Bash Profile Persistence

This module writes an execution trigger to the target's Bash profile. The execution trigger executes a call back payload whenever the target user opens a Bash terminal. A handler is not run automatically, so you must configure an appropriate exploit/multi/handler to receive the callback. This...

Design/Logic Flaw

An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to ha...

CVE-2019-19020

An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to ha...

CVE-2019-19020

CVE-2019-19020 affects TitanHQ WebTitan up to version 5.17. An attacker with a valid WebTitan web interface account can upload a crafted backup file that allows arbitrary code execution by overwriting existing files or adding new PHP files under the web root. This results in remote code execution...

Hardcoded credentials

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords except the...

CVE-2019-6693

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords except the...

CVE-2019-6693

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords except the...

Xiaomi Mi WiFi R3G Command Injection Vulnerability

The Xiaomi Mi WiFi R3G is a 3G router from the Chinese company Xiaomi Technology. A security vulnerability exists in the Xiaomi Mi WiFi R3G backup file upload handling, which allows remote attackers to exploit the vulnerability to submit a special request that can execute arbitrary OS commands...

TerraMaster F2-210 Information Disclosure Vulnerability (CNVD-2019-38804)

The Terramaster F2-210 is an entry-level two-drive NAS. An information disclosure vulnerability exists in the TerraMaster F2-210. An attacker can exploit this vulnerability to download backup files from terramasterTNAS-00E43Aconfigbackup.bin without permission...

CVE-2019-18383

An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramasterTNAS-00E43Aconfigbackup.bin without permission...

CVE-2019-18370

An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar zxf command to decompress, so one can control the contents of the files in the decompressed directory. In addition, the application's sh...

CVE-2019-18370

The Xiaomi Mi WiFi R3G vulnerability (CVE-2019-18370) affects versions prior to 2.28.23-stable. The backup file (tar.gz) can be manipulated during upload, allowing control of contents in the decompressed directory via tar zxf. Additionally, the sh script used for testing speeds reads URLs from /t...

Prima Systems FlexAir

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Prima Systems Equipment: FlexAir Vulnerabilities : OS Command Injection, Unrestricted Upload of File with Dangerous Type, Cross-site Request Forgery, Small Space of Random Values, Cross-site...

ChurchCRM Software 3.3.2 Database Disclosure

Exploit Title : ChurchCRM Software 3.3.2 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 20/04/2019 Vendor Homepage : churchcrm.io Software Download Link : github.com/ChurchCRM/CRM/releases/download/3.3.2/ChurchCRM-3.3.2.zip Software...

OpenDocMan Document Management System 1.3.5 Database Disclosure

Exploit Title : OpenDocMan Document Management System 1.3.5 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 20/04/2019 Vendor Homepage : opendocman.com Software Download Link : opendocman.com/free-download/...

YiiCMS JetBrains PHPStorm 6.0.3 Database Disclosure

Exploit Title : YiiCMS JetBrains PHPStorm 6.0.3 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 10/04/2019 Vendor Homepage : jetbrains.com - yiiframework.com Software Download Link : github.com/johannesMatevosyan/yii-cms/archive/master.zip...

NekoCMS 2.5 Database Disclosure

Exploit Title : NekoCMS 2.5 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 10/04/2019 Vendor Homepage : osdn.net nekocms.osdn.jp Software Download Link : github.com/novhex/NekoCMS-v2.5/archive/master.zip Software Information Link :...

Joomla FPSS Art Frontpage Slideshow 1.6.0 Database Disclose / SQL Injection

Exploit Title : Joomla FPSS Art Frontpage Slideshow Components 1.6.0 Database Disclosure / Open Redirection / SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 19/01/2019 Vendor Homepage : artetics.com Software Information Link :...

Joomla ZHYandexMap 8.0.0.2 Database Disclosure

Exploit Title : Joomla ZHYandexMap Components 8.0.0.2 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 18/01/2019 Vendor Homepage : joomla.org Software Information Link : extensions.joomla.org/extension/zh-yandexmap/ Software Download Link :...

Wordpress CherryFramework Theme Backup File Download Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A backup file download vulnerability exists in Wordpress CherryFramework Theme. An attacker can exploit the vulnerability to...