听前奏就爱上了古风 - 歌单 - 网易云音乐
听前奏就爱上了古风
原来喜欢快节奏的歌曲，现在成功被这里的古风大神俘虏了。个人喜欢没有细分类~就是这么不羁啊
播放：37次
网易云音乐多端下载
同步歌单，随时畅听320k好音乐
网易公司版权所有(C)杭州乐读科技有限公司运营：清风不解语 - 歌单 - 网易云音乐
清风不解语
播放：775次
网易云音乐多端下载
同步歌单，随时畅听320k好音乐
网易公司版权所有(C)杭州乐读科技有限公司运营：SecurityTrackerArchives
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
to receive customized, instant alerts
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and
Our Database or Notification Service
Category:&&
Vendors:&&
HELM Input Validation Holes Let Remote Authenticated Users Inject SQL Commands and Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:&&1012047
SecurityTracker URL:&&/id/1012047
CVE Reference:&&
&&(Links to External Site)
Date:&&Nov
Fix Available:&&Yes&&Vendor Confirmed:&&Yes&&
Version(s): 3.1.19 and prior versions
Description:&&
Hat-Squad reported some input validation vulnerabilities in HELM in the HELM Messaging module.
A remote authenticated user can inject SQL commands and conduct cross-site scripting attacks.
The user can obtain administrative privileges.
It is reported that the HELM Messaging module does not properly validate user-supplied input in the messaging service.
In particular, the &messageToUserAccNum& parameter of &compose message& form is not properly validated, allowing a remote authenticated user to send arbitrary SQL code to execute SQL queries.
A demonstration exploit value to cause the system to add an account with administrative privileges is provided:
password to the account table in HELM database:
xxxx',10,0);
insert into
account(accountnumber,accounttype,accountpassword) values('root',0,'');--
It is also reported that the &Subject& field of the &compose message& form is not properly validated.
A remote user can supply specially crafted input that, when viewed by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the HELM software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Behrang Fouladi is credited with discovering this flaw.
The vendor was notified on October 28, 2004.
The original advisory is available at:
http://www./en/000077.html
A remote user can execute SQL commands on the underlying database to gain administrative privileges.
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the HELM software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:&&
The vendor has released a fixed version (3.1.20), available at:
Vendor URL:&& (Links to External Site)
Underlying OS:&&,
Message History:
&Source Message Contents
Subject: &Hat-Squad Advisory: SQL injection and XSS Vulnerabilities in HELM
This is a cryptographically signed message in MIME format.
--------------ms
Content-Type: text/ charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Hat-Squad Advisory: SQL injection and XSS Vulnerabilities in HELM
November 2, 2004
Product: HELM Web Hosting Control Panel
Vendor URL:
Version: HELM 3.1.19 and lower
Vulnerability: SQL injection and XSS
Release Date: November 2, 2004
Vendor Status:
Informed on 28 October 2004
Response: 1 November 2004
Fixed on 1 November 2004
Description:
Helm is a multi-server management and control system for Windows 2000
and 2003 based web hosts. The system is designed for
any size web hosting companies, datacenters and ISPs, which require a
solid platform that automates all of the day-to-day
tasks that would otherwise require highly skilled man power, and large
work forces.
HELM Messaging module is used by resellers to keep customers up to date
with the latest information. System information
messages can also be sent to the messaging service to inform resellers
and users of any problems. Due to the lack of proper
input validation in this module, it's possible both to inject SQL
commands and malicious script to the system to gain &ADMIN&
level access to the system.
SQL Injection:
There is no input validation on &messageToUserAccNum& parameter of
&compose message& form. Therefore it's possible to execute
SQL query by passing arbitrary SQL code.
By using a Man in The Middle HTTP tool, it's possible to inject sql
query in &messageToUserAccNum& value, in the form of:
[username]',[messageid],[isread]);
[arbitrary sql query];--
A User with reseller level access can send the following value that will
add an account &root& with ADMIN privilege and blank
password to the account table in HELM database:
xxxx',10,0);
insert into
account(accountnumber,accounttype,accountpassword) values('root',0,'');--
Cross Site Scripting:
XSS attack code could be sent in &Subject& field of &compose message&
form. Viewing the message by victim user (usually
ADMIN) will run the attack code.
Update Your HELM software version to 3.1.20 .
This vulnerability has been discovered by Behrang Fouladi
(behrang@)
The Original advisory could be found at:
http://www./en/000077.html
--------------ms
Content-Type: application/x-pkcs7- name=&smime.p7s&
Content-Transfer-Encoding: base64
Content-Disposition: filename=&smime.p7s&
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIO+DCC
BOUwggPNoAMCAQICChDLgJAAAAAAEs8wDQYJKoZIhvcNAQEEBQAwgc0xCzAJBgNVBAYTAkVT
MQ8wDQYDVQQIEwZNYWRyaWQxDzANBgNVBAcTBk1hZHJpZDExMC8GA1UEChMoaXBzQ0EtSVBT
IFNlZ3VyaWRhZCBodHRwOi8vd3d3Lmlwc2NhLmNvbTEfMB0GA1UECxMWQ2VydGlmaWNhZG9z
IENMQVNFIEItMTEmMCQGA1UEAxMdQ0xBU0UgQi0xIGlwc0NBLUlQUyBTZWd1cmlkYWQxIDAe
BgkqhkiG9w0BCQEWEWlwc2NhYjFAaXBzY2EuY29tMB4XDTA0MTAyMTE1MzQ0OFoXDTA2MTAy
MTE1NDQ0OFowWzEkMCIGCSqGSIb3DQEJARYVc2VydmljZUBoYXQtc3F1YWQuY29tMTMwMQYD
VQQDHioAcwBlAHIAdgBpAGMAZQBAAGgAYQB0AC0AcwBxAHUAYQBkAC4AYwBvAG0wXDANBgkq
hkiG9w0BAQEFAANLADBIAkEAxpGQul+Iw8QVFlE5T+E25d1H0recn0hSBLaMBYqMtzoFBkd2
5Z45+0eOspbeqXyjHthFJlGv3Z4pB/SQNg5PxwIDAQABo4IB/jCCAfowDgYDVR0PAQH/BAQD
AgTwMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4EFgQUvrKvLnr2zkI8
xR8Gjfpbhtr813MwgdIGA1UdIwSByjCBx4AUm1zbpeb3EdgVTZKRchy8G0yxKQqhgamkgaYw
gaMxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCQVJDRUxPTkExEjAQBgNVBAcTCUJBUkNFTE9O
QTEZMBcGA1UEChMQSVBTIFNlZ3VyaWRhZCBDQTEYMBYGA1UECxMPQ2VydGlmaWNhY2lvbmVz
MRcwFQYDVQQDEw5JUFMgU0VSVklET1JFUzEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwuaXBz
LmVzggMAkBMwZAYDVR0fBF0wWzAtoCugKYYnaHR0cDovL3d3dy5pcHNjYS5jb20vY3JsL2lw
c2NhYjFjcmwuY3JsMCqgKKAmhiRodHRwOi8vd3d3Lmlwcy5lcy9jcmwvaXBzY2FiMWNybC5j
cmwwbwYIKwYBBQUHAQEEYzBhMDAGCCsGAQUFBzAChiRodHRwOi8vd3d3Lmlwc2NhLmNvbS9j
cmwvaXBzY2FiMS5jcnQwLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuaXBzLmVzL2NybC9pcHNj
YWIxLmNydDANBgkqhkiG9w0BAQQFAAOCAQEAkGSYS1nw7yh6JB+9pb5muXrK8E5bffNt+L2e
bfXOxJxSrx63F1Wx5KLDGzCmLo/syRtBy0f687JuUzeMb5afLVhqP0KVYDUFa7AgiAknSsdf
7sjkMMih3X8HVpCGsxwybES1vuR1POYZSOE0XE5G0wZ2GU3R6JaUg13qAdwHvBXk98ntsWxB
o1enmEOIqqWIhcfr0xpLZQt75tB7TsUFDWKNtosAgN4LhPvfbDw0aEHk9QghNh2+rBioV05H
GrJl5JeeWuMipQKTay0bVJKv4l9w3hw0nx9ckpqhkV8WN7sNaKQgmBoJjiy6+6tqtKtJxPQn
iikONLjeb/lEcml8NjCCBOUwggPNoAMCAQICChDLgJAAAAAAEs8wDQYJKoZIhvcNAQEEBQAw
gc0xCzAJBgNVBAYTAkVTMQ8wDQYDVQQIEwZNYWRyaWQxDzANBgNVBAcTBk1hZHJpZDExMC8G
A1UEChMoaXBzQ0EtSVBTIFNlZ3VyaWRhZCBodHRwOi8vd3d3Lmlwc2NhLmNvbTEfMB0GA1UE
CxMWQ2VydGlmaWNhZG9zIENMQVNFIEItMTEmMCQGA1UEAxMdQ0xBU0UgQi0xIGlwc0NBLUlQ
UyBTZWd1cmlkYWQxIDAeBgkqhkiG9w0BCQEWEWlwc2NhYjFAaXBzY2EuY29tMB4XDTA0MTAy
MTE1MzQ0OFoXDTA2MTAyMTE1NDQ0OFowWzEkMCIGCSqGSIb3DQEJARYVc2VydmljZUBoYXQt
c3F1YWQuY29tMTMwMQYDVQQDHioAcwBlAHIAdgBpAGMAZQBAAGgAYQB0AC0AcwBxAHUAYQBk
AC4AYwBvAG0wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAxpGQul+Iw8QVFlE5T+E25d1H0rec
n0hSBLaMBYqMtzoFBkd25Z45+0eOspbeqXyjHthFJlGv3Z4pB/SQNg5PxwIDAQABo4IB/jCC
AfowDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNV
HQ4EFgQUvrKvLnr2zkI8xR8Gjfpbhtr813MwgdIGA1UdIwSByjCBx4AUm1zbpeb3EdgVTZKR
chy8G0yxKQqhgamkgaYwgaMxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCQVJDRUxPTkExEjAQ
BgNVBAcTCUJBUkNFTE9OQTEZMBcGA1UEChMQSVBTIFNlZ3VyaWRhZCBDQTEYMBYGA1UECxMP
Q2VydGlmaWNhY2lvbmVzMRcwFQYDVQQDEw5JUFMgU0VSVklET1JFUzEeMBwGCSqGSIb3DQEJ
ARYPaXBzQG1haWwuaXBzLmVzggMAkBMwZAYDVR0fBF0wWzAtoCugKYYnaHR0cDovL3d3dy5p
cHNjYS5jb20vY3JsL2lwc2NhYjFjcmwuY3JsMCqgKKAmhiRodHRwOi8vd3d3Lmlwcy5lcy9j
cmwvaXBzY2FiMWNybC5jcmwwbwYIKwYBBQUHAQEEYzBhMDAGCCsGAQUFBzAChiRodHRwOi8v
d3d3Lmlwc2NhLmNvbS9jcmwvaXBzY2FiMS5jcnQwLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cu
aXBzLmVzL2NybC9pcHNjYWIxLmNydDANBgkqhkiG9w0BAQQFAAOCAQEAkGSYS1nw7yh6JB+9
pb5muXrK8E5bffNt+L2ebfXOxJxSrx63F1Wx5KLDGzCmLo/syRtBy0f687JuUzeMb5afLVhq
P0KVYDUFa7AgiAknSsdf7sjkMMih3X8HVpCGsxwybES1vuR1POYZSOE0XE5G0wZ2GU3R6JaU
g13qAdwHvBXk98ntsWxBo1enmEOIqqWIhcfr0xpLZQt75tB7TsUFDWKNtosAgN4LhPvfbDw0
aEHk9QghNh2+rBioV05HGrJl5JeeWuMipQKTay0bVJKv4l9w3hw0nx9ckpqhkV8WN7sNaKQg
mBoJjiy6+6tqtKtJxPQniikONLjeb/lEcml8NjCCBSIwggSLoAMCAQICAwCQEzANBgkqhkiG
9w0BAQQFADCBozELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJBUkNFTE9OQTESMBAGA1UEBxMJ
QkFSQ0VMT05BMRkwFwYDVQQKExBJUFMgU2VndXJpZGFkIENBMRgwFgYDVQQLEw9DZXJ0aWZp
Y2FjaW9uZXMxFzAVBgNVBAMTDklQUyBTRVJWSURPUkVTMR4wHAYJKoZIhvcNAQkBFg9pcHNA
bWFpbC5pcHMuZXMwHhcNMDEwMzExMTkxNDI1WhcNMDkxMjI5MTkxNDI1WjCBzTELMAkGA1UE
BhMCRVMxDzANBgNVBAgTBk1hZHJpZDEPMA0GA1UEBxMGTWFkcmlkMTEwLwYDVQQKEyhpcHND
QS1JUFMgU2VndXJpZGFkIGh0dHA6Ly93d3cuaXBzY2EuY29tMR8wHQYDVQQLExZDZXJ0aWZp
Y2Fkb3MgQ0xBU0UgQi0xMSYwJAYDVQQDEx1DTEFTRSBCLTEgaXBzQ0EtSVBTIFNlZ3VyaWRh
ZDEgMB4GCSqGSIb3DQEJARYRaXBzY2FiMUBpcHNjYS5jb20wggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQDN/dRdxbqK3kEv4nSwsqAm/SMrvjuxyUqAUfm2OPLoDdfaclBwLZat
9McSqBPS/o+gEVE4/irrx7YHFoa2f/zaHE937iCnfachQDZ4vYt3ckpQFGXrVcTVYtbTTmY8
VENlr3uf62dQBMuqmWUHCS1rS3J8HD3V7XqnE5ojQWHEKUddBUCzzRa0qGHSRDMRWgDvcxo2
x2R6nlj873kRcaq4NRrL+mnbGEEwMeRr9RfvU+4dIFV9ixhky4viY8fJHiATf1gCod9Q87P1
T6aabftupxjGz1pY49fKaqHiPrlj0AxqMOALuA6VNcfypzjCP9f04zTjmdSTrg5ziQjxHkD1
AgMBAAGjggGyMIIBrjAiBglghkgBhvhCAQIEFRYTaHR0cHM6Ly93d3cuaXBzLmVzLzAhBglg
hkgBhvhCAQMEFBYSZXN0YWRvL2VzdGFkby5hc3A/MCUGCWCGSAGG+EIBBAQYFhZlc3RhZG9D
QUIxL2VzdGFkby5hc3A/MCIGCWCGSAGG+EIBBwQVFhNlc3RhZG8vcmVudWV2YS5hc3A/MCAG
CWCGSAGG+EIBCAQTFhFlc3RhZG8vcG9saWN5LmFzcDAzBglghkgBhvhCAQ0EJhYkQ2VydGlm
aWNhZG8gcG9yIElQUyBTZXJ2aWRvcmVzIGlwc0NBMBEGCWCGSAGG+EIBAQQEAwIABzAMBgNV
HRMEBTADAQH/MB0GA1UdDgQWBBSbXNul5vcR2BVNkpFyHLwbTLEpCjBABgNVHR8EOTA3MDWg
M6Axhi9odHRwOi8vd3d3Lmlwc2NhLmNvbS9jcmwvaXBzY2FTRVJWSURPUkVTY3JsLmNybDBB
BggrBgEFBQcBAQQ1MDMwMQYIKwYBBQUHMAKGJWh0dHA6Ly93d3cuaXBzY2EuY29tL2VzdGFk
by9jYUIxLmh0bWwwDQYJKoZIhvcNAQEEBQADgYEAU/03+kbQ6RUr1Q8jAPy4Hdx8r2q7QQPH
2UrusbImuHqYd3xa0/n6cIoi2N7UnuHfjPW6jDaFIol7JqBw5JFjc3/frLqU1QW+73ltfUPL
mXhdE6RrN0QzaedwkA5Ez0K+/Dol2gGUi69nvvEXLq/u+Mp0BgWtyvWy0zfZxuEp74oxggPZ
MIID1QIBATCB3DCBzTELMAkGA1UEBhMCRVMxDzANBgNVBAgTBk1hZHJpZDEPMA0GA1UEBxMG
TWFkcmlkMTEwLwYDVQQKEyhpcHNDQS1JUFMgU2VndXJpZGFkIGh0dHA6Ly93d3cuaXBzY2Eu
Y29tMR8wHQYDVQQLExZDZXJ0aWZpY2Fkb3MgQ0xBU0UgQi0xMSYwJAYDVQQDEx1DTEFTRSBC
LTEgaXBzQ0EtSVBTIFNlZ3VyaWRhZDEgMB4GCSqGSIb3DQEJARYRaXBzY2FiMUBpcHNjYS5j
b20CChDLgJAAAAAAEs8wCQYFKw4DAhoFAKCCApMwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEH
ATAcBgkqhkiG9w0BCQUxDxcNMDQxMTAyMDAzMjM3WjAjBgkqhkiG9w0BCQQxFgQUTPgBxI4D
HdCkAX/jAUFKW/LZ4mgwUgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAOBggqhkiG9w0D
AgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwge0GCSsGAQQB
gjcQBDGB3zCB3DCBzTELMAkGA1UEBhMCRVMxDzANBgNVBAgTBk1hZHJpZDEPMA0GA1UEBxMG
TWFkcmlkMTEwLwYDVQQKEyhpcHNDQS1JUFMgU2VndXJpZGFkIGh0dHA6Ly93d3cuaXBzY2Eu
Y29tMR8wHQYDVQQLExZDZXJ0aWZpY2Fkb3MgQ0xBU0UgQi0xMSYwJAYDVQQDEx1DTEFTRSBC
LTEgaXBzQ0EtSVBTIFNlZ3VyaWRhZDEgMB4GCSqGSIb3DQEJARYRaXBzY2FiMUBpcHNjYS5j
b20CChDLgJAAAAAAEs8wge8GCyqGSIb3DQEJEAILMYHfoIHcMIHNMQswCQYDVQQGEwJFUzEP
MA0GA1UECBMGTWFkcmlkMQ8wDQYDVQQHEwZNYWRyaWQxMTAvBgNVBAoTKGlwc0NBLUlQUyBT
ZWd1cmlkYWQgaHR0cDovL3d3dy5pcHNjYS5jb20xHzAdBgNVBAsTFkNlcnRpZmljYWRvcyBD
TEFTRSBCLTExJjAkBgNVBAMTHUNMQVNFIEItMSBpcHNDQS1JUFMgU2VndXJpZGFkMSAwHgYJ
KoZIhvcNAQkBFhFpcHNjYWIxQGlwc2NhLmNvbQIKEMuAkAAAAAASzzANBgkqhkiG9w0BAQEF
AARAjYFP1pPLm820yvQ7z+2C6F1aPgxxNDTNOLaqJ11jJhmycqHnLpJ8ArRBGVXdqydVEosf
HUVPpL8kC+tFWaD3ZwAAAAAAAA==
--------------ms--
Copyright 2017, SecurityGlobal.net LLC 上传我的文档
 下载
 收藏
该文档贡献者很忙，什么也没留下。
 下载此文档
华北电力大学自动控制理论习题答案
下载积分：100
内容提示：华北电力大学自动控制理论习题答案
文档格式：DOC|
浏览次数：45|
上传日期： 15:32:31|
文档星级：
全文阅读已结束，如果下载本文需要使用
 100 积分
下载此文档
该用户还上传了这些文档
华北电力大学自动控制理论习题答案
关注微信公众号