某学位论文提交系统通用SQL注入

简要描述： 详细说明： 某学位论文提交系统通用SQL注入。 案例： http://...:8001/paper/submit1.jsp ...:8001/paper/submit1.jsp http://...:8080/paper/submit1.jsp ...:8001/paper/submit1.jsp http://...:8001/paper/submit1.jsp 漏洞证明： 注入证明：（POST） 例：http://...:8001/paper/submit1.jsp 单引号输出报错 POST数据 POST /papercon HTTP/1.1 Accept:...

青果教务系统高危无限制注射(影响海量学校)

简要描述： 这么严重的SQL注射；青果会来确认吗？ 详细说明： 青果某系统存在无限制SQL注射；居然没有见到传说中的WAF拦截；并且大部分可以使用SQLMAP自动化注入测试工具进行测试；并且均为DBA权限；危害极大！ SQL Injection： /data/indexLOGIN.aspx 学生登录时UserID参数存在SQL注射漏洞 Case: 99%以上都是存在该漏洞；我想我该Mask一下保护这些学生！审核员你说呢？ 手工 1、...

SQLMAP-Web-GUI - Web GUI to drive near full functionality of SQLMAP

PHP Frontend to work with the SQLMAP JSON API Server sqlmapapi.py to allow for a Web GUI to drive near full functionality of SQLMAP! Here is a few quick videos to show that almost all of your usual SQLMAP command line functionality is still possible via this Web GUI. Demo against: Windows 2003...

SQLMap Web Front End

PHP Front end to work with the SQLMAP JSON API Server sqlmapapi.py to allow for a Web GUI to drive near full functionality of SQLMAP! Windows 2003 Server, IIS/6.0 + ASP + MS-SQL 2005 SQLMap Web GUI Requirements: Linux, Apache, PHP check your favorite distro’s wiki or forum pages, or use google PH...

Web Security Dojo

Web Security Dojo is a preconfigured, stand-alone training environment for Web Application Security. Virtualbox and VMware versions are available for download. Dojo is an open source project intended to be used as a training environment, and shouldn’t be used as a pen-testing platform due to the...

White Way Systems SQL Injection

========================================================= + Title :- White Way Systems CMS - SQL Injection Vulnerability + Date :- 19 - June - 2015 + Vendor Homepage: :- http://whitewaysystems.co.za/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :-...

Why Web Developments SQL Injection

========================================================= + Title :- Why Web Developments CMS - SQL Injection Vulnerability + Date :- 19 - June - 2015 + Vendor Homepage: :- http://www.whyweb.co.za/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :-...

Pasworld - 'detail.php' Blind SQL Injection

========================================================= + Title :- Pasworld detail.php Blind Sql Injection Vulnerability + Date :- 5 - June - 2015 + Vendor Homepage: :- http://main.pasworld.co.th/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :-...

Easy2Map Photos <= 1.0.9 - SQL Injection

The code in Functions.php is vulnerable to SQL Injection because they are not parameterising or sanitising user input. PoC sqlmap -u 'http://www.example.com/wp-admin/admin-ajax.php' --data="mapID=11='+or+1%3D%3D1%3B=e2mimgsavemapname" --cookie=COOKIEHERE --level=5 --risk=3...

Pasworld - detail.php Blind SQL Injection

Pasworld - detail.php Blind SQL Injection ========================================================= + Title :- Pasworld detail.php Blind Sql Injection Vulnerability + Date :- 5 - June - 2015 + Vendor Homepage: :- http://main.pasworld.co.th/ + Version :- All Versions + Tested on :- Nginx/1.4.5,...

SQLiPy - Plugin for Burp Suite that integrates SQLMap using the SQLMap API

SQLiPy is a Python plugin for Burp Suite that integrates SQLMap using the SQLMap API. SQLMap comes with a RESTful based server that will execute SQLMap scans. This plugin can start the API for you or connect to an already running API to perform a scan. Requirements Jython 2.7 beta, due to the use...

WordPress LeagueManager 3.9.11 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress LeagueManager SQLi Version: 3.9.11 Vendor: https://wordpress.org/plugins/leaguemanager Software Link: https://downloads.wordpress.org/plugin/leaguemanager.3.9.1.1.zip Author: javabudd Date: 06/01/2015 Tested on: Linux ...

WordPress Booking Calendar Contact Form Plugin 1.0.2 /dex_bccf.php SQL注入漏洞

/dexbccf.phpfunction dexbccfcaculateprice$startday, $enddate, $calendar, $defaultprice ... //$calendar is not sanitized in sql query $codes = $wpdb-getresults 'SELECT FROM '.$wpdb-prefix.DEXBCCFSEASONPRICESTABLENAMENOPREFIX.' WHERE calid='.$calendar; $mode =...

WordPress GigPress 2.3.8 SQL Injection Vulnerability

WordPress GigPress plugin version 2.3.8 suffers from a remote SQL injection vulnerability. Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+...

服务接口存在sql注射漏洞，泄漏全国渠道和用户信息

简要描述： 服务接口存在sql注射漏洞，泄漏全国渠道和用户信息 详细说明： 1、访问http://t.ufida.com.cn/，发现存在大量的开放接口，对其中的GetVerSionJSON进行测试，发现存在sql注射漏洞。 2、注入的请求内容如下： POST /Service.asmx HTTP/1.1 Host: t.ufida.com.cn Content-Type: text/xml; charset=utf-8 Content-Length: length SOAPAction: "http://tempuri.org/GetVerSionJSON" u8 执行 sqlmap ...

WordPress GigPress 2.3.8 SQL Injection

Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+ Vulnerable version: 2.3.8 Fixed version: 2.3.9 CVE: CVE-2015-4066 Vulnerabilities 2...

WordPress FeedWordPress Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1...

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1...

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection

Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1 Authenticated SQLi CWE-89 -------------------------------...

Milw0rm Clone Script 1.0 SQL Injection

| Exploit Title: Milw0rm Clone Script v1.0 - time based SQLi | | Date: 05.19.2015 | | Exploit Daddy: pancaker | | Vendor Homepage: http://milw0rm.sourceforge.net/ | | Software Link: http://sourceforge.net/projects/milw0rm/files/milw0rm.rar/download | | Version: v1.0 | | Tested On: Ubuntu 10.04 | ...