Aviosoft Digital TV Player Professional 1.x (Direct Retn)

Exploit for windows platform in category local exploits Exploit Title: Aviosoft Digital TV Player Professional 1.x Direct Retn Date: 11-25-2012 Exploit Author: Nezim @nezimlufni Vendor Homepage: http://www.aviosoft.com/ Version: Aviosoft Digital TV Player Professional 1.x Tested on: Windows XP SP...

TaoCms SQL injection 0day-vulnerability warning-the black bar safety net

Two Double figure: ! !...

PHPMyWind v4. 5. 2 global variable overwrite 0day-vulnerability warning-the black bar safety net

Code: define‘PHPMYWINDINC’, pregreplace“//\\\\1,/”, ‘/’, dirnameFILE; define‘PHPMYWINDROOT’, pregreplace“//\\\\1,/”, ‘/’, substrPHPMYWINDINC, 0, -8; define‘PHPMYWINDDATA’, PHPMYWINDROOT.’/ data’; define‘PHPMYWINDUPLOAD’, PHPMYWINDROOT.’/ uploads’; define‘PHPMYWINDBACKUP’, PHPMYWINDDATA.’/...

Trend Micro tmactmon.sys DOS vulnerability analysis(0day)-vulnerability warning-the black bar safety net

When tmactmon. sys received ioctlcode=0x9100444f the IRP, it will call the Dispatch function for processing, as shown below. . text:0 0 0 1 1 1 1 6 ; int stdcall BugDispatchint, PIRP Irp . text:0 0 0 1 1 1 1 6 BugDispatch proc near ; DATA XREF: sub11C4C+16D o . text:0 0 0 1 1 1 1 6 . text:0 0 0 1...

IDIC Blogs Shell Upload Vulnerability

IDIC Blogs suffers from a remote shell upload vulnerability. '/ -.- --------------------oOO------OOo---------------------- | IDIC Blogs Arbitrary File Upload Vulnerability | --------------------------------------------------------- ! Discovered: cr4wl3r ! Site: http://0xuht.org ! Download:...

HT Editor 2.0.20 - Local Buffer Overflow (ROP)

HT Editor 2.0.20 - Local Buffer Overflow ROP !/usr/bin/perl =head1 TITLE HT Editor 2.0.20 Buffer Overflow ROP PoC =head2 DESCRIPTION Since version 2.0.18, the stack overflow vulnerability has not been corrected, which I assume would make it 0day? I consequently recoded an exploit, as memory...

HT Editor 2.0.20 Buffer Overflow

!/usr/bin/perl =head1 TITLE HT Editor 2.0.20 Buffer Overflow ROP PoC =head2 DESCRIPTION Since version 2.0.18, the stack overflow vulnerability has not been corrected, which I assume would make it 0day? I consequently recoded an exploit, as memory addresses have changed. I chose to make it B, SSP...

HT Editor 2.0.20 Buffer Overflow (ROP PoC)

Exploit for linux platform in category dos / poc !/usr/bin/perl =head1 TITLE HT Editor 2.0.20 Buffer Overflow ROP PoC =head2 DESCRIPTION Since version 2.0.18, the stack overflow vulnerability has not been corrected, which I assume would make it 0day? I consequently recoded an exploit, as memory...

Smadav AntiVirus - Crash PoC

Exploit for windows platform in category dos / poc Exploit Title: Smadav AntiVirus - Crash PoC Date: 10/Nov/2012 Exploit Author: Mada R Perdhana email protected / Spentera Research Team Vendor Homepage: http://www.smadav.net & http://www.smadav.web.id Software Link: http://www.smadav.net/download...

Microsoft Office Excel 2013 memory corruption

memory corruption during the handling of the xls files a context-dependent attacker can execute arbitrary code. Title : Microsoft Office Excel 2013 memory corruption Version : Microsoft Office professional Plus 2013 Date : 2012-11-10 Vendor : http://office.microsoft.com Impact : Med/High Contact ...

Invision Power Board 3.3.4 Unserialize REGEX Bypass

?php / So this is the patch that sanitizes, static public function safeUnserialize $serialized // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if isstring $serialized && strpos $serialized, "\0" === false if strpos $serialized...

Xivo 1.2 Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Xivo 1.2 Arbitrary File Download under root privileges =============================================================== Date: 6/11/2012 Exploit Author: Mr.Un1k0d3r Vendor Homepage: https://wiki.xivo.fr Software Link:...

EmpireCMS 6.6 PHP Code Execution Vulnerability

EmpireCMS version 6.6 template parser suffers from a remote PHP code execution vulnerability. Exploit Title: EmpireCMS Template Parser Remote PHP Code Execution Vulnerability Date: 2012-11-1 Author: flyh4t Software Link: http://www.phome.net Version: EmpireCMS 6.6 CVE : EmpireCMS Template Parser...

OpenSSH 6.0p1 Backdoor Patch 1.2 Vulnerability 0day

This patch is for openssh-6.0p1 source which combines a known openssh backdoor and Sebastian Krahmer's openssh.reverse capabilities. Telnet to target openssh server and issue udcgamaimagic string for getting reverse openssh connection. $id: udc-hackssh-v3bajaulaut-v1, 2012/10/28 05:00:50 slash...

vBulletin ChangUonDyU Advanced Statistics SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: vBulletin ChangUonDyU Advanced Statistics - SQL Injection Vulnerability Google Dork: No Dork Date: 19/10/2012 Exploit Author: Junookyo Vendor Homepage: http://hoiquantinhoc.com Software Link:...

MyBB Follower User Plugin - SQL Injection

MyBB Follower User Plugin - SQL Injection Exploit Title: Follower User MyBB plugin SQL Injection 0day Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us Date: 13.10.2012 Exploit Author: Zixem Software Link: http://mods.mybb.com/view/suscriber-user Version: 1.5+ Tested on...

MyBB Follower User Plugin - SQL Injection

Exploit Title: Follower User MyBB plugin SQL Injection 0day Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us Date: 13.10.2012 Exploit Author: Zixem Software Link: http://mods.mybb.com/view/suscriber-user Version: 1.5+ Tested on: Linux...

A Recruitment System 0day a gold-bug warning-the black bar safety net

Google: the keywords: inurl:IndexPerson. asp inurl:headhunt ! Use steps: 1. Front Desk registered users 2. Upload photos ! 3. Capture 4. Modification packet nc truncated to submit ! If the directory can not write the situation, change the Upload Directory to...

VICOM STUDIO Local File Inclusion / SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 x Official Website: http://www.1337day.com 0 1 x...

ecshop csrf getshell 0day-vulnerability warning-the black bar safety net

0x0 background getshell In submitting an order the place to see the code to call the getmailtemplateget remindofneworder the contents of the template, and then placed into the fetch is performed, if you can control remindofneworder template of content that can make ecshop to perform our command...