The vulnerability of the Moodle learning management system allows a hacker to circumvent existing restrictions on access time limits.

The vulnerability of the savesubmission function in the Moodle learning management system’s code mod/assign/externallib.php is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing time-based access restrictions by using the...

Dokeos 2.2.1 - Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: Dokeos Blind SQL Injection Date: 2016-06-14 Exploit Author: Mormoroth Exploit Author Blog: http://ha.cker.ir Vendor Homepage: http://www.dokeos.com/ Software Link: http://jaist.dl.sourceforge.net/project/dokeos/dokeos-2.1.1.zip...

Dokeos 2.2.1 - Blind SQL Injection

Exploit Title: Dokeos Blind SQL Injection Date: 2016-06-14 Exploit Author: Mormoroth Exploit Author Blog: http://ha.cker.ir Vendor Homepage: http://www.dokeos.com/ Software Link: http://jaist.dl.sourceforge.net/project/dokeos/dokeos-2.1.1.zip Version: 2.2.1 Tested on: Ubuntu Twitter :...

Hikvision(海康威视) /data/fetchPlanStatus.php 参数rows 时间盲注

No description provided by source...

SQL Blind Betting Vulnerability in zzcms

ZZCMS highlights the investment and supply and demand functions, you can quickly build a product investment website. SQL injection vulnerability exists in zzcms product/project version, cookie and time-based blind injection. The vulnerability trigger point is in downfile.php, the attacker can use...

ILas图书馆自动化集成系统 NTReaderCritic.aspx等2处 时间盲注漏洞

0x01漏洞简介 ILas图书馆自动化集成系统在NTReaderCritic.aspx和NTUniBookRetrInfo.aspx两个页面存在时间延迟注入漏洞。 0x02漏洞详情 NTReaderCritic.aspx sqlmap -u ".../NTReaderCritic.aspx?strRenco=1&strTitle=1" 相关代码如下： protected void PageLoadobject sender, EventArgs e if !base.IsPostBack if base.Request.QueryString"strRenco" != null &&...

GLPI 0.90.2 SQL Injection

Advisory ID: HTB23301 Product: GLPI Vendor: INDEPNET Vulnerable Versions: 0.90.2 and probably prior Tested Version: 0.90.2 Advisory Publication: April 8, 2016 without technical details Vendor Notification: April 8, 2016 Vendor Patch: April 11, 2016 Public Disclosure: April 29, 2016 Vulnerability...

ImpressCMS 1.3.9 - SQL Injection

ImpressCMS 1.3.9 - SQL Injection ============================================= MGC ALERT 2016-002 - Original release date: April 8, 2016 - Last revised: April 21, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I...

ImpressCMS 1.3.9 - SQL Injection

Exploit for php platform in category web applications ============================================= MGC ALERT 2016-002 - Original release date: April 8, 2016 - Last revised: April 21, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score...

ImpressCMS 1.3.9 SQL Injection

============================================= MGC ALERT 2016-002 - Original release date: April 8, 2016 - Last revised: April 21, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY ------------------------...

SocialEngine 4.8.9 - SQL Injection

Exploit for php platform in category web applications Product: SocialEngine Vendor: Webligo Vulnerable Versions: 4.8.9 and probably prior Tested Version: 4.8.9 Advisory Publication: December 21, 2015 without technical details Vendor Notification: December 21, 2015 Public Disclosure: April 6, 2016...

53KF /new/client.php sql注入漏洞

利用过程： 53KF 采用ThinkPHP框架， 注入地址：http://xxx.com/new/client.php?m=Statistic&a=setLost&field=chatrobotlost&type=plus&companyid0=1，companyid0存在时间盲注 payload: /new/client.php?m=Statistic&a=setLost&field=chatrobotlost&type=plus&companyid0=-1%20or%201!=sleep5limit%201%23between...

Timeclock 0.995 SQL Injection

Exploit Title : Multiple SQL injections Author:Marcela Benetrix Date: 02/03/2016 version: 0.995 older version may be vulnerable too software link:http://timeclock-software.net Timeclock software Timeclock-software.net's free software product will be a simple solution to allow your employees to...

UliCMS v9.8.1 - SQL Injection

UliCMS v9.8.1 - SQL Injection ============================================= MGC ALERT 2016-001 - Original release date: January 26, 2016 - Last revised: February 02, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I...

UliCMS 9.8.1 SQL Injection

============================================= MGC ALERT 2016-001 - Original release date: January 26, 2016 - Last revised: February 02, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

Mail.ru: [parapa.mail.ru] SQL Injection

Добрый день. Тип уязвимости - Time Based SQL Injection, Уязвимые параметры - куки parapauid и parapasid. Уязвимость воспроизводиться на многих страницах сайта, в том числе и на форуме. PoC GET /forums/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko...

Mail.ru: [cfire.mail.ru] Time Based SQL Injection

Добрый день. Уязвимо кукис с названием cfiresid. Рабочий PoC GET /account/userbar/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/47.0.2526.73 Safari/537.36 OPR/34.0.2036.25 Host: cfire.mail.ru Accept: text/html, application/xml;q=0.9,...

Joomla JNews (com_jnews) Component 8.5.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Description of the component: Reach, engage and delight more customers with newsletters, auto-responders or campaign management. Exploit Title: Joomla component comjnews - SQL injection Google Dork: inurl:option=comjnews Date: 2015-10-29 Explo...

Joomla! Component com_jnews 8.5.1 - SQL Injection

Description of the component: Reach, engage and delight more customers with newsletters, auto-responders or campaign management. Exploit Title: Joomla component comjnews - SQL injection Google Dork: inurl:option=comjnews Date: 2015-10-29 Exploit Author: Omer Ramić Twitter:...

RealtyScript 4.0.2 - Multiple Blind SQL Injections

RealtyScript v4.0.2 Multiple Time-based Blind SQL Injection Vulnerabilities Vendor: Next Click Ventures Product web page: http://www.realtyscript.com Affected version: 4.0.2 Summary: RealtyScript is award-winning real estate software that makes it effortless for a real estate agent, office, or...