Code execution vulnerability in LaySNS v2.2.0 System.php page

LaySNS Light Community is a comprehensive website system based on ThinkPHP5+LayUI that integrates content publishing and community exchange. A code execution vulnerability exists in the program implementation of the LaySNS v2.2.0 System.php page, which is due to the system's failure to strictly...

PHPCMS V9 version of the background design flaws lead to arbitrary code execution vulnerability

Source link: http://www.cnbraid.com/ 0x01 background Since the default after installation requires Super administrator privileges, so the vulnerability is very tasteless, but the feeling should be in other cms, there are also, so the main share under the mining idea PS: using the test environment...

GlobalSearch CMS system.php parameter id SQL injection vulnerability

No description provided by source...

CVE-2015-1603

Multiple cross-site scripting XSS vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter to index.php or 2 id parameter in a usersusers action to asys/site/system.php...

CVE-2015-1603: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter to index.php or 2 id parameter in a usersusers action to asys/site/system.php...

cmseasy 后台缓存配置文件未过滤一个字符导致getshell

简要描述： cmseasy 管理员身份 后台缓存配置文件，没有过滤一个字符导致getshell 详细说明： 啥都不说了 直接看代码： 我们直接到 然后我们分析一下代码: system.php:lines:67: ifaddslashes$POST'customerinfo' $customerinfo='true'; else $customerinfo='false'; $GLOBALS'celsysteminfo'-confaddslashes$POST'url', addslashes$POST'template',...

anwsion一个类设置缺陷导致安全过滤失效，附带一个利用案例

简要描述： anwsion一个类设置缺陷。哎。。。。 详细说明： 真心蛋疼！！！！！ models/system.php public function analysiskeyword$string $string = strreplacearray "", "!", "@", "", "$", "%", "^", "&", "", ",", ".", "?", ";", ":", "'", '"', "", "", "", "", "！", " ￥", "……", "…", "、", "，", "。", "？", "；", "：", "‘", "“", "”", "’", " 【",...

CVE-2011-0505

Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the settemplatevalue parameter...

Directory traversal

Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the settemplatevalue parameter...

CVE-2011-0505

CVE-2011-0505 affects Zwii 2.1.1, specifically the directory traversal flaw in system/system.php. The root cause is that when magic_quotes_gpc is disabled and register_globals is enabled, an attacker can manipulate the set[template][value] parameter to include and execute arbitrary local files. T...

CVE-2011-0505

Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the settemplatevalue parameter...

CVE-2011-0505: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the settemplatevalue parameter...

Zwii v 2.1.1 Remote File Inclusion Vulnerbility

Exploit for php platform in category web applications Exploit Title: Zwii v 2.1.1 Remote file include vulnerbility Google Dork: Propulsé par Zwii 2.1.1 Date: 08/01/2011 Author: Abdi Mohamed Software Link: http://scripts.toocharger.com/fiches/scripts/zwii/5147.htm Version: v 2.1.1 Tested on: ubun...

Zwii 2.1.1 - Remote File Inclusion

Zwii 2.1.1 - Remote File Inclusion Exploit Title: Zwii v 2.1.1 Remote file include vulnerbility Google Dork: Propulsé par Zwii 2.1.1 Date: 08/01/2011 Author: Abdi Mohamed Software Link: http://scripts.toocharger.com/fiches/scripts/zwii/5147.htm Version: v 2.1.1 Tested on: ubuntu + centos Email :...

Zwii 2.1.1 - Remote File Inclusion

Exploit Title: Zwii v 2.1.1 Remote file include vulnerbility Google Dork: Propulsé par Zwii 2.1.1 Date: 08/01/2011 Author: Abdi Mohamed Software Link: http://scripts.toocharger.com/fiches/scripts/zwii/5147.htm Version: v 2.1.1 Tested on: ubuntu + centos Email : [email protected] -...

V-Webmail 1.6.4 - includespearSystem.php?CONFIG[pear_dir] Remote File Inclusion

V-Webmail 1.6.4 - includespearSystem.php?CONFIGpeardir Remote File Inclusion source: https://www.securityfocus.com/bid/30162/info V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an...

CVE-2008-2820

Directory traversal vulnerability in lang/lang-system.php in Open Azimyt CMS 0.22 minimal and 0.21 stable allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2008-2820: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in lang/lang-system.php in Open Azimyt CMS 0.22 minimal and 0.21 stable allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2008-1911: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via a cookpass cookie...

1024 CMS <= 1.4.2 Local File Inclusion / Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ==================================================================== 1024 CMS = 1.4.2 Local File Inclusion / Blind SQL Injection Exploit ==================================================================== Author: GiReX Date: 13/04/2008 CM...