发表于
2017-01-25 06:34:39
PageAdmin CMS SQLInjection 0DAY
发表于
2017-01-01 21:18:20
dedeCMS友情链接getshell漏洞分析
在tpl.php中/*---------------------------
function savetagfile() { }
保存标签碎片修改
--------------------------*/
else if($action=='savetagfile')
{
if(!preg_match("#^[a-z0-9_-]{1,}\.lib\.php$#i", $filename))
{
ShowMsg('文件名不合法，不允许进行操作！', '-1');
exit();
}
require_once(DEDEINC.'/oxwindow.class.php');
$tagname = preg_replace("#\.lib\.php$#i", "", $filename);
$content = stripslashes($content);
$truefile = DEDEINC.'/taglib/'.$filename;
$fp = fopen($truefile, 'w');
fwrite($fp, $content);
fclose($fp);
$msg = "测试标签：(需要使用环境变量的不能在此测试){dede:{$tagname} }{/d
...继续阅读
(17)
发表于
2016-12-31 03:23:14
通达oa前台注入+后台getshell
注入分析\inc\common.inc.phpphp
function SecureRequest(&$var)
{
if (is_array($var)) {
foreach ($var as $_k =$_v ) {
$var[$_k] = securerequest($_v);
}
}
else {
if ((0 < strlen($var)) && preg_match("#^(MYOA_|GLOBALS|_GET|_POST|_COOKIE|_ENV|_SERVER|_FILES|_SESSION)#", $var)) {
exit("Invalid Parameters!");
}
if (!get_magic_quotes_gpc()) {
$var = addslashes($var);
}
}
return $var;
}
function CheckRequest(&$val)
{
if (is_array($val)) {
foreach ($val as $_k => $_v ) {
checkre
...继续阅读
(23)
发表于
2016-12-27 09:34:23
PHPMailer 5.2.17 - Remote Code Execution
坦白的说，看到限制条件就觉得不爱了，搞得上班还迟到.就是没有注意看条件.要是直接docker运行多好。Before thiscommitinclass.phpmailer.phpin a certain scenarion there is no filter in the sender's email address special chars. This flaw can lead to a remote code execution, viamailfunctionhere.To trigger this code, you need:* PHPMailer < 5.2.18
* Compile PHP without PCRE.
* PHP version must be inferior to 5.2.0.So you can bypass the sender's email validation onvalidateAddressfunction, settingpatternselecttonoregex. To make easier to archieve such environment without having to setup PHP like this I just hardcoded itthis code.作者是本地进行调试的python -m
...继续阅读
(12)
发表于
2016-12-26 17:35:25
OpenSSH < 7.4 - agent 漏洞利用代码细节
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1009
The OpenSSH agent permits its clients to load PKCS11 providers using the commands SSH_AGENTC_ADD_SMARTCARD_KEY and SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED if OpenSSH was compiled with the ENABLE_PKCS11 flag (normally enabled) and the agent isn't locked. For these commands, the client has to specify a provider name. The agent passes this provider name to a subprocess (via ssh-agent.c:process_add_smartcard_key -> ssh-pkcs11-client.c:pkcs11_add_provider -> ssh-pkcs11-client.c:send_msg), and the subprocess receives it and pas
...继续阅读
(18)
发表于
2016-12-26 09:35:25
OpenSSH < 7.4 - agent 漏洞利用代码细节
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1009
The OpenSSH agent permits its clients to load PKCS11 providers using the commands SSH_AGENTC_ADD_SMARTCARD_KEY and SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED if OpenSSH was compiled with the ENABLE_PKCS11 flag (normally enabled) and the agent isn't locked. For these commands, the client has to specify a provider name. The agent passes this provider name to a subprocess (via ssh-agent.c:process_add_smartcard_key -> ssh-pkcs11-client.c:pkcs11_add_provider -> ssh-pkcs11-client.c:send_msg), and the subprocess receives it a
...继续阅读
(9)
发表于
2016-12-24 13:13:23
Finecms 任意文件下载
Author:Sinner漏洞文件：\controllers\ApiController.php Line 54public function downAction() {
$data = fn_authcode(base64_decode($this->get('file')), 'DECODE');
$file = isset($data['finecms']) && $data['finecms'] ? $data['finecms'] : '';
if (empty($file)) {
$this->msg(lang('a-mod-213'));
}
if (strpos($file, ':/')) {
//远程
header("Location: $file");
} else {
//本地
$file = str_replace('..', '', $file);
$file = strpos($file, '/') === 0 ? APP_ROOT.$file : $file;
if (!is_file($f
...继续阅读
(14)
发表于
2016-12-22 11:17:58
MetInfo 5.3.12 注入漏洞
最新版尝试通过，具体的版本为5.3.12.这是一个比较老的漏洞了，不知道为什么，metinfo 还是没有修复，网上的介绍都比较简单，我这里就详细的解释一下\app\system\include\compatible\metv5_top.php//获取当前应用栏目信息
$PHP_SELF = $_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_SERVER['SCRIPT_NAME'];
$PHP_SELFs = explode('/', $PHP_SELF);
print_r($PHP_SELFs);
$query = "SELECT * FROM {$_M['table'][column]} where module!=0 and foldername = '{$PHP_SELFs[count($PHP_SELFs)-2]}' and lang='{$_M['lang']}'";
$column = DB::get_one($query);这里调用了 $_SERVER[‘SCRIPT_NAME’] 去获取网站路径，但是这里有一个问题就是，路径中并没有waf 处理，可以导致一些安全问题，代码里面就直接 explode 函数对路径进行了切割，这里取出了倒数第二个参数，并且未经过处理就带入了 sql 语句里面，我们看看 这个文件的剩下的一些代
...继续阅读
(12)
发表于
2016-12-22 03:17:58
MetInfo 5.3.12 注入漏洞
发表于
2016-12-06 16:44:02
FineCMS后台getshell
发表于
2016-11-18 16:48:52
VBulletin 核心插件 forumrunner SQL注入(CVE-2016-6195)漏洞分析
发表于
2016-09-19 01:16:01
PHPCMS V9最新版本后台设计缺陷导致getshell
发表于
2016-08-11 03:18:35
耳朵音乐CMS 免认证登录
发表于
2016-08-06 07:09:57
Apache Shiro Java 反序列化漏洞分析
发表于
2016-07-04 12:15:16
Ubuntu 16.04 local root exploit – netfilter target_offset OOB
发表于
2016-06-01 09:57:31
Discuz X系列门户文章功能SSRF漏洞挖掘与分析
发表于
2016-06-01 09:39:48
Imagetragick 补丁绕过再次命令执行
发表于
2016-06-01 08:42:08
CouchDB未授权访问导致执行任意系统命令漏洞
发表于
2016-06-01 08:18:43
新姿势之Docker Remote API未授权访问漏洞分析和利用
发表于
2016-06-01 07:16:17
FFmpeg文件读取漏洞测试及利用
发表于
2016-02-16 15:58:21
xpshop网店系统sql注入一处(官方demo演示)
发表于
2016-02-16 15:47:44
xpshop网店系统sql注入(demo演示)
发表于
2016-01-20 11:19:10
[+] Linux Kernel +3.8 0day PoC [+]
/* https://gist.github.com/PerceptionPointTeam/18b1e86d1c0f8531ff8f */
/* $ gcc cve_2016_0728.c -o cve_2016_0728 -lkeyutils -Wall */
/* $ ./cve_2016_072 PP_KEY */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <keyutils.h>
#include <unistd.h>
#include <time.h>
#include <unistd.h>
#include <sys/ipc.h>
#include <sys/msg.h>
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cr
...继续阅读
(262)
发表于
2016-01-16 05:57:07
Cacti 0.8.8f graphs_new.php SQL注入漏洞
graphs_new.phpfunction form_save() {
if (isset($_POST["save_component_graph"])) {
/* summarize the 'create graph from host template/snmp index' stuff into an array */
while (list($var, $val) = each($_POST)) {
if (preg_match('/^cg_(\d+)$/', $var, $matches)) {
$selected_graphs["cg"]{$matches[1]}{$matches[1]} = true;
//cg_g is not filtered
}elseif (preg_match('/^cg_g$/', $var)) {
if ($_POST["cg_g"] > 0) {
$selected_graphs["cg"]{$_POST["cg_g"]}{$_POST["cg_g"]} = true; //给数组赋值
...继续阅读
(164)
发表于
2016-01-06 02:36:56
海盗云商储存型xss
发表于
2016-01-06 02:31:35
海盗云商前台getshell
发表于
2016-01-06 02:18:37
Ubuntu 14.04 LTS, 15.10 overlayfs – Local Root Exploit
发表于
2016-01-04 06:52:59
用友ERP-NC某处通用文件包含漏洞
发表于
2016-01-04 06:17:24
extmail邮件服务存在漏洞读取任意用户邮件内容
发表于
2015-12-03 02:45:25
RHEL 7.0/7.1 – abrt/sosreport Local Root
#!/usr/bin/python
# CVE-2015-5287 (?)
# abrt/sosreport RHEL 7.0/7.1 local root
# rebel 09/2015
# [user@localhost ~]$ python sosreport-rhel7.py
# crashing pid 19143
# waiting for dump directory
# dump directory: /var/tmp/abrt/ccpp-2015-11-30-19:41:13-19143
# waiting for sosreport directory
# sosreport: sosreport-localhost.localdomain-20151130194114
# waiting for tmpfiles
# tmpfiles: ['tmpurfpyY', 'tmpYnCfnQ']
# moving directory
# moving tmpfiles
# tmpurfpyY -> tmpurfpyY.old
# tmpYnCfnQ -> tmpYnCfnQ.old
# waiting for sosreport to finish (can take several minutes).......................
...继续阅读
(52)