56796 matches found
Disclosure: WordPress WPDB SQL Injection - Technical
Today, a significant SQL-Injection vulnerability was fixed in WordPress 4.8.3. Before reading further, if you haven’t updated yet stop right now and update. The foundations of this vulnerability was reported via Hacker-One on September 20th, 2017. This post will detail the technical vulnerability...
Aerospike Database Server Set Name Code Execution Vulnerability(CVE-2016-9054)
Summary An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function assindexsimatchlistbysetbinid resulting in remote code execution. An...
Moxa AWK-3131A Web Application Cross-Site Request Forgery Vulnerability(CVE-2016-8718)
Summary An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted form can trick a client into making an unintentional request to the web server which will be treated as an...
FreeRDP Rdp Client License Read Challenge Packet Denial of Service Vulnerability(CVE-2017-2839)
Summary An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use ma...
Foscam IP Video Camera Command Injection Vulnerability(CVE-2017-2847)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configurati...
xycms b_title parameter sql injection vulnerability
No description provided by source...
Apple iOS / MacOS Netagent Kernel Memory Disclosure(CVE-2017-2507)
iOS/MacOS kernel memory disclosure due to lack of bounds checking in netagent socket option handling netagentctlsetopt is the setsockopt handler for netagent control sockets. Options of type NETAGENTOPTIONTYPEREGISTER are handled by netagenthandleregistersetopt. Here's the code: static errnot...
Heap Overflow Vulnerability in Citrix NetScaler Gateway (CVE-2017-7219)
After presenting my findings on the Swisscom router at the CybSecConference last year, I started looking for a new product to analyze. I quickly found that it’s possible to download virtual “demo” appliances of Citrix products, so I went on to download a Netscaler VPX, which at the time was at...
AMF3 Java implementations Improper Restriction of XML External Entity Reference ('XXE')
A detailed analysis of the reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers allow the external entity references XXEs from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose...
RoundCube Webmail mail <1.0.5 body stored XSS（CVE-2015-1433）
RoundCube Webmail is a foreign use of a wide an open source php e-mail system, the meaning is still quite large. roundcube webmail official website: , download the latest version. /program/lib/Roundcube/rcubewashtml.php this file is actually a rich text filter class class rcubewashtml it. roundcu...
Wordpress <= 4.6.1 Stored XSS Via Theme File
Author: p0wd3r 知道创宇404安全实验室 0x00 漏洞概述 1.漏洞简介 WordPress是一个以PHP和MySQL为平台的自由开源的博客软件和内容管理系统，近日研究者发现在其 ... DO NOT CHANGES HERE ... / 接着更改文件夹名字再打包： bash mv illdy "" zip -r theme.zip "" 构造好之后我们登录后台上传该主题文件，同时开始动态调试。 首先进入wp-admin/includes/class-theme-installer-skin.php中第55-82行： php $name =...
启明星辰网御&天清汗马安全集中管理系统MgmtCenter_login.action_username参数sql注入
No description provided by source...
用友致远A6协同系统 /yyoa/ext/trafaxserver/ExtnoManage/setextno.jsp 文件 user_ids 参数SQL注入漏洞
No description provided by source...
用友致远A6协同系统messageViewer.jsp三处SQL注入漏洞
No description provided by source...
Horizon QCMS 4.0 'category' 参数SQL注入漏洞
受影响系统 Horizon QCMS Horizon QCMS 测试方法： -------------------------------------------------------------------------------- 警 告 以下程序方法可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！ http://host/download.php?category=%27%20union%20select%201,2,version,4,5,6%20--%202 建议：...
网康VPN设备6.3.1越权访问
网康vpn设备虽然设置了授权访问，但是大部分页面可以越权绕过访问。1，https://xx.xx.xx.x/vpnweb/bulletin.php?para=admin/index.php绕过认证直接访问后台认证，使用burp抓包，得到url地址!网康vpn设备设计缺陷，可以远程直接重启。直接访问vpn设备的地址https://xxx.xx.xx.xx//admin/devicestatus.php点击重启，直接可以重启设备！影响的型号为6.3.1版本...
cmstop媒体云SQL注入漏洞
简要描述： 媒体云真是方便，直接注册就建立一个网站了，但是如果云出了漏洞呢？ 详细说明： CmsTop 媒体云 作为媒体云时代的开创者，思拓合众颠覆了传统的软件采购和项目外包模式，与传媒集团建立战略合作伙伴关系，以互联网思维和云计算技术为基础整合集团、区域和行业内的媒体及政务新媒体资源，共同建设和运营媒体云。 想象是美好的，现实呢，现实是，媒体云后台管理存在sql注入漏洞 我们随便注册一个账号（http://www.cmstop.cn/），然后访问用户功能 http://site.cmstop.cn//member/index/index?state=enable...
JEECMS一处通用越权第四弹(可删除订单取消订单)
简要描述： 111 详细说明： ID1和ID2各自去买一个自己喜欢的东西，就是没有TT，真可惜啊-。- 我们修改一下ID，然后把自己吓一跳吧，。。 我们这些做测试的简直可以上星光大道了，引用刘谦那句话，接下来就是见证奇迹的时候了 白帽子都是魔术师-。- test7取消订单，然后会增加一个删除按钮，然后删除抓包改ID，发包，删除成功 漏洞证明： ID1和ID2各自去买一个自己喜欢的东西，就是没有TT，真可惜啊-。- 我们修改一下ID，然后把自己吓一跳吧，。。 我们这些做测试的简直可以上星光大道了，引用刘谦那句话，接下来就是见证奇迹的时候了 白帽子都是魔术师-。-...
金蝶某主机Mysql弱密码泄露部分员工信息
简要描述： 金蝶某主机mysql弱密码,泄露部分员工信息。 详细说明： mysql -uroot -p123456 -h218.244.150.94 漏洞证明： mysql show databases; +--------------------+ | Database | +--------------------+ | informationschema | | aucp | | jiradb | | mysql | | performanceschema | | pss | | scrumdb | | test | +--------------------+...
Discuz!论坛CSRF一处
简要描述： Discuz!论坛CSRF一处 详细说明： 测试版本：x3.2，论坛需要开启广播功能（全局--站点功能）。 当访问一个url时，可取消收听指定用户 http://127.0.0.1/dz/home.php?mod=spacecp&ac=follow&op=del&fuid=用户id 没有token验证。 漏洞证明： 收听一个用户，确定该用户的uid，比方说是1 访问如下第三方也没就可取消啊收听...
ESPCMS 6.2 /interface/order.php SQL注入漏洞
No description provided by source...
Wordpress wpDataTables Plugin 1.5.3 /wpdatatables.php SQL注入漏洞
wpdatatables.php // AJAX-handlers addaction 'wpajaxgetwdtable', 'wdtgetajaxdata' ; addaction 'wpajaxnoprivgetwdtable', 'wdtgetajaxdata' ; / Handler which returns the AJAX response / function wdtgetajaxdata $id = $GET'tableid'; $tabledata = wdtgettablebyid $id ; $columndata = wdtgetcolumnsbytablei...
Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20141106-0 ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable version: 12.1.4023.4080...
Enalean Tuleap 7.2 - XXE File Disclosure
No description provided by source. Vulnerability title: Tuleap = 7.2 External XML Entity Injection in Enalean Tuleap CVE: CVE-2014-7177 Vendor: Enalean Product: Tuleap Affected version: 7.2 and earlier Fixed version: 7.4.99.5 Reported by: Jerzy Kramarz Details: A multiple XML External Entity...
Supesite 注入一枚 (可提升自己为管理)
简要描述： Supesite 注入出的密码 基本都破不出来 如果能够直接提升自己为管理员 或者 自己修改管理的密码那就再好不过了。 忙里偷闲。 详细说明： 在index.php中 if$SGET'action' != 'index' ifempty$channels'menus'$SGET'action''upnameid' && $channels'menus'$SGET'action''upnameid' != 'news' $scriptfile = SROOT.'./'.$SGET'action'.'.php'; else $scriptfile =...
espcms sql注入漏洞
简要描述： 刚刚看了 espcms的官网 发现2014-09-16 16:58:17更新了,下了份看下，发现这上面的几个漏洞完全没修复啊..上次提交了个漏洞只给了5rank..敢给多点么.这次和上次那个相似,怕你们只修复一处,这处也提交下。 详细说明： 在order.php inordersave中 365-367行附近 foreach $did as $key = $value $value = intval$value; $oprice$key = floatval$oprice$key; $bprice$key = floatval$bprice$key;...
万户OA某页面通用性SQL注入（又影响N个政府网和医疗机构）
简要描述： 其实我一直琢磨，之前发的那个，为什么有一部分不能注入，后来找了找，发现不能注入的都是oracle数据库，很好奇。。。然后……就发现了这个通用注入。。例子中，涉及淮北市卫生局，内蒙古海勃湾区市政府、怀远县政府等多家政府单位和医疗机构。在注入时貌似有些限制，凌晨1:45了，就不继续测试了，该睡觉了。。 详细说明： 万户OA协同管理系统，存在POST注入 问题链接：defaultroot/mobile/index.jsp 该登陆框，username处没有做过滤，导致了POST注入 详细看图吧。。。 漏洞证明：...
Croogo 1.2.1 - Multiple CSRF Vulnerabilities
No description provided by source. ----------------------------------------------------------------------------------------------- Title: Croogo 1.2.1 Multiple CSRF Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmaildotcom Date: 07. February 2010...
MobPartner Counter - Remote File Upload Vulnerability
No description provided by source. MobPartner Counter Remote File Upload Vulnerability + Author : wlhaan hacker + Email : [email protected] + Site : www.sa-hacker.com/vb + team wlhaan Hacker + Dork : MobPartner Counter upload files The exploit : http://localhost/path/upload.php edit shell...
Joomla Seyret Video Component (com_seyret) Blind SQL Injection Exploit
No description provided by source. 1 1 0 I'm RoAdKiLlEr member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 +Title :Joomla Component comseyret Blind SQL Injection Exploit +Author :RoAdKiLlEr +Contact :RoAdKiLlEratKhg-CrewdotWs +Tested on :Win X...
pGB 2.12 kommentar.php SQL Injection Vulnerability
No description provided by source. Exploit Title: pGB 2.12 SQL Injection Vulnerability Date: 18/01/2012 - 03.52 Author: 3spi0n Software Website: http://www.powie.de/ Tested On: BackTrack 5 - Win7 Ultimate Platform: Php $ Vulnerable File: kommentar.php $ Demo Sites:...
Multiple Vendor ICMP Implementation Malformed Path MTU DoS
No description provided by source. source: http://www.securityfocus.com/bid/13124/info Multiple vendor implementations of TCP/IP Internet Control Message Protocol ICMP are reported prone to several denial-of-service attacks. ICMP is employed by network nodes to determine certain automatic actions...
FOSCAM IP-Cameras Improper Access Restrictions
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...
Litespeed Technologies Web Server Remote Poison null byte Exploit
No description provided by source. Litespeed Technologies Web Server Remote Poison null byte Zero-Day discovered and exploited by Kingcope in June 2010 google gives me over 9million hits Example exploit session: %nc 192.168.2.19 80 HEAD / HTTP/1.0 HTTP/1.0 200 OK Date: Sun, 13 Jun 2010 00:10:38 G...
Dotproject 2.0 /includes/db_connect.php baseDir Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/16648/info Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to includ...
Java Statement.invoke() Trusted Method Chain Exploit
No description provided by source. $Id: javatrustedchain.rb 11345 2010-12-15 22:46:22Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms o...
Apache Tomcat 5.5.0 to 5.5.29 & 6.0.0 to 6.0.26 - Information Disclosure Vulnerability
No description provided by source. CVE-2010-1157: Apache Tomcat information disclosure vulnerability Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 6.0.0 to 6.0.26 - - Tomcat 5.5.0 to 5.5.29 Note: The unsupported Tomcat 3.x, 4.x and 5.0.x versions may also be...
Guru Penny Auction Pro 3.0 - Blind SQL Injection Vulnerability
No description provided by source. / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...
D-Link IP Cameras Multiple Vulnerabilities
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ D-Link IP Cameras Multiple Vulnerabilities 1. Advisory Information Title: D-Link IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0303 Advisory URL:...
XLineSoft ASPRunner 1.0/2.x [TABLE-NAME]_edit.asp SQL Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/10799/info ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files. ASPRunner versions 2.4...
ASX to MP3 Converter 3.1.2.1 - SEH Exploit (Multiple OS, DEP and ASLR Bypass)
No description provided by source. Exploit Title: ASX to MP3 Converter v3.1.2.1 SEH Exploit Multiple OS, DEP and ASLR Bypass Date: July 13, 2010 Author: Node Software Link: http://www.mini-stream.net/downloads/ASXtoMP3Converter.exe Version: Mini-Stream Software ASX to MP3 Converter...
MetaCart E-Shop V-8 StrCatalog_NAME Parameter Remote SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13377/info An SQL injection vulnerability affects MetaCart e-Shop V-8. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in SQL queries. An attacker may explo...
Namad (IMenAfzar) 2.0.0.0 - Remote File Disclosure Vulnerability
No description provided by source. Securitylab.ir Application Info: Name: Namad Version: 2.0.0.0 Website: http://imenafzar.com Discoverd By: Securitylab.ir Website: http://securitylab.ir Contacts: adminatsecuritylab.ir & info@securitylabdotir Vulnerability Info: Type: Remote File Download...
Joomla! <= 3.0.2 (highlight.php) PHP Object Injection Vulnerability
No description provided by source. ------------------------------------------------------------------- Joomla! = 3.0.2 highlight.php PHP Object Injection Vulnerability ------------------------------------------------------------------- - Software Link: http://www.joomla.org/ - Affected Versions:...
MailEnable Webmail Cross-Site Scripting Vulnerability
No description provided by source. ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor contact:...
RoundCube Webmail <= 0.2b Remote Code Execution Exploit
No description provided by source. !/bin/sh I was hoping the PoC would not appear so soon, but now that it is out, i thought i might as well publish my real exploit. Hunger http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619 FOR LEARNING PURPOSES ONLY! PHP echoiniget'disablefunctions';...
BisonFTP Server <= 3.5 - Remote Buffer Overflow Exploit (MSF)
No description provided by source. Title : BisonFTP Server Remote Buffer Overflow Exploit Author : Veerendra G.G SecPod Technologies www.secpod.com Advisory : http://secpod.org/blog/?p=384 http://secpod.org/msf/bisonserverbof.rb Version : BisonFTP Server = v3.5 Date : 09/07/2011 $Id:...
WonderWare SuiteLink 2.0 - Remote Denial of Service Exploit (meta)
No description provided by source. $Id: suitlink.rb $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
OpenSSL < 0.9.8i DTLS ChangeCipherSpec Remote DoS Exploit
No description provided by source. / cve-2009-1386.c OpenSSL 0.9.8i DTLS ChangeCipherSpec Remote DoS Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1386 OpenSSL would SegFault if the DTLS server receives a...
Commercial Interactive Media SCOOP! 2.3 prePurchaserRegistration.asp Invalid Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/16015/info Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...