phpmps 注入一枚

简要描述： 过滤不严。 详细说明： 在member.php case 'checkinfogold': $json = new ServicesJSON; extract$REQUEST; $mgold = $db-getOne"select gold from $tablemember where userid='$userid' "; $data'kou' = $CFG'infotopgold' intval$number; $data'gold' = $mgold - $data'kou'; $data=$json-encode$data; echo $data; break;...

程氏舞曲 Sql一枚 依旧无视Gpc。

简要描述： 程氏CMSV3.5 正式版 更新时间：2014-02-18 下载次数：13145 表示下载的这个 是最新的了把? 无需登录 无视Gpc。 详细说明： 在app/controllers/zj.php中 public function so $data='';$datacontent=''; $fid = $this-security-xssclean$this-uri-segment3; //方式 $key = $this-security-xssclean$this-uri-segment4; //关键字 $page =...

ThinkSAAS SQL注入漏洞打包6-10

简要描述： 详细说明： 上个注入大礼包，终于走了一个大厂商！ 看来还是打包来的划算，最后一个注入大礼包了。 这个漏洞完了，回给出修复方案，求给力！ 第一处SQL注入 /app/group/action/add.php // 执行发布帖子 case "do" : if $POST 'token' != $SESSION 'token' tsNotice '非法操作！' ; $authcode = strtolower $POST 'authcode' ; if $TSSITE 'base' 'isauthcode' if $authcode != $SESSION 'verify'...

Thinksaas v2.1 2枚注入。

简要描述： 依旧过滤不严。 详细说明： 这次写两个把。。 - - 这两个同一文件的 哈哈。 依旧是越权。 \app\group\action\admin\group.php 无需管理 只需要一个前台注册账户就能访问。 真正的管理后台在\app\system\action\ 但是为毛这admin目录下的文件都能做很多事? 注入第一枚。 case "adddo": $userid = intval$POST'userid'; $strUser = $db-oncefetchassoc"select from ".dbprefix."userinfo where...

ShopXP admin/pinglun.asp SQL注入漏洞

http://bbs.anquan.org/forum.php?mod=viewthread&tid=22021&page=1pid55222漏洞存在于/admin/pinglun.asp 文件 --用户评论 首先看到 引用了xp.asp文件， 这个文件的作用是获取数据库连接对象，继续回到/admin/pinglun.asp 文件， pinglunid=request.QuerySt...

大汉网络又来几处命令执行漏洞

简要描述： RT 详细说明： 存在漏洞的地址： http://demo.hanweb.com/jact/front/frontreg.action http://demo.hanweb.com/jact/front/frontmailstat.action http://demo.hanweb.com/jact/front/frontmailwrite.action 直接谷歌：site:hanweb.com filetype:action 一堆是... 证明： http://demo.hanweb.com/jact/1.txt 漏洞证明：...

Jetaudio 8.0.17 Crash Proof Of Concept

References: http://downloads.securityfocus.com/vulnerabilities/exploits/61400.py http://packetstormsecurity.com/files/122504/Jetaudio-8.0.17-Crash-Proof-Of-Concept.html http://cxsecurity.com/issue/WLB-2013070167 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'...

New network vulnerabilities continue to hijack all the new network domain name of the state is forbidden to modify the exception-vulnerability warning-the black bar safety net

Brief description: New network vulnerabilities continue to hijack all the new network domain name of the state is forbidden to modify, except Statement: I talked to the new network really didn't hate Detailed description: How to obtain the domain administrative password of the MD5 value will not...

Ruijie Application Control engine of the management server can increase user-vulnerability warning-the black bar safety net

Ruijie Application Control engine of the management server, the RG-ACE series Application Control engine of the management server V3. 1. 3 6. 0 0 1, The Official Website of the connection http://www.ruijie.com.cn/service/down-search.aspx the display is the latest version according to not authorit...

Active Defense class software generic implementation vulnerability-a vulnerability warning-the black bar safety net

Active Defense software in the realization of the presence of a Common Vulnerability, malware can take to bypass security checks to perform malicious acts The main anti-block system some of the key operation in these monitoring points do parameter checking. Because the parameters often come from...

Songcms Sql injection vulnerability and fix-vulnerability warning-the black bar safety net

The filter is not rigorous! ResultSQL injection it! if$WebOpening==0 diehtmlspecialcharsdecode$WebMaintenanceText; $QUERY = pregreplace"/\\:\?"'& lt;\\\\\\\s$/",",$SERVER'QUERYSTRING'; //This regular expression is not rigorous.!!!! Embarrassed$QUERY = explode'/',$QUERY; foreach...

Anhui business network built Station system arbitrary file read vulnerability-vulnerability warning-the black bar safety net

Vulnerability file in the background file management: other/files.php Read the configuration file http://www.xxx.com/admin/other/files.php?edit=../../config.inc.php&copt=2 Read the linux system's account information http://www.xxx.com/admin/other/files.php?edit=../../../../../etc/passwd&copt=2...

Dolphin 7.0.7 <= multiple cross site vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability exists in 7. 0. 7 version the following! Test code http://localhost/dolph/explanation.php?explain=%27%22%3E%3Cscript%3Ealert%28/xss/%29%3C/script%3E http://localhost/dolph/viewFriends.php?iUser=1&page=1&perpage=3 2&sort=activity&photosonly='";scriptalert/xss//script...

用友ICC网站客服系统远程代码执行漏洞

简要描述： 全部采用用友ICC客服系统,上线前没有做严格测试!导致漏洞产生!全部可以获得管理权限! 网络游戏 盛大网络 光通娱乐 在线销售 麦考林 母婴之家 教育 威迅教育 中锐留学 汽车 广州本田 永达汽车 物流 顺丰速运 申通快递 保险 太平洋保险 PICC中国人保 软件/互联网 金山软件 政府 上海公共研发平台 金融 中国银联 环迅电子商务有限公司 IFX 大成基金 东亚银行 运营商 中国电信 中国联通 安徽电信 西藏电信 行业资讯平台 泡泡网 中国汽车网 中国塑料网 网易163 零售卖场 苏宁电器 详细说明： 以下网站客服系统全部采用用友ICC客服系统 网络游戏 盛大网络 光通娱...

MS10-081: Windows Common Control Library (Comctl32) Heap Overflow

Exploit for windows platform in category remote exploits !/usr/bin/env ruby http://breakingpointsystems.com/community/blog/microsoft-vulnerability-proof-of-concept Nephi Johnson require 'socket' def httpsendsock, data, opts= defaults = :code="200", :message="OK", :type="text/html", :desc="content...

YPOPS! v0.9.7.3 Buffer Overflow (SEH)

No description provided by source. Version:0.9.7.3 Tested on: Windows XP SP3 !/usr/bin/python All modules are SafeSEH protected in service pack 3. import socket, sys print "\n ========================================" print " YPOPS! v 0.9.7.3 Buffer Overflow SEH" print " Proof of Concept by Blake...

UCStats 1.1 - SQL Injection

UCStats 1.1 - SQL Injection UCStats 1.1 Remote SQL Injection Vulnerability Author: Sora Contact: vhr95zw at hotmail dot com Website: http://greyhathackers.wordpress.com/ Google Dork: "Powered by UCStats version 1.1" Vulnerability Description: UCStats version 1.1 suffers a remote SQL injection...

Jamroom 4.0.2 - t Local File Inclusion

Jamroom 4.0.2 - t Local File Inclusion o-----------------------------------------------------------------------------------------------------------------x | Local File Include Vulnerability | o------------------------------------------------------------------------------------o | Software : Jamro...

RealVNC 4.1.2 - 'vncviewer.exe' RFB Protocol Remote Code Execution (PoC)

!/usr/bin/env python POC: RealVNC 4.1.2 'vncviewer.exe' RFB Protocol Remote Code Execution Vulnerability, BID 30499 Author: Andres Lopez Luksenberg import socket serversocket = socket.socketsocket.AFINET, socket.SOCKSTREAM serversocket.bind'', 5900 serversocket.listen1 while True: clientsocket,...

[Full-disclosure] HP eSupportDiagnostics hpediags.dll Information Disclosure

The HP eSupportDiagnostics hpediag.dll exposes some methods that allow the reading of arbitrary files and registry values. hpediag.dll, version 1.0.11.0 PoC as follows: --------------------- html head script language="JavaScript" DEFER function Check var out = fileUtil.ReadTextFilesomePath; var o...