268 matches found
CVE-2020-11942: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections...
Open-AudIT Professional 3.3.1 Remote Code Execution
Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution Date: 2020-04-22 Exploit Author: Askar CVE: CVE-2020-12078 Vendor Homepage: https://opmantek.com/ Version: v3.3.1 Tested on: Ubuntu 18.04 / PHP 7.2.24 !/usr/bin/python3 import requests import sys import warnings import random...
PT-2020-12939
Name of the Vulnerable Software and Affected Versions Open-AudIT version 3.2.2 Description An issue was discovered that allows for Arbitrary file upload. Recommendations For Open-AudIT version 3.2.2, consider restricting access to file upload functionality until a patch is available. As a tempora...
PT-2020-12938
Name of the Vulnerable Software and Affected Versions Open-AudIT version 3.2.2 Description An issue was discovered in the software, which involves multiple SQL injections. Recommendations For Open-AudIT version 3.2.2, update to a version that fixes the SQL injection issue. At the moment, there is...
Open-AudIT Professional 3.3.1 - Remote Code Execution
Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution Date: 2020-04-22 Exploit Author: Askar CVE: CVE-2020-8813 Vendor Homepage: https://opmantek.com/ Version: v3.3.1 Tested on: Ubuntu 18.04 / PHP 7.2.24 !/usr/bin/python3 import requests import sys import warnings import random...
CVE-2020-11943: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload...
Opmantek Open-AudIT Cross-Site Scripting Vulnerability
Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek USA. The program intelligently scans networks and network devices and provides status reports. A cross-site scripting vulnerability exists in Opmantek Open-AudIT version 3.3.0. The vulnerability stems from...
Opmantek Open-AudIT Injection Vulnerability
Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek USA. The program intelligently scans networks and network devices and provides status reports. Opmantek Open-AudIT suffers from an injection vulnerability. An attacker can exploit this vulnerability to inje...
CVE-2020-12261
Open-AudIT 3.3.0 allows an XSS attack after login...
CVE-2020-12261
Open-AudIT 3.3.0 allows an XSS attack after login...
Design/Logic Flaw
Open-AudIT 3.3.0 allows an XSS attack after login...
CVE-2020-12261
Open-AudIT 3.3.0 allows an XSS attack after login...
CVE-2020-12261
Open-AudIT 3.3.0 allows an XSS attack after login...
CVE-2020-12261
Open-AudIT 3.3.0 is affected by a reflected/authenticated cross-site scripting vulnerability (CVE-2020-12261). The issue arises in the web interface after login, where crafted input (e.g., payloads placed in the search path) can execute client-side scripts. Public references include Exploit-DB an...
CVE-2020-12078
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...
CVE-2020-12078
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...
Design/Logic Flaw
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...
Exploit for OS Command Injection in Opmantek Open-Audit
CVE-2020-12078 The offi...
CVE-2020-12078
CVE-2020-12078 - Open-AudIT 3.3.1 : A shell metacharacter injection flaw exists in the open-audit/configuration/ URI. The exclude_ip value from global discovery settings is passed to an unfiltered exec in discoveries_helper.php (inside all_ip_list), allowing a payload to execute commands. Connect...
CVE-2020-12078
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...