PerfexCRM 1.9.7 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: PerfexCRM 1.9.7 – Unrestricted php5 File upload Exploit Author: Ahmad Mahfouz Description: PerfexCRM 1.9.7 prone to unrestricted file upload that lead to system take over by misconfigured elfinder plugin Contact:...

PerfexCRM 1.9.7 - Arbitrary File Upload

Exploit Title: PerfexCRM 1.9.7 – Unrestricted php5 File upload Exploit Author: Ahmad Mahfouz Description: PerfexCRM 1.9.7 prone to unrestricted file upload that lead to system take over by misconfigured elfinder plugin Contact: http://twitter.com/eln1x Date: 12/01/2018 CVE: CVE-2017-17976 Version...

BuilderEngine 3.5.0 - Arbitrary File Upload and Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "BuilderEngine Arbitrary File Upload Vulnerability and execution", 'Description' = %q This module exploits a vulnerability found in BuilderEngine...

BuilderEngine Arbitrary File Upload / Execution Exploit

This Metasploit module exploits a vulnerability found in BuilderEngine 3.5.0 via elFinder 2.0. The jquery-file-upload plugin can be abused to upload a malicious file, which would result in arbitrary remote code execution under the context of the web server. This module requires Metasploit:...

Exponent CMS Cross-Site Scripting Vulnerability (CNVD-2017-06734)

Exponent CMS is a free, open source, modular PHP-based content management system CMS. The system supports direct editing in the page and provides user management, site configuration, content editing and other functions. A cross-site scripting vulnerability exists in the...

Code injection

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

Exponent CMS vulnerable before 2.4.1 Patch #5 due to an XSS flaw in elFinder (framework/modules/file/connector/elfinder.php). The issue affects Exponent CMS versions prior to 2.4.1 Patch #5; patch 2.4.1 Patch #5 fixes the vulnerability. The connected sources describe the vulnerability as a cross-...

CVE-2017-8085: Improper Neutralization of Input During Web Page Generation

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

Cross site scripting

Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting XSS attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the...

CVE-2015-8684

Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting XSS attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the...

CVE-2015-8684: Improper Neutralization of Input During Web Page Generation

Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting XSS attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the...

BuilderEngine 3.5.0 - Arbitrary File Upload

BuilderEngine 3.5.0 - Arbitrary File Upload...

BuilderEngine 3.5.0 - Arbitrary File Upload

...

BuilderEngine Arbitrary File Upload Vulnerability and execution

This module exploits a vulnerability found in BuilderEngine 3.5.0 via elFinder 2.0. The jquery-file-upload plugin can be abused to upload a malicious file, which would result in arbitrary remote code execution under the context of the web server. Module Options msf use...

TikiWiki 15.1 ELFinder Unauthenticated File Upload

Description A file upload vulnerability in Tiki Wiki --Part83012510490351498898101-- 3. Info Author: Mehmet Ince https://www.exploit-db.com/exploits/40091/...

TikiWiki elfinder file upload

Added: 07/14/2016 Background TikiWiki is a multi-purpose web content management system written in PHP. Problem The third-party elfinder component allows unauthenticated users to upload arbitrary files, which can then be executed using a simple HTTP request. Resolution Upgrade to TikiWiki 12.9,...

TikiWiki elfinder file upload

Added: 07/14/2016 Background TikiWiki is a multi-purpose web content management system written in PHP. Problem The third-party elfinder component allows unauthenticated users to upload arbitrary files, which can then be executed using a simple HTTP request. Resolution Upgrade to TikiWiki 12.9,...