http://bbs.wolvez.org/viewtopic.php?id=222

by:xhm1n9
 2011.2.21
 
inc/mod_main.php //漏洞文件

 case 'category':
       if (!$job) $job='default';
   else $job=basename($job);
   $ifannouncement="none";

   acceptrequest('mode');
   if ($mode==1 || $mode==2) {
       

by:xhm1n9

2010.12.28

      半年前看到的了，平常自己不怎么日站，留着也没什么用(没留意别人有没放出过)。

    http://www.x-xox-x.net/exploit/11/

by:xhm1n9

#!/usr/bin/php
<?php
print_r('
+-------------------------------------------------------------------------------------------+
2010.2.6
discuz 7.0-7.2 get shell
exploit by xhming
site: http://hi.baidu.com/mr_xhming
+-------------------------------------------------------------------------------------------+
');
if ($argc < 3) {
        print_r(

                                          dvbbs php2.0漏洞

1,joinvipgroup.php //注入

function up_vipuser(){

看到大牛已放出exp，我也放出我的分析！大家将就下看吧

exp在http://hi.baidu.com/toby57/blog/item/686b70ece294cfdc2f2e2183.html

................................................................................................................................................

by:xhm1n9

article_add.php
........................
else if($dopost=='save')
{
include(DEDEMEMBE

by:xhm1n9

       MolyX以前还是有蛮大的用户下载量的，现在没落了，记得刚开始学php时有看过这程序，但是没能找到bug，今天偶然路过用这程序的论坛，非常想知道安全性相比以前有什么样的进步! 可惜到现在还是不咋地~~~漏洞比较简单，写出来算是给刚开始摸索php漏洞的同鞋举个例吧!
                      
1, includes/db/db_base.php 注入
 

by:xhm1n9

/flow.php
..................................

elseif ($_REQUEST['step'] == 'update_cart')
{
    if (isset($_POST['goods_number']) && is_array($_POST['goods_number']))
    {
        flow_update_cart($_POST['goods_number']);
    }

    show_message($_LANG['update_cart_notice'], $_LANG['back_to_cart'], 'flow.php');
  

by:xhming              

1. source/cp_friend.php 文件

     elseif($op == 'group') {

if(submitcheck('groupsubmin')) {
   if(empty($_POST['fuids'])) {
    showmessage('please_correct_choice_groups_friend');
   }
   $ids = simplode($_POST['fuids']);
   $groupid = intval($_POST['group']);
  

                                supersite7.5找回密码的鸡肋问题!

     source/do_lostpasswd.php 这是找回密码的文件！   

if(submitcheck('lostpwsubmit')) {

$_POST['username'] = trim($_POST['username']);

if ($_POST['username']) {
   $user = uc_get_u