Basilic diff.php RCE

Exploits command injection in Basilic = 1.5.14 via the file parameter on /Config/diff.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection RCE — execute session.""" from future import annotations import re from...

Basilic - diff.php RCE Detection

Detects Basilic = 1.5.14 RCE via /Config/diff.php?file=;id&new=1&old=2. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

Hardcoded credentials

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CVE-2019-12094

CVE-2019-12094 affects Horde Groupware Webmail Edition through 5.2.22. The vulnerability allows XSS via crafted URIs such as admin/user.php?form=update_f&user_name=, admin/user.php?form=remove_f&user_name=, or admin/config/diff.php?app=, as documented in the CVE entry and OSV/NVD references. The ...

CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

PT-2019-12636

Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail Edition versions prior to 5.2.23 Description The issue allows for XSS attacks via specific URI parameters. This can be achieved through the admin/user.php endpoint with either the form=update f or form=remove f paramete...

CVE-2019-12094: Improper Neutralization of Input During Web Page Generation

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CVE-2012-3399: Improper Input Validation

Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter...

PT-2012-4692

Name of the Vulnerable Software and Affected Versions Basilic version 1.5.14 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter in the Config/diff.php file. Recommendations For Basilic version 1.5.14, consider restricting...

Basilic RCE bug

Hi Dear Sir Basilic is an Automated Bibliography Server for Research Publications Diffusion that use by many research center. there is a RCE bug in basilic/Config/diff.php s could allow an attacker to run system command in server. sample:...