OpenFiler 2.x - NetworkCard Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Openfiler v2.x...

OpenFiler 2.3 - Multiple Cross-Site Scripting Information Disclosure Vulnerabilities

OpenFiler 2.3 - Multiple Cross-Site Scripting Information Disclosure Vulnerabilities source: https://www.securityfocus.com/bid/55500/info Openfiler is prone to multiple cross-site scripting and information disclosure vulnerabilities. An attacker may leverage these issues to obtain potentially...

OpenFiler 2.3 - Multiple Cross-Site Scripting / Information Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/55500/info Openfiler is prone to multiple cross-site scripting and information disclosure vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an...

Openfiler v2.x NetworkCard Command Execution

This module exploits a vulnerability in Openfiler v2.x which could be abused to allow authenticated users to execute arbitrary code under the context of the 'openfiler' user. The 'system.html' file uses user controlled data from the 'device' parameter to create a new 'NetworkCard' object. The cla...

Openfiler Management Interface Default Administrator Credentials

The remote Openfiler install uses a default set of credentials 'openfiler' / 'password' to control access to its management interface. With this information, an attacker can gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Openfiler Management Interface Detection

The remote web server hosts the management interface for Openfiler, a network storage operating system. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid51459; scriptversion"1.7"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"Openfiler Management Interface...

OpenFiler - device Cross-Site Scripting

OpenFiler - device Cross-Site Scripting source: https://www.securityfocus.com/bid/45523/info Openfiler is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser...

OpenFiler - 'device' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45523/info Openfiler is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context ...

Openfiler Cross Site Scripting

Good morning again! -- openfiler xss: https://192.168.0.2:446/admin/system.html?step=2&device=et%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3Ebh0...

Openfiler redirect参数跨站脚本执行漏洞

BUGTRAQ ID: 33778 Openfiler是一款开源的网络存储解决方案。 Openfiler的index.html没有正确地过滤redirect参数输入便返回给了用户，这允许远程攻击者通过向服务器提交恶意请求执行跨站脚本攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。 Openfiler 2.3 厂商补丁： Openfiler --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.openfiler.com/...

Openfiler 2.3 (Auth Bypass) Remote Password Change Exploit

No description provided by source. Exploit code PoC for OpenFiler 2.3 current by just a nonroot user http://nonroot.blogspot.com/ import urllib,sys,re host example: https://192.168.20.5:446/ host=rawinput"OpenFiler system include http and /: " Super admin user user='openfiler' What pass do you...

Openfiler 2.3 Password Change

Exploit code PoC for OpenFiler 2.3 current by just a nonroot user http://nonroot.blogspot.com/ import urllib,sys,re host example: https://192.168.20.5:446/ host=rawinput"OpenFiler system include http and /: " Super admin user user='openfiler' What pass do you want? password='nonroot' use it pleas...

OpenFiler 2.3 - (Authentication Bypass) Remote Password Change

Exploit code PoC for OpenFiler 2.3 current by just a nonroot user http://nonroot.blogspot.com/ import urllib,sys,re host example: https://192.168.20.5:446/ host=rawinput"OpenFiler system include http and /: " Super admin user user='openfiler' What pass do you want? password='nonroot' use it pleas...

OpenFiler 2.3 - (Authentication Bypass) Remote Password Change

OpenFiler 2.3 - Authentication Bypass Remote Password Change Exploit code PoC for OpenFiler 2.3 current by just a nonroot user http://nonroot.blogspot.com/ import urllib,sys,re host example: https://192.168.20.5:446/ host=rawinput"OpenFiler system include http and /: " Super admin user...

Openfiler 2.3 (Auth Bypass) Remote Password Change Exploit

Exploit for unknown platform in category web applications ========================================================== Openfiler 2.3 Auth Bypass Remote Password Change Exploit ========================================================== Exploit code PoC for OpenFiler 2.3 current by just a nonroot use...