Cloud Security

  # Exploit Title: WordPress TimThumb Plugin-Remote Code Execution # Google Dork: inurl: timthumb ext: php-site: googlecode.com-site: google.com # Date: 3rd August 2011 # Author: MaXe # Software Link: http://timthumb.googlecode.com/svn-history/r141/

Author: Xiaohua [] & [SOVO of Chengdu Neusoft Emy of information] ----- reposted here to describe the source! The cainiao expert does not laugh!A few days ago, I received a phone call from a high school student saying that the website of the middle

Brief description: Smarty is a widely used front-end template framework in PHP. However, because Smarty3 introduces new features, in some cases, you can use feature combinations to directly execute arbitrary code remotely. Detailed description:

Keywords: allinurl: borrow. php? Diskid =Keywords: allintitle: videodb # Vendor: http://www.videodb.net/blog/ $ -----------#| Initialverun |&------------@ Along with this I was able in some sites to determine that you can overwrite the databse

JoomTouch Joomla Component Software: com_joomtouch ver 1.0.2Vendor: http://www.joomtouch.com/  Test method:Http://www.bkjia.com/[path]/index. php? Option = com_joomtouch & controller = [LFI]  Http://www.bkjia.com/[path]/index. php? Option =

4399 a function can be used with xss and filters, but it can be bypassed by some means.1 test address http://my.4399.com/space-693256254-do-blog-id-1140804.html please delete this address content after the vulnerability is confirmed. 2. 4399 the log

An injection point is found. http://www.bkjia.com /Diary_A.asp? UBID = & DCID = dc2012050610558247 & DIID = DI2012050610583389 habitually add 'having1 = 1 -- http://www.xxx.com.tw/Diary_A.asp?UBID=&DCID=DC2012050610553697&DIID=DI2012050610583389

Zhichuang waf does not strictly detect a policy, resulting in injection bypass. A defect in the professional firewall system (IIS version) of zhichuang website causes the website to be completely bypassed under certain circumstances. Zhichuang waf

When I came back to find a house during the Chinese New Year, I accidentally saw it. The internal information of the ball helps you find a house. Soufun can delete any rental information (whether it is a vulnerability or a risk)When you delete the

http://bbs.open.qq.com/ Is APACHE server, because of the existence of CVE-2012-0053, coupled with a small cross-site, you can get httponly cookie test environment: win7 + Firefox browser 19 briefly said 1. this forum is on the APACHE server, there

One day I dug up an xss for a resource, and then I told the Administrator that today I need to make a comeback with various filters and tragedies, after a day, I finally wrote an article to record ...... 1. After fuzz is edited for a long time, the

View source01 02 03 Oh no! 04 "; 06 07 08 09 And you thought parsers were smart. 10 11 Result: the priority is parsed, as if the priority is relatively high. Reference http://erlend.oftedal.no/blog/ below? Blogid = 91 content: "That

In the past few days, I have nothing to do and I have to hand in original articles. I started to go to the hacker's website and check the friendship and connection to see if I can build a hacker station. The main site is not capable of dz. under

Recently, in the intensive defcon topic training, one set of questions was mentioned in writeup written by a foreigner.LFIOther Tips For more information, see http://ddxhunter.wordpress.com/2010/03/10/lfis-exploitation-techniques/. PS:This technique

Output not filteredHttp://list.taobao.com/itemlist/default.htm There is a topic on the search page that shows the most recently browsed items from the shared objcet in flash for filtering. If shared objcet has malicious data, it will cause xss.     

Sina Weibo has another storage-type xss. Similar to the previous one, the filter is not synchronized and appears on the search page this time. Send a microblog, content: http://weibo.com if your account is included in the search, it forms a storage

In fact, we found this vulnerability on Renren's website. We clicked on Sina and found the vulnerability. Position filters all js Code. For example, if the input content contains an alert (1), all the content is filtered into null characters... The

This vulnerability allows you to bypass gpc escaping and defend against 80 sec injection attacks. In addition, Do not worry that the backend cannot be found. This is just a demo. Can I modify any database? Are you afraid you can't get the SHELL? The

The API of an application system of Youku does not strictly design the business logic when outputting user information. It directly outputs user's email address, user name, user password, user logon IP address, and other sensitive information. In

Is there a problem with the release of the 2013 release version ~ This is a problem of micro-sphere. Please add XSS code in the personal signature section of my account t.qq.com/CaoYebo1999 (please listen to QQ Security Center, please worship you,