Crime24 Stealer Panel 1.0 - Multiple Vulnerabilities

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= | \ | | | \ | | | |/ | / | | | | |/ / \ | | | |/ | ' \ | || | | | \ \ || | Twitter @TheHackersBay Pentester / Underground hacker Exploit Title: Crime24 Stealer Panel &in=1&search=Search Example: http://i.imgur.com/zyIr5xv.png...

Mail.ru: Admin panel of http://tp-test1.corp.mail.ru/ is acccessible publicly

http://tp-test1.corp.mail.ru/ link has various operations which should not be accessible to an anonymous user. As admin panel is accessible an attacker can use this information in targeted attack and he can bruteforce the username and password. on the other side server information is easily...

Atlassian JIRA < 6.0.5 Multiple Vulnerabilities

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is prior to version 6.0.5. It is, therefore, potentially affected by multiple vulnerabilities : - A cross-site scripting vulnerability exists in the Admin Panel due to a failure to sanitiz...

CVE-2013-3728

Cross-site scripting XSS vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an adminnewcategory action to admin.php...

Piwigo 2.6.1 - Cross-Site Request Forgery

Exploit Title: piwigo 2.6.1 - CSRF Date: 26/02/2014 Exploit Author: [email protected] Vendor Homepage: http://it.piwigo.org/ Software Link: http://it.piwigo.org/basics/downloads Version: 2.6.1 Tested on: Virtualbox debian A CSRF problem is present in the administration panel. Here it is a POF...

ThinkSAAS 设计缺陷导致严重漏洞

简要描述： ThinkSAAS 设计缺陷导致严重漏洞 详细说明： ThinkSAAS 的管理后台是system目录。 但是在每一个功能的目录下有一个amdin目录，这下面的功能和system管理后台功能一样。 如\app\article\action\admin\post.php findAll'article',null,'addtime desc',null,$lstart.',20'; $articleNum = $new'article'-findCount'article'; $pageUrl = pagination$articleNum, 20, $page, $url;...

程氏舞曲CMS储存型xss可跨管理员

简要描述： .... 详细说明： 还是那个获取ip的函数，既然可以伪造ip那么坑定可以插入js了。 function GetIP if getenv"HTTPCLIENTIP" && strcasecmpgetenv"HTTPCLIENTIP", "unknown" $ip = getenv"HTTPCLIENTIP"; else if getenv"HTTPXFORWARDEDFOR" && strcasecmpgetenv"HTTPXFORWARDEDFOR", "unknown" $ip = getenv"HTTPXFORWARDEDFOR"; else if...

D-link router CSRF exploit detailed explanation-vulnerability warning-the black bar safety net

A, introduction The purpose of this article is to demonstrate a CSRF vulnerability in D-link DIR-6 0 0 router-hardware version: BX firmware version: 2.16-CSRF vulnerability, for example. D-link CSRF vulnerability is already disclosed herein will be described in detail at the entire D-link CSRF...

TopicsViewer 3.0 Beta 1 - Multiple Vulnerabilities

TopicsViewer v3.0 Beta 1 - Multiple Sql Injection Vulnerabilty =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.topicsviewer.com/...

LinPHA 1.3.4 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: linPHA 1.3.4 - Pemanent XSS and CSRF Date: 28/01/2014 Exploit Author: [email protected] Vendor Homepage: http://sourceforge.net/projects/linpha/ Software Link: http://sourceforge.net/projects/linpha/files/latest/download Version: 1.3.4 Tested on: Virtualbox debian and Apache ===...

Built2Go PHP Shopping跨站请求伪造漏洞

No description provided by source. Built2Go PHP Shopping v 1.x – CSRF Vulnerabilityadd admin ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script...

EZGenerator跨站请求伪造漏洞

EZGenerator是一个网站建设和内容管理系统。 The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. create an administrative account when a logged-in administrative user visits a specially crafted web...

EZGenerator Cross Site Request Forgery / File Disclosure

EZGenerator – Local File Disclosure/Admin Data/CSRF Vulnerability ================================================================= .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Dork : inurl:”utils.php?action=...

Built2Go PHP Shopping 1.x Cross Site Request Forgery

Built2Go PHP Shopping v 1.x – CSRF Vulnerabilityadd admin ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.built2go.com/ .:. Dor...

PrisonLocker Ransomware Emerges From Criminal Underground

Security researchers from Malware Must Die uncovered new ransomware called PrisonLocker, and said the malware author is either a legitimate security researcher or is posing as one via a personal blog and Twitter handle. Malware Must Die has monitored PrisonLocker’s development since spotting it f...

WEBCrafted Cross Site Scripting

WEBCrafted Exploit Exploit By G4eL Exploit Title: WEBCrafted - Persistent XSS Google Dork: inurl:"/templates/webcrafted/" Date: 04/01/2014 Exploit Author: G4eL Software Link: http://www.bukkit.fr/index.php?/files/file/24-webcrafted-le-cms-minecraft/ Persistent XSS in users accounts Users...

Hacking Wireless DSL routers via Administrative password Reset Vulnerability

If you want to hack a Netgear and Linkys Wireless Routers, there is a quick backdoor entry available, that allow an attacker to reset the admin panel password to defaults. Eloi Vanderbeken, a hacker and reverse-engineer from France has discovered an administration password Reset vulnerability in...

eFront 3.6.14 Cross Site Scripting Vulnerability

eFront version 3.6.14 build 18012 suffers from multiple stored cross site scripting vulnerabilities. EDB Note: Screenshot provided by exploit author. Exploit Title: eFront v3.6.14 build 18012 -Stored XSS in multiple Parameters Author: sajith version: eFront v3.6.14- build 18012 Vendor Homepage:...

Ovidentia 7.9.6 - Multiple Vulnerabilities

Exploit Title: Ovidentia 7.9.6 Multiple Vulnerabilities Author: sajith version: Ovidentia 7.9.6 Vendor Homepage: http://www.ovidentia.org/ vulnerable app link:http://www.ovidentia.org/telecharger 1SQL injection vulnerability Log into admin panel and access delegate functionality managing...

ImpressPages CMS 3.8 - Stored XSS Vulnerability

Exploit for php platform in category web applications steps: 1 log into the admin panel http://127.0.0.1/cms/ImpressPages/?cmsaction=manage 2click on advanced tab in the button title field enter the payload " request: POST /cms/ImpressPages/?cmsaction=manage HTTP/1.1 Host: 127.0.0.1 User-Agent:...