Wordpress Theme U-Design Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Theme U-Design Arbitrary File Download Vulnerability Date: 18/01/2015 Exploit Author: t3rr0rist - GHC Georgian Hacking Community team Contact : email protected Tested on: Linux Google Dork:...

U-Mail v9.8.57 /getpass.php 信息泄漏漏洞

No description provided by source...

U-Mail the latest version of the arbitrary File Download vulnerability-vulnerability warning-the black bar safety net

The problem occurs is in the picture preview of the place code area http://192.168.1.24/webmail/client/mail/index. php? module=operate&action=attach-img-preview&durl=1. gif&type=application/octet-stream The key code is as follows: code area if ACTION == "attach-img-preview" $downloadurl =...

U-mail邮件系统又一getshell

简要描述： U-mail邮件系统某处处理不当，导致getshell 详细说明： 版本：U-Mail for Windows V9.8.57 测试帐号：[email protected] 测试主机：windows server 2003+IIS6 windows主机配置都为邮件系统默认配置 首先需要获取用户的UserID，因为其缓存目录路径为 umail\WorldClient\html\client\cache\userid\ 获取用户id的接口为...

U-Mail最新版任意文件下载漏洞

简要描述： 下载了最新版的umail，发现漏洞还不少，不过上wooyun一搜索，都是以前大牛提交过了，只好另找一个了。任意文件下载，泄露系统重要敏感信息，还可导致可下载任意用户的全部邮件。u-mail的使用量就不说了，可以参考： http://www.wooyun.org/bugs/wooyun-2010-061859 详细说明： 问题出现的位置是在图片预览的地方...

Arris VAP2500 tools_command.php Command Execution

Arris VAP2500 access points are vulnerable to OS command injection in the web management portal via the toolscommand.php page. Though authentication is required to access this page, it is trivially bypassed by setting the value of a cookie to an md5 hash of a valid username. Module Options msf us...

U-Mail某处sql注射漏洞

简要描述： U-Mail sql注射 U-mail 进行了文件更新其他的漏洞已经被修补了 但是还有一处没有进行修补 详细说明： oconcat.php: if ACTION == "contact-edit" $contactid = gss $GET'id' ; $grouplist = explode ",", trim $POST'grouplist' ; $groupchange = gss $POST'groupchange' ; if !$contactid && !checkpost dumpjson array "status" = 0, "message" =...

Hackers publish the BadUSB fix patch only applies to the latest version of the group with the USB 3.0 firmware-bug warning-the black bar safety net

Last week, two hackers announced they had the BadUSB code reverse engineering, and on GitHub published. As for the reason for this, is to give the industry the pressure is applied, in order to quickly come up with a solution--although doing so will also make the user more vulnerable to face...

U-Mail存储型XSS漏洞(可XSS邮箱用户、系统管理员、域管理员)

简要描述： U-Mail存储型XSS漏洞，可XSS任意邮箱用户以及系统管理员、域管理员 详细说明： U-Mail邮箱系统未对邮箱用户的个人资料进行编码处理导致存储型XSS，可导致收到邮件的普通邮箱用户受到XSS，同时邮箱系统管理员、邮箱域管理员在进行用户管理时也会受到XSS攻击，可导致邮箱系统管理员和域管理员的会话被劫持，邮箱系统被控制，更进一步利用U-Mail得PHP+IIS解析漏洞可导致服务器被控制。 U-Mail官网：http://www.comingchina.com/ 试用版下载：http://www.comingchina.com/html/downloads/...

U-mail一处SQL注入+任意文件删除

简要描述： U-mail一处SQL注入+任意文件删除 详细说明： oletterpaper.php 1.sql注入： if ACTION == "letterpaper-set" $url = makelink "option", "view", "letterpaper" ; $lpid = gss $POST'id' ; .... if $lpid $lpinfo = $Widget-getoneletterpaper "id=".$lpid, "", 0 ; 没啥好分析的，直接上exp...

U-Mail邮件服务系统存在漏洞可获取所有用户密码

简要描述： 产品介绍摘自官网 U-Mail专注于电子邮件领域15年，为企业轻松搭建最安全稳定的电子邮件系统软件。 关键字：15年 最安全 最稳定 涉及：金融、政府、银行，石油、军队、证券行业等重要部门，影响非常巨大，经测试受影响率：99.8%100% 场外话：我很想把农业银行拿下来的,想想还是算了,毕竟随便改卡里的数字,成土豪了，这样是极其不安全的.. 详细说明： 1 产品介绍...

U-mail某鸡肋代码注入导致敏感信息泄漏(demo测试成功)

简要描述： RT 详细说明： 漏洞文件：api/api.php:670行 $do = trim $GET'do' ; if functionexists $do $do ; else echo "paramerror"; exit ; 直接来个动态函数，可惜没有参数可控，只能控制$do,所以可以鸡肋的用来读些敏感信息如phpinfo/phpcredits等 漏洞证明： 官网demo: http://mail.comingchina.com/webmail/api/api.php?do=phpinfo...

Serv-U FTP Server < 15.1.0.458 Multiple Vulnerabilities

According to its banner, the installed version of Serv-U is a version prior to 15.1.0.458. It is, therefore, affected by a cross-site scripting vulnerability, an information-disclosure vulnerability, and multiple unspecified security vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security...

Cat Soft Serv-U 2.5/a/b,Windows 2000/95/98/NT 4.0 Shortcut Vulnerability

No description provided by source. Cat Soft Serv-U 2.5/a/b,Windows 2000 Advanced Server/2000 Datacenter Server/2000 Professional/2000 Server/2000 Terminal Services/95/98/NT 4.0/NT Enterprise Server 4.0/NT Server 4.0/NT Terminal Server 4.0/NT Workstation 4.0 Shortcut Vulnerability source:...

RhinoSoft Serv-U FTP Server 7.2.0.1 'rnto' Command Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31563/info RhinoSoft Serv-U FTP server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue allows an attacker to write arbitrar...

RhinoSoft Serv-U FTP Server 3/4/5 MDTM Command Time Argument Buffer Overflow Vulnerability (3)

No description provided by source. source: http://www.securityfocus.com/bid/9751/info Serv-U FTP Server has been reported prone to a remote stack based buffer overflow vulnerability when handling time zone arguments passed to the MDTM FTP command. The problem exists due to insufficient bounds...

Cisco Aironet AP1x00 Malformed HTTP GET Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8290/info Cisco Aironet AP1x00 series devices are prone to a denial of service vulnerability upon receipt of a malformed HTTP GET request. Such a request will cause the device to reload. !/usr/bin/perl Cisco Global...

RhinoSoft Serv-U FTP Server 3.x/4.x/5.0 LIST Parameter Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10181/info Reportedly Serv-U is affected by a remote buffer overflow vulnerability in the list parameter. This issue is due to a failure of the application to properly validate buffer boundaries during processing of user...

Serv-U FTPD MDTM Overflow

No description provided by source. $Id: servumdtm.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Serv-U 4.x "site chmod" Remote Buffer Overflow Exploit

No description provided by source. include stdio.h include sys/types.h include sys/socket.h include netinet/in.h define exploitlength 511 define NOP 'A' define SEHhandleroffset 400 char SEHhandler = \x41\x41\xEB\x04; // 3 jmp over next four bytes char retaddress4004 = \xab\x1c\x5f\x01; // 1...