LuxCal 3.2.2 Cross Site Request Forgery / SQL Injection

Author: TUNISIAN CYBER + Exploit Title: LuxCal v3.2.2 CSRF/Blind SQL Injection Vulnerabilities + Date: 09-03-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-352/CWE-89 + Vendor: http://www.luxsoft.eu/ + Friendly Sites: na3il.com,th3-creative.com + Twitter: @TCYB3R...

LuxCal v3.2.2 CSRF/Blind SQL Injection Vulnerabilities

LuxCal v3.2.2 suffers from a CSRF and Blind SQL Injection Vulnerabilities. + Author: TUNISIAN CYBER + Exploit Title: LuxCal v3.2.2 CSRF/Blind SQL Injection Vulnerabilities + Date: 09-03-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-352/CWE-89 + Vendor:...

Eventy Plus Cross Site Request Forgery

Author: TUNISIAN CYBER + Exploit Title: Eventy Plus Cross-Site Request Forgery Add Admin Vulnerability + Date: 03-03-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-352 + Vendor: http://calendarscripts.info/ + Friendly Sites: na3il.com,th3-creative.com + Twitter: @TCYB3R...

dreamMail e-mail client 4.6.9.2 - Persistent Cross-Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: dreamMail e-mail client Version: 4.6.9.2 Vendor Site: http://www.dreammail.eu Software Download: http://www.dreammail.eu/intl/en/download.html Tested on: Windows XP SP3 Eng. Tested on: Windows 7 Pro SP1 Eng. dreamMail: Using...

NCMedia Sound Editor Pro 7.5.1 - Local Overflow (SEH + DEP Bypass)

!/usr/bin/python --------------------------------------------------------------------------- Exploit: NCMedia Sound Editor Pro v7.5.1 SEH&DEP Author: b33f - http://www.fuzzysecurity.com/ OS: Windows 7 Pro SP1 probably universal across 32-bit POC - Julien Ahrens XP SP3:...

OTRS Open Technology Real Services 3.1.8/3.1.9 - Cross-Site Scripting

!/usr/bin/python ''' Author: Mike Eduard - Znuny - Enterprise Services for OTRS Product: OTRS Open Technology Real Services Version: 3.1.8 and 3.1.9 Vendor Homepage: http://otrs.org CVE: 2012-4600 Timeline: 22 Aug 2012: Vulnerability reported to vendor and CERT 23 Aug 2012: Response received from...

T-dah Webmail Client 3.2.0-2.3 - Persistent Cross-Site Scripting

T-dah Webmail Client 3.2.0-2.3 - Persistent Cross-Site Scripting !/usr/bin/python ''' Author: loneferret of Offensive Security Product: T-dah Webmail Client Version: 3.2.0-2.3 Vendor Site: http://t-dahmail.sourceforge.net/index.php Software Download: http://sourceforge.net/projects/t-dahmail/...

EmailArchitect Enterprise Email Server 10.0 Stored XSS

Exploit for php platform in category web applications !/usr/bin/python ''' Author: loneferret of Offensive Security Product: EmailArchitect Enterprise Email Server Version: 10.0 Vendor Site: http://www.emailarchitect.net Software Download Link:...

Surgemail 6.0a4 - Persistent Cross-Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: SurgeMail Version: 6.0a4 Vendor Site: http://www.netwinsite.com Software Download: http://netwinsite.com/download.htm Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response received from CERT with disclosu...

Windows Explorer Denial Of Service

Exploit for windows platform in category dos / poc Windows 2008 SP2 RC2 Explorer Go Byebye :P Windows 7 Pro SP1 Explorer Go Byebye :P Interesting Brought to you by Level & z0r0 @ Smash The Stack from win32com.shell import shell, shellcon from os import mkdir try: mkdir"c:\triggeralt" except: prin...

MOAB-01-01-2007: Apple Quicktime rtsp URL Handler Stack-based Buffer Overflow

Summary The following description of the software is provided by vendor Apple: QuickTime 7 makes the future of video crystal clear with new features including user-friendly controls and pristine H.264 video. Upgrade to QuickTime 7 Pro and capture your own movies, then share them with friends and...