MS-MSDT-Office-RCE-Follina

MS-MSDT-Office-RCE-Follina CVE-2022-30190 | MS-MSDT Follina 一键利用 1. 创建一个 Docx 文件。 2. 在 Docx 文件中，点击“插入” “对象” “位图图像” “确定”。 3. 在启动的画图应用程序中，保存画图文件。 4. 保存你的 Docx 文件。 5. 以归档形式打开你的文件（使用 7Zip；右键点击 7Zip 打开归档）。 6. 从 \Word\ 中复制出 Document.xml，并从 \wordrels\ 中复制出 document.xml.rels 文件。 7. 打开/编辑...

CVE-2026-90496

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

CVE-2026-90497

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

CVE-2026-90497 Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

CVE-2026-90497

Fengoffice Feng Office versions up to 3.11.13.11 are affected by a cross-site scripting (XSS) vulnerability in the getTitle function of the file application/views/task/add_task.php (component: Task Title Output). Manipulating the og_objects.name argument allows a remote attacker to inject script ...

EUVD-2026-76950

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

EUVD-2026-76949

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

CVE-2026-90496

A SQL injection vulnerability exists in Fengoffice Feng Office versions up to 3.11.13.11 , affecting the update_system_module_order/update_dimension_order functions in the file application/controllers/MoreController.class.php (component: Reorder Handlers ). An authenticated attacker (high privile...

CVE-2026-90495

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

CVE-2026-90495

Fengoffice Feng Office versions up to 3.11.13.11 contain a SQL injection vulnerability in the Legacy API component, specifically in the function Contacts::instance->findAll within the file application/models/CompanyWebsite.class.php. Manipulation of the auth argument allows a remote, unauthent...

EUVD-2026-76942

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

CVE-2026-90495 Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

CVE-2021-40444

CVE-2021-40444 PoC Generador de docx malicioso para explotar CVE-2021-40444 Ejecución remota de código en Microsoft Office Word La creación de este script se basa en ingeniería inversa sobre la muestra utilizada in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 archivo...

CVE-2017-11882

CVE-2017-11882 43b 原脚本来自于 https://github.com/embedi/CVE-2017-11882 109b 原脚本来自于 https://github.com/unamer/CVE-2017-11882/ （膜一波，现在unamer的代码已经可以执行shellcode了） CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-118...

CVE-2018-8174-msf

CVE-2018-8174-msf Este es un módulo de Metasploit que crea un documento malicioso de Word para explotar CVE-2018-8174 - vulnerabilidad de corrupción de memoria en VBScript. Este módulo es un puerto muy rápido y utiliza la muestra de exploit que se encontró en la naturaleza. El exploit funciona so...

CVE-2021-40444

完全武器化的 CVE-2021-40444 用于利用 CVE-2021-40444（Microsoft Office Word 远程代码执行）的恶意 docx 生成器，可配合任意 DLL 文件使用。 背景 尽管互联网上已经有很多 PoC，我还是想亲自尝试武器化这个漏洞，因为我发现现有的资料缺少值得分享的有价值信息，而且微软已经为此漏洞发布了补丁。 到目前为止，我见过的能够创建完全可用的生成器的有价值资源只有： Ret2Pwn 的博客 j00sean 的推文 上述资源概述了构建完整利用链所需的许多要求。为避免重复太多不必要的信息，我只总结相关细节。 利用链 1. 打开 Docx 2...

CVE-2023-36884_patcher

CVE-2023-36884patcher CVE-2023-36884影响office 2016、2019、2021 版本，这是它的临时补丁，下载后右键使用管理员权限运行即可。...

CVE-2017-11882

CVE-2017-11882 原脚本来自于 https://github.com/embedi/CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Research:...

LetsDefend-SOC173-Follina-0-Day-Detected

LetsDefend-SOC173-Follina-0-Day-Detected 我们收到一个安全告警，提示检测到 Follina（CVE-2022-30190）漏洞。一个恶意 Word 文档触发了 msdt.exe 的执行，表明主机 JonasPRD 可能已被远程代码执行。我们的任务是调查此告警，确认漏洞利用情况，评估影响，并提出修复建议。 案例详情 2022 年 6 月 2 日 15:22，触发了一条安全告警，来源为 SOC173 – Follina 0-Day 检测 SIEM 规则 。该告警涉及名为 'JonasPRD' 的端点，IP 地址为...

CVE-2018-8174-msf

CVE-2018-8174-msf 这是一个 Metasploit 模块，用于创建恶意的 Word 文档以利用 CVE-2018-8174（VBScript 内存破坏漏洞）。 该模块是一个快速移植版本，使用了在野外发现的漏洞利用样本。该漏洞利用仅适用于 Microsoft Office 32 位版本。 此模块还有很多需要改进的地方，但如果有时间我会在将来进行更新。 安装 1. 将 CVE-2018-8174.rb 复制到 /usr/share/metasploit-framework/modules/exploits/windows/fileformat/ 2. 将...