phpwind 9.0后台执行任意php代码

简要描述： 诶呀我这种小透明总算是能够发一个看起来比较高大上的漏洞了´･ω･ --这次漏洞的利用需要APT或者社工才能做到｡・ω´･-- 所以请各位使用pw系统的站长要看好自己的权限咯 :з」∠ 话说我打这么多颜文字会不会看起来很萌 σ'ω'σ 哈哈哈哈哈就这样吧,高考完了闲得慌来一发漏洞 肉肉肉我爱你（开玩笑的） 详细说明： 漏洞的利用需要“门户设计”权限，也就是在线编辑网站模板所需要的权限。 测试的phpwind版本为 v9.0 20130702 本来直接告诉了开发组结果被说“你不给他权限不就好了嘛”，遂发到乌云来。 由于是0day所以估计涉及了大量版本（？） 正片：...

PostgreSQL <= 8.4.1 JOIN Hashtable Size Integer Overflow Vulnerability

Exploit for multiple platform in category dos / poc PostgreSQL is prone to a remote denial-of-service vulnerability because it fails to properly validate user-supplied data before using it in memory-allocation calculations. An attacker can exploit this issue to cause the affected application to...

VN Loader Authorization Bypass Vulnerability

VN Loader is botnet. Exploit is auth bypass with SQLi. SQLi can be used for more, but proof is auth bypass. Usage Info Change panelurl to url for bot panel. If disable actually connect, will not connect to panel, but only give you credentials. Credentials also in code comments. This is private...

NAGIOS NRPE <=2.15 Plugin Scanner and Remote Execution Exploit

A simple and powerfull NRPE remote comand execution masscaner who spawn a shell via netcat. Usage Info python NRPE.py This is private exploit. You can buy it at https://0day.today...

Wordpress Plugin CopySafe PDF Protection Shell Upload (0day) Vulnerability

Exploit for php platform in category web applications Title : Wordpress Plugin CopySafe PDF Protection Shell Upload Vulnerability Author : Aloulou Date : 01/06/2014 Facebook : http://www.facebook.com/Aloulou.TN Email: email protected Vendor : wordpress.org Google Dork :...

phpdisk任意文件上传getshell(官网已shell)

简要描述： M老师指哪个cms，我就打哪个cms真是幸福 无需登录，无需权限，直接getshell。 详细说明： 上传位置在plugins/phpdiskclient/clientsub.php 首先验证user-agent，然后从解密字符串里拿到了一个用户名和密码： None 选择shell上传，中途抓包。 改user-agent为“phpdisk-client”，不改不能上传。 发送。 返回包是这样的： 这个时候查看/system/cache/即可看到shell： 官网demo站shell已拿下：...

Xilisoft Video Converter Ultimate Dll Hijacking Exploit (quserex.dll)

Exploit for windows platform in category dos / poc / Title: Xilisoft Video Converter Ultimate Dll Hijacking Exploit quserex.dll Version: 7.8.1 build-20140505 Previous versions might be vulnerable Tested on: Windows XP SP2 en Vendor: http://www.xilisoft.com/ Software Link:...

Easy File Sharing FTP Server 3.5 - Stack Buffer Overflow

Exploit for windows platform in category remote exploits !/usr/bin/env python Exploit Title: Easy File Sharing FTP Server 3.5 stack buffer overflow Date: 27 May 2014 Exploit Author: superkojiman - http://www.techorganic.com Vulnerability discovered by: h07 CVE: CVE-2006-3952 OSVDB: 27646 Vendor...

WordPress Conversion Ninja Cross Site Scripting Vulnerability

WordPress Conversion Ninja plugin suffers from a cross site scripting vulnerability. Note that this finding houses site-specific data. ++++++++++++++++++++++++ + + Exploit Title: Wordpress Plugin Conversionninja Cross Site Scripting + + Exploit Author: Ashiyane Digital Security Team + + Date:...

(0Day) SAP Sybase ESP esp_parse Connection.getType Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Sybase ESP. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Connection.getType function in espserverlib.dll. By sending specific arguments to...

AoA Audio Extractor Basic ActiveX

Exploit for windows platform in category local exploits Exploit Title: AoA Audio Extractor Basic ActiveX Date: 19.05.2014 Author: metacom Website: www.rstforums.com Software Link: www.aoamedia.com/audioextractor.exe Version: 2.3.7 Tested on: Windows xp sp3EN IE 6.0 nse="\xEB\x06\xff\xff";...

AoA MP4 Converter ActiveX

Exploit for windows platform in category local exploits Exploit Title: AoA MP4 Converter ActiveX Date: 19.05.2014 Author:metacom Website: www.rstforums.com Software Link: www.aoamedia.com/AoAMP4Converter.exe Version: 4.1.2 Tested on: Windows xp sp3EN IE 6.0 nse="\xEB\x06\x90\x90";...

Wordpress Theme Echea Shell Upload Vulnerability

Exploit for php platform in category web applications Title : Wordpress Theme Echea Shell Upload Vulnerability Author : Aloulou Date : 15/05/2014 Facebook : http://www.facebook.com/Aloulou.TN Email: email protected Vendor : www.themeforest.net Google Dork : inurl:/wp-content/themes/echea/ Tested ...

TFTPD32 4.5 / TFTPD64 4.5 - DoS PoC

Exploit for windows platform in category dos / poc Exploit Title: TFTPD32 4.5 / TFTPD64 4.5 DoS poc Date: 13/05/2014 Exploit Author: j0s3h4x0r Homepage: http://tftpd32.jounin.net/tftpd32testimonials.html Software Link: http://tftpd32.jounin.net/download/tftpd32.450.zip Version: 4.5 32 bits / 4.5 ...

Wordpress Theme Photocrati-theme-v4.07 Shell Upload Vulnerability

Exploit for php platform in category web applications Title : Wordpress Theme Photocrati-theme-v4.07 Shell Upload Vulnerability Author : Aloulou Date : 13/05/2014 Facebook : http://www.facebook.com/Aloulou.TN Email: email protected Vendor : www.photocrati.com Google Dork...

Wordpress MU 0day Remote Code Execution Exploit

Remote PHP and Shell code execution on any version of Wordpress MU. See dork: "powered by wordpress mu". 0day exploit never been released. This exploit will re-write the file wp-config.php and add a shell to it eval$GET'HIDDEN'; you can replace this to anything you want in the exploit code just...

Cobbler Local File Inclusion Vulnerability

Cobbler versions 2.4.x through 2.6.x suffer from a local file inclusion vulnerability. Exploit Title: Local File Inclusion vulnerability in cobbler Exploit author: Dolev Farhi @f1nhack Date 07/05/2014 Vendor homepage: http://www.cobblerd.org Affected Software version: 2.4.x - 2.6.x Alerted vendor...

Mybb All Version Denial of Service Vulnerability

Mybb All Version Denial of Service Vulnerability !/usr/bin/perl @@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@...

Secure Voipswitch database download vulnerability

This bug used for hacking voip traffic , it can get all site information and sips. All Versions are affected . This is private exploit. You can buy it at https://0day.today...

Protection strategies for the Security Advisory 2963983 IE 0day

We’ve received a number of customer inquiries about the workaround steps documented in Security Advisory 2963983 published on Saturday evening. We hope this blog post answers those questions. Steps you can take to stay safe The security advisory lists several options customers can take to stay...