CMS漏洞分析 - 随笔分类(第8页) - 郑瀚Andrew

08CMS Variable Override Write Arbitrarily WEBSHELL Into Arbitrarily Path

摘要：08CMS Variable Override Write Arbitrarily WEBSHELL Into Arbitrarily Path 阅读全文

posted @ 2015-03-06 19:36 郑瀚Andrew 阅读(838) 评论(0) 推荐(0) 编辑

Discuz! X upgrade/converter GETSHELL Vulnerability Via /convert/include/global.func.php Inject Special Symbol Into /convert/data/config.inc.php

摘要：Discuz! X upgrade/converter GETSHELL Vulnerability Via /convert/include/global.func.php Inject Special Symbol Into /convert/data/config.inc.php 阅读全文

posted @ 2015-03-06 11:15 郑瀚Andrew 阅读(2276) 评论(0) 推荐(0) 编辑

Getshell Via phpmyadmin SQL Execution In /import.php To Write Evil Webshell File Into Disk

摘要：Getshell Via phpmyadmin SQL Execution In /import.php To Write Evil Webshell File Into Disk 阅读全文

posted @ 2015-02-25 14:28 郑瀚Andrew 阅读(1794) 评论(0) 推荐(0) 编辑

dedeCMS /data/mysql_error_trace.php DB error raised PHP Code Injection Via /include/dedesql.class.php Log FIle Without Access Validation

摘要：dedeCMS /data/mysql_error_trace.php DB error raised PHP Code Injection Via /include/dedesql.class.php Log FIle Without Access Validation 阅读全文

posted @ 2015-02-09 13:13 郑瀚Andrew 阅读(1001) 评论(0) 推荐(0) 编辑

ECSHOP Inject PHPCode Into ecs_mail_templates table Via \admin\mail_template.php && \includes\cls_template.php Vul Tag_PHP_Code Execute Getshell

摘要：ECSHOP Inject PHPCode Into ecs_mail_templates table Via \admin\mail_template.php && \includes\cls_template.php Vul Tag_PHP_Code Execute Getshell 阅读全文

posted @ 2015-02-04 14:18 郑瀚Andrew 阅读(1160) 评论(0) 推荐(0) 编辑

phpMyadmin /scripts/setup.php Execute Arbitrary PHP Code Via unserialize Vul Object Injection PMASA-2010-4

摘要：phpMyadmin /scripts/setup.php Execute Arbitrary PHP Code Via unserialize Vul Object Injection PMASA-2010-4 阅读全文

posted @ 2015-01-21 20:07 郑瀚Andrew 阅读(2248) 评论(0) 推荐(0) 编辑

DedeCMS Xss+Csrf Getshell \dede\file_manage_control.php

摘要：DedeCMS Xss+Csrf Getshell \dede\file_manage_control.php 阅读全文

posted @ 2015-01-21 11:20 郑瀚Andrew 阅读(2749) 评论(0) 推荐(0) 编辑

dedeCMS /plus/ad_js.php、/plus/mytag_js.php Vul Via Injecting PHP Code By /plus/download.php Into DB && /include/dedesql.class.php

摘要：dedeCMS /plus/ad_js.php、/plus/mytag_js.php Vul Via Injecting PHP Code By /plus/download.php Into DB && /include/dedesql.class.php 阅读全文

posted @ 2015-01-20 16:52 郑瀚Andrew 阅读(7020) 评论(0) 推荐(1) 编辑

phpMyadmin /scripts/setup.php Execute Arbitrary PHP Code Via A Crafted POST Request CVE-2010-3055

摘要：phpMyadmin /scripts/setup.php Execute Arbitrary PHP Code Via A Crafted POST Request CVE-2010-3055 阅读全文

posted @ 2015-01-20 14:53 郑瀚Andrew 阅读(1286) 评论(0) 推荐(0) 编辑

Ecshop /admin/get_password.php Password Recovery Secrect Code Which Can Predict Vulnerability

摘要：Ecshop /admin/get_password.php Password Recovery Secrect Code Which Can Predict Vulnerability 阅读全文

posted @ 2014-12-16 08:54 郑瀚Andrew 阅读(1246) 评论(0) 推荐(0) 编辑

Dedecms include\dialog\select_soft_post.php Upload Any Files To The Specified Directory Via Variable Not Initial Flaw Bypass Extension Defence

摘要：Dedecms include\dialog\select_soft_post.php Upload Any Files To The Specified Directory Via Variable Not Initial Flaw Bypass Extension Defence 阅读全文

posted @ 2014-12-15 20:31 郑瀚Andrew 阅读(2394) 评论(0) 推荐(1) 编辑

ECSHOP \admin\edit_languages.php GETSHELL Based On Injection PHP Code Into /languages/zh_cn/user.php

摘要：ECSHOP \admin\edit_languages.php GETSHELL Based On Injection PHP Code Into /languages/zh_cn/user.php 阅读全文

posted @ 2014-11-11 10:46 郑瀚Andrew 阅读(2616) 评论(0) 推荐(0) 编辑

ECSHOP Inject PHPCode Into \library\myship.php Via \admin\template.php && \includes\cls_template.php Vul Tag_PHP_Code Execute Getshell

摘要：ECSHOP myship.php Vul Tag_PHP_Code Execute Getshell 阅读全文

posted @ 2014-11-06 13:45 郑瀚Andrew 阅读(1434) 评论(1) 推荐(0) 编辑

DRUPAL-PSA-CORE-2014-005 && CVE-2014-3704 Drupal 7.31 SQL Injection Vulnerability /includes/database/database.inc Analysis

摘要：DRUPAL-PSA-CORE-2014-005 && CVE-2014-3704 Drupal 7.31 SQL Injection Vulnerability /includes/database/database.inc Analysis 阅读全文

posted @ 2014-11-01 17:25 郑瀚Andrew 阅读(1254) 评论(0) 推荐(0) 编辑

WDCP(WDlinux Control Panel) mysql/add_user.php、mysql/add_db.php Authentication Loss

摘要：WDCP(WDlinux Control Panel) mysql/add_user.php、mysql/add_db.php Authentication Loss 阅读全文

posted @ 2014-10-30 20:46 郑瀚Andrew 阅读(1699) 评论(1) 推荐(0) 编辑

phpMyadmin /scripts/setup.php Remote Code Injection && Execution CVE-2009-1151

摘要：phpMyadmin /scripts/setup.php Remote Code Injection && Execution CVE-2009-1151 阅读全文

posted @ 2014-10-22 17:29 郑瀚Andrew 阅读(4294) 评论(1) 推荐(0) 编辑

Han Zheng, Practitioners and Theoretical Researcher, Now working in Alibaba Cloud Corp, China

Welcome to contact me. Wechat：LittleHann，My email, 306211321@qq.com，Job mail：zhenghan.zh@alibaba-inc.com

随笔分类 - CMS漏洞分析

公告