shopex最新版前台一处想不到的SQL注入

简要描述： shopex代码核心的地方都做了加密处理，找漏洞就需要一点想象空间了，比如这个SQL注入... 详细说明： 存在于用户注册想不到的位置吧？ 1. /core/shop/controller/ctl.passport.php 267行 if !$info = $account-create$POST,$message ... 2.看到1，想到有没有可能$account-create是foreach $POST构造sql语句的呐？ 3.看数据表结构： 果断提交时$POST里加入memberid测试其实测试时我还试了mobile等，嘿，只捡有用的字段说，然后就有了下图： 漏洞证明：...

Fedora Update for libkipi FEDORA-2013-10182

Check for the Version of libkipi OpenVAS Vulnerability Test Fedora Update for libkipi FEDORA-2013-10182 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora Update for libkipi FEDORA-2013-10130

Check for the Version of libkipi OpenVAS Vulnerability Test Fedora Update for libkipi FEDORA-2013-10130 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

EcShop冒充任意用户发商品评论，合理利用可操纵网店舆论

简要描述： 登录用户可以冒充任意其他注册用户对任意商品发表评论，合理利用可操纵网店舆论 详细说明： 漏洞代码在comment.php的287行处： $username = empty$cmt-username ? $SESSION'username' : trim$cmt-username; $cmt是一个json数据结构，在comment.php的37行处赋值： $cmt = $json-decode$REQUEST'cmt'; 由此可见，这里只要用户提交了"username":"any user account"的json code，就能冒充任意用户发表对指定商品的评论！ 漏洞证明：...

CVE-2011-4087

The brparseipoptions function in net/bridge/brnetfilter.c in the Linux kernel before 2.6.39 does not properly initialize a certain data structure, which allows remote attackers to cause a denial of service by leveraging connectivity to a network interface that uses an Ethernet bridge device...

CVE-2013-1929

Heap-based buffer overflow in the tg3readvpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service system crash or possibly execute arbitrary code via crafted firmware that specifies a long string in the...

UBUNTU-CVE-2013-2141

The dotkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a 1 tkill or 2 tgkill system call...

74CMS talent system v3. 2 injection& full version pass rounded out the background-bug warning-the black bar safety net

Because a station with this system next to the station is also no start so went down the parts of the source code to read Set of procedures filter is still relatively full, but all versions are GBK encoding is his flawed but basically the string into the library when the author used the iconv to...

Kernel: net/tun: ioctl() based information leaks

The tunchrioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application...

DEBIAN-CVE-2012-6547

The tunchrioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application...

DEBIAN-CVE-2012-6540

The doipvsgetctl function in net/netfilter/ipvs/ipvsctl.c in the Linux kernel before 3.6 does not initialize a certain structure for IPVSSOGETTIMEOUT commands, which allows local users to obtain sensitive information from kernel stack memory via a crafted application...

CVE-2012-6547

The tunchrioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application...

DEBIAN-CVE-2012-6541

The ccid3hctxgetsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application...

Design/Logic Flaw

The ccid3hctxgetsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application...

Varnish 2.1.5 DoS in STV_alloc() while parsing Content-Length header

STValloc | st != NULL Authors: 22733db72ab3ed94b5f8a1ffcde850251fe6f466 c8e74ebd8392fda4788179f9a02bb49337638e7b AKAT-1 Versions: 2.1.5 Full panic message: Panic message: Assert error in STValloc, stevedore.c line 192:012 Conditionst != NULL not true. Summary: Varnish 2.1.5 crash and restart via...

Ruby on Rails 远程代码执行漏洞(CVE-2013-0277)

BUGTRAQ ID: 57898 CVECAN ID: CVE-2013-0277 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails 3.x、2.3.x中的活动记录允许远程攻击者通过特制的序列化属性造成拒绝服务或执行任意代码，这些特制的属性可造成+serialize+ helper反序列化任意YAML。 0 Ruby on Rails 3.2.x Ruby on Rails 3.1.x Ruby on Rails 2.3.x 厂商补丁： Ruby on Rails...

UBUNTU-CVE-2012-6541

The ccid3hctxgetsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application...

Oracle Outside In CorelDRAW File Parser Heap Buffer Overflow (CVE-2013-0418)

A heap buffer overflow vulnerability exists in Oracle Outside In. The vulnerability is due to an error when processing Coords structure for loda chunks of type 3 Line/Curve. Remote attackers could exploit the vulnerability to inject and execute arbitrary code in the context of the vulnerable...

nss-pam-ldapd fd_set overflow

FDSET structure overflow...

Photodex ProShow Producer 5.0.3297 - '.pxs' Memory Corruption

!/usr/bin/python Exploit Title: Photodex ProShow Producer v5.0.3297 .pxs Memory Corruption Vulnerability Version: = 5.0.3297 Date: 2013-02-14 Author: Julien Ahrens @MrTuxracer Homepage: http://www.inshell.net Software Link: http://www.photodex.com Tested on: Windows XP SP3 Professional German...