java代码审计基础教程之V2会议系统多个漏洞集合/无需登录

简要描述： 包括 sql注入 任意文件下载 越权 getshell xml实体注入 感谢@loopx9大牛帮助 详细说明： 因为学习java并不是很长时间，也没有做深入的研究。但是在学习之后，发现可以审计出一些简单的javaweb漏洞，所以想这这里和大家分享一下。 0x01审计之初 首先，我拿到了源码之后，大概看了一下这个系统的架构，发现是通过Struts写的。在具体看代码之前，我们先看一下这个会议系统有什么功能，在代码审计的时候，不能一股脑的先跑过去就看代码，我们要学会通过功能去找问题的缺陷。现在以...:8288/Conf/jsp/main/mainAction.do...

CVE-2015-0482

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.2.0 and 12.1.3.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices...

Design/Logic Flaw

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.2.0 and 12.1.3.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices...

CVE-2015-0482

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.2.0 and 12.1.3.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices...

PT-2015-1129

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.1.2.0 through 12.1.3.0 Description The issue affects confidentiality, integrity, and availability. It is related to the WLS-WebServices subcomponent and can be exploited by remote authenticated users...

CVE-2015-0482: Undefined Security Weakness

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.2.0 and 12.1.3.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices...

Bugzilla < 4.0.16 / 4.2.12 / 4.4.7 / 5.0rc1 Multiple Vulnerabilities

According to its banner, the version of Bugzilla running on the remote host is potentially affected by the following vulnerabilities : - A command injection vulnerability exists due to a failure to properly utilize the 3 arguments form for open. This allows an authenticated, remote attacker with...

FreeBSD : Bugzilla multiple security issues (dc2d76df-a595-11e4-9363-20cf30e32f6d)

Bugzilla Security Advisory Command Injection Some code in Bugzilla does not properly utilize 3 arguments form for open and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes. Information Leak Using the WebServices API, a user c...

HackerOne: Arbitrary file uploads to Amazon WS.

Hi, It seems one is able to upload arbitrary files to Amazon Webservices through the UI. This allows for uploading malware such as msf-payload-x86.jpg.exe or whatever. Beyond free hosting this could potentially be used to entice teams into downloading stuff they probably don't want. Actual...

Design/Logic Flaw

The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token...

CVE-2012-0797

The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token...

CVE-2012-0797

The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token...

CVE-2012-0797

The CVE-2012-0797 issue affects Moodle webservices authentication: remote authenticated users could bypass the deleted status and continue using a server via a token. Affected versions are Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1. The root cause is improper handling o...

CVE-2012-0797: Undefined Security Weakness

The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token...

PT-2012-2874

Name of the Vulnerable Software and Affected Versions Moodle versions 2.0.x through 2.0.6 Moodle versions 2.1.x through 2.1.3 Moodle versions 2.2.x through 2.2.0 Description The issue allows remote authenticated users to bypass the deleted status and continue using a server via a token,...

Liferay 6.1 json webservices are subject to cross-site request forgery attacks

Liferay 6.1 json webservices are subject to cross-site request forgery attacks Description: Liferay Portal is an enterprise portal written in Java If a user is currently logged in to the portal or has ticked the remember me box then with a little help of social engineering like sending a link via...

Liferay 6.1 can be compromised in its default configuration

Liferay 6.1 can be compromised in its default configuration Description: Liferay Portal is an enterprise portal written in Java By utilizing the json webservices exposed by the platform you can register a new user with any role in the system, including the built in administrator role. The problem...

CVE-2012-1079

Unspecified vulnerability in the Webservices for TYPO3 typo3webservice extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors...

Code injection

Unspecified vulnerability in the Webservices for TYPO3 typo3webservice extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors...

CVE-2012-1079

CVE-2012-1079 affects the TYPO3 Webservices extension (typo3_webservice) for TYPO3, vulnerable versions before 0.3.8. Remote authenticated users could execute arbitrary code via unknown vectors due to the underlying issue in that extension. No explicit exploit details are provided in the document...