PT-2018-13572

Name of the Vulnerable Software and Affected Versions SeaCMS versions prior to 6.62 Description An issue exists in the software, allowing SQL injection via the tid parameter in an "adm1n/admin topic vod.php" request. Recommendations For versions prior to 6.62, update to version 6.62 or later to...

PT-2018-9658

Name of the Vulnerable Software and Affected Versions: joyplus-cms version 1.6.0 Description: The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the keyword parameter of the manager/admin vod.php file...

PT-2018-18621

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for Remote Code Execution due to an Arbitrary File Upload problem. This is related to the "manager/editor/upload.php" and "manager/admin vod.php?action=add" API endpoints, specifically the...

苹果CMS绕过检测SQL注入，第四发（绕过360防护）

简要描述： 原来我之前说的那些都成废话了，厂商没有看懂，囧～，看回复把过错归结于360safe3.php，不再发了，总结下原因。 详细说明： index.php: $m = be'get','m'; ifstrpos$m,'.' $m = substr$m,0,strpos$m,'.'; $par = explode'-',$m; $parlen = count$par; $ac = $par0; ifempty$ac $ac='vod'; $method='index'; $colnum = array"id","pg","yaer","typeid","classid";...