Cloud Security

Metinfo is a fully functional marketing-type enterprise website management platform based on the PHP + MYSQL architecture. Two errors occurred during design, sensitive information leakage and cross-site scripting. Metinfo3.0 file code Leakage EXp:

1. File NameWe all know that in windows, there are rules for file names and some reserved characters are defined. They are: (greater than): (colon)" (double quote)/ (forward slash) (backslash)| (vertical bar or pipe)? (question mark)* (asterisk) In

Default Asp/connector. asp? Command = CreateFolder & Type = Image & CurrentFolder =/o. asp & NewFolderName = o. asp "> www.xx.com/admin/system/editor/fckeditorboyisx/editor/filemanager/connectors/asp/connectorasp? Command = CreateFolder & Type =

Vulnerability Author: blueSubmission time: Public time:Vulnerability Type: CSRF hazard level: high vulnerability status: confirmed by the vendorBrief description:When the target user logs on to the QQ space, he or she can trick the user into opening

The SOOP Portal Member registration page contains security questions, which can be uploaded and executed using pseudo-creation shell.asp;.jpg.  Google: "soops Portal 2.0" 1. Register as a Website member; http://www.bkjia.com/member_form.asp? Do = 5

Brief description of vulnerability details: Incorrect memcache configuration may cause security problemsDescription: C:> nc-vv 61.135.178.118 1121161.135.178.118: inverse host lookup failed: h_errno 11004: NO_DATA(UNKNOWN) [61.135.178.118] 11211 (?)

The out-of-the-star virtual machine has been regarded as BT. In fact, I feel better. At least he supports aspx. If you find some execution directories, you can kill them in 99% seconds and take the server permissions.The latest version of the

Author: Salvatore Fresta aka Drosophila Official Website: joomlaextensions. co. in Vulnerability Type: File UploadVulnerability Description: an error in the program saving function. (compose. php) allows you to upload files with any extension to

# Vendor or Software Link: http://www.phpwebscripts.com/admanagerpro/ # Category: WebApp # Version: 3 # Price: $99/$130/$325 USD # Contact: R4dc0re@yahoo.fr # Website: www.1337db.com # Greetings to: R0073r (1337db.com), L0rd CrusAd3r, Sid3 ^ effects

Mssql: Hid = request. QueryString ("id ")SQL = "select * from admin where id =" & hidSet rsw.conn.exe cute (SQL)%> Access: Db = "aspzhuru. mdb" Modify the database path or name hereSet conn = Server. CreateObject ("ADODB. Connection ")Dbpath =

Author: kj021320 Reprinted please indicate the source In fact, there is no need to use such a method for a powerful database like ORACLE. The SQLJ stored procedure can also write files, forcing the other machine to not support sqlj and the UTL_FILE

Especially for users who use virtual hosts, if the CPU is overloaded, a "service unariable" prompt will appear. There are many factors related to overloading, such as unreasonable webpage structure and excessive traffic. Another possible malicious

Summary of liunx-related Elevation of Privilege penetration techniques. 1. ldap penetration skills:1. cat/etc/nsswitchCheck the Password Logon Policy. We can see that the file ldap mode is used.2. less/etc/ldap. confBase ou = People, dc =

Author: Mo Liang [B. H.S. T] Many people often test injection. Most of them only read the link submitted by get. data submitted by post method may be too lazy to capture packets for testing as I do, and some diligent buddies may also try cookie

Brief description: path burst caused by improper allocation of Awstats statistics PermissionsDescription: Awstats is a Perl-based WEB log analysis and statistics Tool. Because of its simple and powerful functions, it is favored by many

Mind Affected Versions: LatestHttp://www.kewei8.com Vulnerability Type: SQL InjectionVulnerability description: Take a few minutes to find the vulnerability.The web site navigation is the same as the program file in the box navigation. The interface

By coffee (k4kup8_0x00004_gmail.com) [Directory] 1. Brief Introduction2. php Execution Process3. lifecycle of php4. php source code analysis and functional code implementation5. Summary6. References I. Brief Introduction Php-specific runtime

Author: superhei [http://hi.baidu.com/hi_heige]Team: www.80vul.comWww.ph4nt0m.orgI. PrefaceThis article is actually due To the [technical challenges] How To Exploit Location Cross-DoIn the IE section of main Scripting, since basically no one is

Release date: 2011-01.17Author:★Kiddie★ Affected Version: UnknownHttp://www.ecisp.cn Vulnerability Type: Cookie SpoofingVulnerability Description: After obtaining COOKIES, modify spoofing and upload jpg files to the background to construct Getshell.

Official download: http://www.network-13.com/ EXP: Remote Admin Add CSRF Exploit Remote Admin Add CSRF Exploit by qing-Edit