WonderCMS-4.3.2-XSS-to-RCE-Exploits-CVE-2023-41425

WonderCMS 4.3.2 XSS 到 RCE 漏洞利用脚本 概述 这些脚本利用 WonderCMS 4.3.2 中的 XSS（跨站脚本）漏洞来实现 远程代码执行（RCE） 。当管理员触发 XSS 载荷时，它会通过一个精心构造的恶意主题模块自动在目标服务器上安装反向 Shell。反向 Shell 从 revshells.com 获取并执行，从而使攻击者获得对服务器的远程访问权限。 目录 前提条件 脚本1：自动利用脚本 功能特性 使用方法 脚本2：手动利用脚本 功能特性 使用方法 注意 许可证 前提条件 要成功运行任一脚本，需满足以下工具和条件： 1. Bash Shell...

EUVD-2012-2203

Malware in sbrugna...

EUVD-2012-4426

Malware in sbrugna...

CVE-2020-13978

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes=editchunk URI. NOTE: there is no indication that the Edit Chunk feature...

CVE-2020-13978

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=editchunk URI. NOTE: there is no indication that the Edit Chunk...

Design/Logic Flaw

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=editchunk URI. NOTE: there is no indication that the Edit Chunk...

CVE-2020-13978

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=editchunk URI. NOTE: there is no indication that the Edit Chunk...

PT-2020-13814 · Monstra · Monstra Cms

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: The issue allows an attacker with administrative access to execute arbitrary OS commands via the Theme Module by visiting the "admin/index.php?id=themes&action=edit chunk" URI. This is achieved by...

CVE-2012-2209

Multiple cross-site scripting XSS vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 section parameter in the configuration module, 2 installstatus parameter in the languagesnew module, or 3 theme parameter in the theme modu...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 section parameter in the configuration module, 2 installstatus parameter in the languagesnew module, or 3 theme parameter in the theme modu...

CVE-2009-0818

Cross-site scripting XSS vulnerability in the taxonomythemeadmintablebuilder function taxonomythemeadmin.inc in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is...

Drupal Taxonomy Theme模块name参数HTML注入漏洞

BUGTRAQ ID: 33923 Drupal的Taxonomy Theme模块允许网站管理员基于分类、词汇或类型内容更改指定内容的主题。 Taxonomy Theme模块的taxonomythemeadmintablebuilder函数没有正确地检查用户提供输入。在taxonomythemeadmin.inc的388行： $form'table'$item-$data'key''title' = array'value' = $item-name; 由于没有使用checkplain或类似的函数对$item-name值执行过滤，拥有administer...