用友FE协作办公系统SQL注入漏洞(一)

简要描述： 用友FE协作办公系统某处过滤不严，导致SQL注入漏洞 详细说明： 用友FE协作办公系统某处过滤不严，导致SQL注入漏洞，可直接union注入 注入链接：/sys/treeXml.jsp?Si06=1&type=sort 注入参数：Si06 Payload： Si06=1%27+UNION+ALL+SELECT+1,@@version,1,1,1,1,1,1,1,1,1,1,1,1--&type=sort Sqlmap命令： python sqlmap.py -u 'http://xxxx//sys/treeXml.jsp?Si06=1&type=sort' -p Si06...

大米CMS某处SQL盲注2

简要描述： 大米CMS某处SQL盲注第二发，可直接拖库 详细说明： 文件/Web/Lib/Action/ApiAction.class.php //万能获取数据接口 function ajaxarclist $prefix = !empty$REQUEST'prefix'?bool$REQUEST'prefix':true; //表过滤防止泄露信息,只允许的表 if!inarray$REQUEST'model',array'article','type','ad','label','link'exit; if!empty$REQUEST'model' if$prefix == true...

Etiko CMS index.php cross-site scripting vulnerability-vulnerability warning-the black bar safety net

Affected system: Etiko Etiko CMS Description: CVECAN ID: CVE-2 0 1 4-8 5 0 5 Etiko CMS is a content management system. Etiko CMS did not effectively verify the index. php script input, in the realization on the presence of cross-site scripting vulnerability, a remote attacker with the structure o...

用友FE协作办公系统SQL注入漏洞

简要描述： RT 详细说明： 用友FE协作办公系统某处过滤不严，导致SQL注入漏洞，可直接union注入 注入链接：/system/config/deptTreeXml.jsp?type=group&SG04=1 注入参数：SG04 Payload：SG04=1'+UNION+ALL+SELECT+1,@@version,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1-- Sqlmap注入：python sqlmap.py -u 'http://xxxx/system/config/deptTreeXml.jsp?type=group&SG04=1...

WordPress Plugin CP Multi View Event Calendar 1.01 - SQL Injection

WordPress Plugin CP Multi View Event Calendar 1.01 - SQL Injection Exploit Title : CP Multi View Event Calendar 1.01 SQL Injection Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/cp-multi-view-calendar.zip Date : 2014-10-23 Tested on : Windows...

WordPress CP Multi View Event Calendar 1.01 SQL Injection Vulnerability

WordPress CP Multi View Event Calendar plugin version 1.01 suffers from a remote SQL injection vulnerability. Exploit Title : CP Multi View Event Calendar 1.01 SQL Injection Vulnerability Exploit Author : Claudio Viviani Software Link :...

WordPress CP Multi View Event Calendar 1.01 SQL Injection

Exploit Title : CP Multi View Event Calendar 1.01 SQL Injection Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/cp-multi-view-calendar.zip Date : 2014-10-23 Tested on : Windows 7 / Mozilla Firefox Windows 7 / sqlmap 0.8-1 Linux / Mozilla...

BIWEB开源CMS V5.86存在SQL注射

简要描述： 0.0 新手彩笔第一次么么哒 详细说明： biweb/cases/include/index.inc.php 23行-50行 $arrWhere = array; $arrLink = array; $arrWhere = "pass='1'"; $typetitle = ''; if !empty$GET'typeid' $intTypeID = intval$GET'typeid'; $typeid = $intTypeID - 1; $typetitle = $arrMType$typeid'typetitle';...

CMS Subkarma Cross Site Scripting / SQL Injection Vulnerabilities

CMS Subkarma suffers from cross site scripting and remote SQL injection vulnerabilities. Note that this finding houses site-specific data. Multiple SQL Injection & XSS on CMS SUBKARMA Risk: High CWE number: CWE-89,CWE-79 Date: 13/10/2014 Vendor: www.jttel.com.tw Author: Felipe " Renzi " Gabriel...

Etiko CMS Cross Site Scripting / SQL Injection

SQL Injection & XSS on Etiko CMS. Risk: High CWE number: CWE-89,CWE-79 Date: 13/10/2014 Vendor: www.etikweb.com Version: All Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on: Windows 8 ; Chrome ; Sqlmap 1.0-dev-nongit-20140906 Vulnerables Files: /index.php & /loja/index.php...

MVO - Maquina Vendas Online SQL Injection

SQL Injection on MVO ? - M?quina Vendas Online Risk: High CWE number: CWE-89 Date: 13/10/2014 Vendor: adnweb.es Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on: Linux Mint ; Firefox ; Sqlmap 1.0-dev-nongit-20140906 Vulnerable File: product.php Exploits:...

CMS Subkarma Cross Site Scripting / SQL Injection

Multiple SQL Injection & XSS on CMS SUBKARMA Risk: High CWE number: CWE-89,CWE-79 Date: 13/10/2014 Vendor: www.jttel.com.tw Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on: Linux Mint ; Firefox ; Sqlmap 1.0-dev-nongit-20140906 Vulnerables File: news.php ; product.php ;...

TinyShop V1.0.2 电子商务系统 SQL注入（gpc开启）

简要描述： TinyShop最新版SQL注入一枚。 简直被审核系统搞无语了，麻烦乌云加上时钟跟分钟好吗？不然早提交几小时几分钟的同学跟自动审核的人一起提交只有遭殃的份。 重复重复，重复你妹啊！ ps：亲 时间是通过审核的时间，请看漏洞ID区分先后顺序 当前时间：2014.7.10 11.44 详细说明： 上个漏洞厂商说不要一起发SQL注入了，下个版本会一起处理。现在来看看怎么处理的。 framework\lib\util\filterclass.php： 文件定义了过滤机制： public static function sql$str if getmagicquotesgpc $str...

Ultra Electronics SSL VPN 7.2.0.19 / 7.4.0.7 SQL Injection / Directory Creation

Ultra Electronics SSL VPN versions 7.2.0.19 and 7.4.0.7 suffer from directory creation and remote SQL injection vulnerabilities. Ultra Electronics / AEP Networks - SSL VPN Netilla / Series A / Ultra Protect Vulnerabilities http://www.osisecurity.com.au/advisories/ultra-aep-netilla-vulnerabilities...

Wordpress Like Dislike Counter 1.2.3 Plugin - SQL Injection Vulnerability

一、插件介绍 是一个支持文章、页面和评论投票顶踩的插件，你可以将顶踩放在文章、页面评论的任意位置，还可以放在网站首页上。如果你有一定代码修改能里的话，可以将本插件集成到主题里。 二、漏洞概述 Like Dislike Counter 1.2.3及其他版本存在多个SQL注入漏洞，成功利用后可使攻击者执行未授权数据库操作。 三、漏洞描述 Like Dislike Counter 插件SQL注入漏洞存在于ajaxcounter.php文件中，主要原因是未对POST数据中的postid进行有效过滤，致使非法数据被数据库正常解析执行。 四、漏洞分析...

SqlMap of mysql udf.dll provide right-vulnerability warning-the black bar safety net

First upload the dll file to any directory, such as: D:/RECYCLER/libmysqludfsys.dll Import the dll,according to the version of the import to windows or the mysql plugin directorytypically executing a select @@plugindir can be seen in the plugin directory specific path select...

WordPress Spider Facebook 1.0.8 SQL Injection

Exploit Title : Wordpress Spider Facebook 1.0.8 Authenticated SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://web-dorado.com/ Software Link : http://downloads.wordpress.org/plugin/spider-facebook.1.0.8.zip Date : 2014-08-25 Tested on : Windows 7 / Mozilla Firefox Linux /...

Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection

No description provided by source. Exploit Title : Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://huge-it.com/ Software Link : http://downloads.wordpress.org/plugin/gallery-images.zip Mirror Link :...

WordPress Huge IT Image Gallery 1.0.0 SQL Injection

Exploit Title : Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://huge-it.com/ Software Link : http://downloads.wordpress.org/plugin/gallery-images.zip Mirror Link :...

TinyShop SQL注入

简要描述： 未过滤，导致注入 详细说明： 问题出现在/protected/controllers/simple.php中： //捆绑商品数量 public function bundbuynum $id = Filter::intReq::args'id'; $num = Filter::intReq::args'num'; if$numwhere"id=$id"-find; if$bund//为了条件语句执行，$id要存在。 $goodsid = $bund'goodsid'; $products = $model-table"goods as go"-join"left join...