Arbitrary File Editing Vulnerability in UCMS Version 1.4.6

UCMS is a simple open source content management system, which can be used to quickly develop a variety of enterprise stations, article stations and station systems. UCMS version 1.4.6 \ucms\sadmin\fi.php page arbitrary file editing vulnerability. An attacker can exploit the vulnerability to edit...

ShopsN open source online store system adHandle function there are SQL injection vulnerabilities

ShopsN free version of the B2C e-commerce is a product of Shanghai Yisu Network Technology Co., Ltd. a full-featured enterprise-class commercial standards in line with the real allow free commercial use of open source online store full network system. ShopsN 2.3.3 official version of the adHandle...

Multiple vulnerabilities in jspxcms

jspxcms is an open source content management system based on java and jsp technology . jspxcms cross-site request forgery and reflective cross-site scripting vulnerabilities. Attackers can use the vulnerability to send scripts containing malicious links , to be reviewed by the administrator can b...

File Upload Vulnerability in BEESCMS Enterprise Website Management System V4.0

BEESCMS is a scalable content management system CMS based on PHP and MySQL. A file upload vulnerability exists in BEESCMS Enterprise Website Management System V4.0. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion Vulnerability

Exploit for php platform in category web applications The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip The problem appears in /index.php Find 5563 lines Line 61 contains include $REQUEST'target'; This is obviously LFI precursor, as long ...

phpMyAdmin 4.8.1 Local File Inclusion

The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip The problem appears in /index.php Find 5563 lines Line 61 contains include $REQUEST'target'; This is obviously LFI precursor, as long as we bypass the 55 to 59 restrictions on the line Lin...

phpmyadmin4.8.1后台getshell

官网下载的最新版，文件名是phpMyAdmin-4.8.1-all-languages.zip 问题就出现在了 /index.php 找到5563行 第61行出现了 include $REQUEST'target'; 很明显这是LFI的前兆，我们只要绕过5559的限制就行 第57行限制 target 参数不能以index开头 第58行限制 target 参数不能出现在 $targetblacklist 内 找到 $targetblacklist 的定义： 就在 /index.php 的第50行 只要 target 参数不是 import.php 或 export.php...

Prowli Malware Targeting Servers, Routers, and IoT Devices

After the discovery of massive VPNFilter malware botnet, security researchers have now uncovered another giant botnet that has already compromised more than 40,000 servers, modems and internet-connected devices belonging to a wide number of organizations across the world. Dubbed Operation Prowli,...

Code Execution Vulnerability in UQCMS B2B2C Multi-merchant E-commerce System Backend Templates

B2B2C multi-merchant e-commerce system is combined with years of e-commerce development experience to launch the B2B2C multi-store system. There is a code execution vulnerability in the backend template of UQCMS B2B2C Multi-merchant E-commerce System. Attackers can use this vulnerability to write...

GreenCMS 2.3.0603 - Cross-Site Request Forgery Remote Code Execution

GreenCMS 2.3.0603 - Cross-Site Request Forgery Remote Code Execution Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability get webshell Date: 2018-06-02 Exploit Author: xichao Vendor Homepage: https://github.com/GreenCMS/GreenCMS Software Link: https://github.com/GreenCMS/GreenCMS Version: v2.3.06...

GreenCMS 2.3.0603 Cross Site Request Forgery

Exploit 1 of 2: Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability get webshell Date: 2018-06-02 Exploit Author: xichao Vendor Homepage: https://github.com/GreenCMS/GreenCMS Software Link: https://github.com/GreenCMS/GreenCMS Version: v2.3.0603 CVE : CVE-2018-11670 An issue was discovered in...

GreenCMS 2.3.0603 - Cross-Site Request Forgery / Remote Code Execution Vulnerabilities

Exploit for php platform in category web applications Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability get webshell Exploit Author: xichao Vendor Homepage: https://github.com/GreenCMS/GreenCMS Software Link: https://github.com/GreenCMS/GreenCMS Version: v2.3.0603 CVE : CVE-2018-11670 An issue...

MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass Vulnerabilities

Exploit for php platform in category web applications Vendor: Appnitro Product webpage: https://www.machform.com/ Full-Disclose: https://metalamin.github.io/MachForm-not-0-day-EN/ Fix: https://www.machform.com/blog-machform-423-security-release/ Author: Amine Taouirsa Twitter: @metalamin Google...

MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass

Vendor: Appnitro Product webpage: https://www.machform.com/ Full-Disclose: https://metalamin.github.io/MachForm-not-0-day-EN/ Fix: https://www.machform.com/blog-machform-423-security-release/ Author: Amine Taouirsa Twitter: @metalamin Google dork examples: ---------------------- "machform"...

Monxin Netcom Mall System v4.0 Exists Arbitrary File Upload Vulnerability

Monxin all-network mall system is a mall management system based on PC mall + cell phone mall + WeChat mall + offline cashier, members / orders / commodities / inventory online and offline real-time synchronization of data across the network. Monxin v4.0 there are arbitrary file upload...

Monstra CMS 3.0.4 Remote Code Execution

Exploit Title: Monstra CMS 3.0.4 Upload Plugin Remote code execution CVE-2018-9037 Date: 2018-05-14 Exploit Author: Jameel Nabbo Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested on: MAC OSX CVE :CVE-2018-9037 Monst...

Code Execution Vulnerability in Microcms (viicms) v1.0

VIICMS is a third-party platform that specializes in providing marketing and promotion services for WeChat public accounts. A code execution vulnerability exists in micro cms viicms v1.0. The vulnerability stems from the program failing to effectively filter the parameter array when changing the...

Monstra CMS 3.0.4 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications Exploit Title: Monstra CMS 3.0.4 Upload Plugin Remote code execution CVE-2018-9037 Exploit Author: Jameel Nabbo Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested...

Code Execution Vulnerability in Micro Window CMS (Vwins) v3.0

Micro Window CMS Vwins is a free and open source microsoft public and paypal service window management platform system. A code execution vulnerability exists in version v3.0 of Vwins CMS Vwins. The vulnerability stems from improper filtering of incoming parameters when modifying the configuration...

UCMS 1.4.5 File Upload Vulnerability

UCMS is a simple open source content management system. A file upload vulnerability exists in UCMS 1.4.5. An attacker can exploit the vulnerability to directly upload a script Trojan file to obtain a webshell...