ThinkPHP远程代码执行隐患（需满足特定条件）

简要描述： 其某处处理存在安全隐患，开发者一不小心就可能写出有漏洞的代码造成任意代码执行。 详细说明： 这个问题之前看ThinkSNS就发现了： WooYun: ThinkSNS getshell一枚 ThinkSNS由于使用ThinkPHP模板，造成任意代码执行。 下面分析下ThinkPHP实现细节 模板类是ThinkPHP中一个重要的类，主要实现了为模板变量赋值，模板解析和输出模板变量的逻辑，其中模板变量的赋值通过assign函数进行，模板变量的解析通过display函数，模板编译通过fetch函数，这一系列对模板的读写与编译操作导致了漏洞的产生。...

INVOhost - SQL Injection

INVOhost - SQL Injection Andrés Gómez Exploit Title : INVOhost SQL Injection Date : 2010-04-24 Author : Andrés Gómez Software Link : http://www.invohost.com/ Contact : [email protected] Dork : "Powered by INVOhost" An attacker may execute arbitrary SQL statements on the vulnerable system...

Pligg CMS 9.9.0 - Remote Code Execution

Pligg CMS 9.9.0 - Remote Code Execution !/usr/bin/perl -w use LWP::UserAgent; use MIME::Base64; use Digest::MD5 qwmd5hex; use Getopt::Std; getopts'h:', %args; print "\n"; print " Pligg new; $http-agent'Mozilla/5.0 Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1 Gecko/2008070208 Firefox/3.0.1';...

Advanced Poll 2.0.5-dev - Remote Code Execution

Advanced Poll 2.0.5-dev - Remote Code Execution !/usr/bin/perl -w Advanced Poll 2.0.0 = 2.0.5-dev textfile RCE. date: 30/07/06 diwou PHCKSEC c 2001-2006. Hey, what a mad world! use strict; use warnings; use LWP::UserAgent; use MD5; args: http://url/apollpath cmd proxy: export...

Advanced Poll <= 2.0.5-dev Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl -w Advanced Poll 2.0.0 = 2.0.5-dev textfile RCE. date: 30/07/06 diwou [email protected] PHCKSEC c 2001-2006. Hey, what a mad world! use strict; use warnings; use LWP::UserAgent; use MD5; args: http://url/apollpath cmd proxy: export...

Advanced Poll 2.0.5-dev - Remote Code Execution

!/usr/bin/perl -w Advanced Poll 2.0.0 = 2.0.5-dev textfile RCE. date: 30/07/06 diwou PHCKSEC c 2001-2006. Hey, what a mad world! use strict; use warnings; use LWP::UserAgent; use MD5; args: http://url/apollpath cmd proxy: export PROXY='http|https://www.my.big.and.famous.proxy:8080/' url:...