EUVD-2018-3741

Malware in sbrugna...

CVE-2018-11722

WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UCKEY' is hard coded...

CVE-2018-11722

CVE-2018-11722 affects WUZHI CMS 4.1.0 with a SQL Injection in api/uc.php driven by the 'code' parameter due to a hard-coded UC_KEY. The vulnerability is described across multiple datasources as enabling arbitrary SQL commands; CVSS metrics indicate network-level access, low attack complexity, an...

PT-2018-10780

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a SQL Injection in the api/uc.php endpoint via the code parameter. This occurs because the UC KEY is hard coded, allowing for potential exploitation. Recommendations For WUZHI CMS...

CVE-2018-11722: Improper Neutralization of Special Elements used in an SQL Command

WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UCKEY' is hard coded...

ecshop /api/uc.php注入漏洞

No description provided by source...

FineCMS高级版前台getshell(demo成功)

简要描述： demo也shell了哦 详细说明： 看到\member\api\uc.php define'DISCUZROOT', dirnamedirnamedirnameFILE.'/member/ucenter/'; include DISCUZROOT.'api/uc.php'; 就是包含了uc的那个插件。但是这个功能只有高级版才有，免费版没有 然后uckey都是默认的 8808cer8o1UJsEpt2G2Jn0uhEn/YgEva589Mfo0 然后就可以直接getshell了 附上脚本 ! /usr/bin/env python coding=utf-8 import...

CmsTop媒体版中某处sql注入漏洞

简要描述： sql注入漏洞 详细说明： 可以直接修改 管理员密码。 问题出现在 uc.php接口中,没有正确的判断UC接口是否开启,而key又是默认的。 因为代码中自己关闭了GPC，所以会导致注入。 $set= setting'member'; $set'ucdbtablepre' = ''.$set'ucdbname'.'.'.$set'ucdbtablepre'; $set = arraychangekeycase$set, CASEUPPER; foreach$set as $k = $v ifpregmatch'/^UC/',$k define$k,$v;...

kingcms the latest version sql injection vulnerability-vulnerability warning-the black bar safety net

Brief description: kingcms injection vulnerability Detailed description: api/uc.php UCKEY not initialized cause injection ? php define'UCCLIENTVERSION', '1.5.0'; //note UCenter version identifier define'UCCLIENTRELEASE', '2 0 0 9 0 5 0 2'; define'APIDELETEUSER', 1; //note the user to delete the A...

Modoer 2.6 /api/uc.php SQL注入漏洞

No description provided by source...

PHPDisk 6.8.0 api/uc.php SQL注入漏洞

No description provided by source...

DISCUZX1. 5 local file inclusion vulnerability-vulnerability warning-the black bar safety net

DISCUZX1. 5 local file inclusion, of course, is conditional, is to use a file as a cache. configglobal.php $config'cache''type' = 'file'; function cachedata$cachenames ...... $isfilecache = getglobal'config/cache/type' == 'file'; ...... if$isfilecache $lostcaches = array; foreach$cachenames as...