------------------...

Milw0rm Clone Script 1.0 SQL Injection

| Exploit Title: Milw0rm Clone Script v1.0 - time based SQLi | | Date: 05.19.2015 | | Exploit Daddy: pancaker | | Vendor Homepage: http://milw0rm.sourceforge.net/ | | Software Link: http://sourceforge.net/projects/milw0rm/files/milw0rm.rar/download | | Version: v1.0 | | Tested On: Ubuntu 10.04 | ...

CRUCMS Crucial Networking - SQL Injection Vulnerability

Document Title: =============== CRUCMS Crucial Networking - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1497 Release Date: ============= 2015-05-17 Vulnerability Laboratory ID VL-ID: ==================================== 14...

Web India Solutions CMS 2015 - SQL Injection Vulnerability

Document Title: =============== Web India Solutions CMS 2015 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1495 Release Date: ============= 2015-05-12 Vulnerability Laboratory ID VL-ID: ====================================...

用友某金融站点存在sql注射漏洞

简要描述： 不求礼物，但求rank。 详细说明： 站点为：https://www.yonyoufinancial.com 存在PHPcmsV9 referer 注入漏洞 使用exp获取管理员帐号密码： 然后觉得能拿到的东西太少，丢sqlmap跑了一下： 可惜不是root权限，要不直接写shell了～ exp链接（来自独自等待大牛博客）： http://www.waitalone.cn/phpcmsv9-posterclick-injection-exp.html 漏洞证明： 如上...

Coremail官网SQL注入可读全库

简要描述： coremail官网存在注入，有防护，可绕过。 详细说明： 漏洞地址：http://www.coremail.cn/gjzc2/list117.aspx?lcid=412 漏洞证明： 有防护，直接用sqlmap加个tamper=chardoubleencode.py可以跑出来。 这个是sqlmap用的payload： Place: GET Parameter: lcid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: lcid=412 AND...