Virtual Freer Authentication Bypass

Title : Virtual Freer 1.57 - Authentication Bypass Tested : CentOS / php Vendor Homepage: http://freer.ir Author : Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes , reza.esparghamatgmaildotcom Website : www.reza.es Twitter : https://twitter.com/rezesp...

Microsoft Office 2007 msxml5.dll Crash Proof Of Concept

!/usr/bin/perl -w Title : Microsoft Office 2007 msxml5.dll - Crash Proof Of Concept Tested : Microsoft Office 2007 / Win7 DLL : msxml5.dll 5.20.1072.0 WINWORD.EXE version : 12.0.6612.1000 Author : Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes ,...

Microsoft Office 2007 - msxml5.dll Crash PoC

Exploit for windows platform in category dos / poc !/usr/bin/perl -w Title : Microsoft Office 2007 msxml5.dll - Crash Proof Of Concept Tested : Microsoft Office 2007 / Win7 DLL : msxml5.dll 5.20.1072.0 WINWORD.EXE version : 12.0.6612.1000 Author : Mohammad Reza Espargham Linkedin :...

AN IT CMS - SQL Injection Vulnerability

========================================================== + Title :- WAN IT CMS - SQL Injection Vulnerability + Date :- 23 - July - 2015 + Vendor Homepage :- http://www.wanitltd.com/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google...

Vifi Radio 1 Cross Site Request Forgery

. | | / | | \ \ | | \ / | |\ / / /\ \ / \ | Y / ^ / / || / / / / /\ /\ \ \ \ | / \ / http://h4x0resec.blogspot.com / \ | \ \ / // / \ / / / / Vifi Radio v1 - CSRF Arbitrary Change Password Exploit My + Discovered by: KnocKout Contact : [email protected] HomePage :...

Vifi Radio 1.0 - Cross-Site Request Forgery

. | | / | | \ \ | | \ / | |\ / / /\ \ / \ | Y / ^ / / || / / / / /\ /\ \ \ \ | / \ / http://h4x0resec.blogspot.com / \ | \ \ / // / \ / / / / Vifi Radio v1 - CSRF Arbitrary Change Password Exploit My + Discovered by: KnocKout Contact : [email protected] HomePage :...

Microsoft Windows HTA (HTML Application) - Remote Code Execution Exploit

Microsoft Windows HTA HTML Application remote code execution exploit that leverages MS14-064. !/usr/bin/php poc'."\n\n"; $reza = socketcreateAFINET, SOCKSTREAM, 0 or die'Failed to create socket!'; socketbind$reza, 0,$port; socketlisten$...

UBNT Bug Bounty #3 - Persistent Filename Vulnerability

Document Title: =============== UBNT Bug Bounty 3 - Persistent Filename Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1468 View Video: https://www.youtube.com/watch?v=JeEWyV9VMpE Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1467 Release...

MSCorp CMS - SQL Injection Vulnerability

Exploit for php platform in category web applications ========================================================= + Title :- MSCorp CMS - SQL Injection Vulnerability + Date :- 7 - Aug - 2015 + Vendor Homepage :- http://www.mscorp.co.in/ + Version :- All Versions + Tested on :- Nginx/1.4.5,...

Heroes of Might and Magic III - '.h3m' Map file Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'zlib' class Metasploit3 'Heroes of Might and Magic III .h3m Map file Buffer Overflow', 'Description' = %q This module embeds an exploit into a...

kppw最新版任意用户登录

简要描述： 只需要用户名和用户id即可实现任意用户登录 详细说明： 问题出在 lib/inc/kekecoreclass.php function inituser 第981行 elseif $COOKIE 'kekeautologin' $loginInfo = unserialize $COOKIE 'kekeautologin' ; $pwdInfo = explode '|', base64decode $loginInfo 2 ; $uInfo = kekezu::gettabledata '', 'witkeyspace', " username='$pwdInfo2' an...

WordPress Altos Connect Widget Plugin <= 1.3.0 - Cross Site Scripting (XSS)

This plugin is prone to a cross site scripting vulnerability, because "PHPSELF" is printed without sanitization in a captcha demo page. Solution Update the plugin...

骑士CMS最新版任意用户登陆

简要描述： 骑士CMS最新版任意用户登陆（官网demo测试）。 详细说明： 骑士CMS最新版去掉了全局addslash include/common.inc.php @@ -17,20 +17,10 @@ sessionsavepathQISHIROOTPATH.'data/sessions/'; sessionstart;\r requireonceQISHIROOTPATH.'data/config.php';\r header"Content-Type:text/html;charset=".QISHICHARSET;\r...

大米CMS存在0元购物逻辑漏洞（demo演示）

简要描述： 大米CMS存在0元购物逻辑漏洞,当然要注册会员咯。但是可以0元购物 详细说明： 漏洞文件:Web/Lib/Action/MemberAction.class.php //413行 if!isnumeric$POST'id'$i || !isnumeric$POST'price'$i || !isnumeric$POST'qty'$icontinue; $data'gid' = $POST'id'$i; //这里把传入的商品id传给了 $data'gid' $data'uid' = $SESSION'damiuid'; $data'price' =...

WideImage Cross-Site Scripting Vulnerability

WideImage is an open source for image processing object-oriented PHP library . A cross-site scripting vulnerability exists in WideImage 11.02.19, which allows remote attackers to inject arbitrary web script or HTML via the matrix parameter of demo/indexphp...

Audio Gallery Suite Local File Disclosure

Exploit Title: Audio-Gallery-Suite Local File Disclosure Vulnerability + Google Dork: inurl:/downloadengine.php?file= + Date: July/04/2015 + Exploit Author: IranianDarkCodersTeam + Vendor Homepage: http://robinrizvi.info + Software Link: https://github.com/robinrizvi/Audio-Gallery-Suite +...

逐浪CMS2.4分分钟GetShell影响尚未发布的2.5Beta版

简要描述： Zoomla!逐浪CMS软件由上海逐一软件科技有限公司、江西逐浪软件科技有限公司联袂打造，其旗下华夏互联hx008.com开发团队，是华中排名第一的IDC服务商，拥有近十年的网站开发服务经验，一直以来致力于高端的WEB开发，也是国内领先的TOP外包合作商。 作为国产CMS的领先企业和国内首家推出的基于微软公司.NET平台的高端网站内核内容管理系统，Zoomla!逐浪CMS具备八大模块、近百项功能，深得业界好评。 在.NET平台开发的CMS行业，Zoomla!逐浪CMS与四川风讯CMS、北京百榕科技、佛山动易软件等公司，引领国产CMS行业的潮流，已成为业界事实标准。...

WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities

WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion Date: 2015-06-23 Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" Exploit Author:...

方维O2O商业系统SQL注入漏洞+XXE实体注入（demo验证）

简要描述： RT 详细说明： 方维O2O，demo站点地址：http://o2odemo.fanwe.net/ /cpapi/qxtapi.php define"FILEPATH","/cpapi"; requireonce '../system/systeminit.php'; $ip = CLIENTIP; $xml = filegetcontents'php://input'; if$ip!='221.179.180.156' || $xml=="" header"Content-Type:text/html; charset=utf-8"; echo "·Ç·¨·ÃÎÊ";...

Why Web Developments SQL Injection

========================================================= + Title :- Why Web Developments CMS - SQL Injection Vulnerability + Date :- 19 - June - 2015 + Vendor Homepage: :- http://www.whyweb.co.za/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :-...