WP Multiple Meta Box v1.0 - SQL Injection Vulnerability

Document Title: =============== WP Multiple Meta Box v1.0 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1818 Release Date: ============= 2016-04-07 Vulnerability Laboratory ID VL-ID: ==================================== 18...

VoHo Concept4E CMS v1.0 - SQL Injection Vulnerabilities

Document Title: =============== VoHo Concept4E CMS v1.0 - SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1816 Release Date: ============= 2016-04-06 Vulnerability Laboratory ID VL-ID: ==================================== 18...

Microsoft Internet Explorer - MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-

Exploit for windows platform in category dos / poc k 10 ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0bb14b64 6ad180b8 vrfcore!VerifierStopMessageEx+0x571 0bb14b88 67fec434 vrfcore!VerifierDisableVerifier+0x748 0bb14bdc 67fea3dc...

Microsoft Internet Explorer - MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-023)

k 10 ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0bb14b64 6ad180b8 vrfcore!VerifierStopMessageEx+0x571 0bb14b88 67fec434 vrfcore!VerifierDisableVerifier+0x748 0bb14bdc 67fea3dc verifier67fe0000!VerifierStopMessage+0x74 0bb14c40 67fe733d...

Xion Audio Player 1.5 (build 160) - '.mp3' Crash (PoC)

Exploit for windows platform in category dos / poc Exploit Title: Xion Audio Player new'legit.mp3'; whatever mp3 you got handy $mp3-titleset'A' x 5000; title/artist tags $mp3-artistset'A' x 5000; may vary although both seems to be needed $mp3-updatetags; $mp3-close; print " Completed.\n";...

Perli v2.6 iOS - Filter Bypass & Persistent Vulnerability

Document Title: =============== Perli v2.6 iOS - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1813 Release Date: ============= 2016-04-04 Vulnerability Laboratory ID VL-ID: ====================================...

Xion Audio Player 1.5 (build 160) - '.mp3' Crash (PoC)

Exploit Title: Xion Audio Player new'legit.mp3'; whatever mp3 you got handy $mp3-titleset'A' x 5000; title/artist tags $mp3-artistset'A' x 5000; may vary although both seems to be needed $mp3-updatetags; $mp3-close; print " Completed.\n";...

Adobe Flash - URLStream.readObject Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=611 There is a use-after-free in URLStream.readObject. If the object read is a registered class, the constructor will get invoked to create the object. If the constructor calls...

Adobe Flash - textfield.maxChars Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581 There is a use-after-free in the TextField.maxChars setter. If the maxChars the field is set to is an object with valueOf defined, the valueOf function can free the field's...

Adobe Flash - Color.setTransform Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451 If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows: var tf:TextField = this.createTextField"tf",1,1,1,4,4 var n = new Object; n.valueOf = function trace"here";...

Adobe Flash - textfield.maxChars Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581 There is a use-after-free in the TextField.maxChars setter. If the maxChars the field is set to is an object with valueOf defined, the valueOf function can free the field's parent object, which is then used. A minimal PoC is as...

Axil CMS 0.1 SQL Injection

Exploit Title : Axil CMS 0.1 Authentication bypass Exploit Author : Persian Hack Team Vendor Homepage : http://www.axilcreations.com/ Date: 2016/03/31 Version : 0.1 PoC: User And Pass : '=' 'or' Demo : http://www.mets.com.np/myadmin/ http://www.princeies.com/myadmin/...

Google Android 5.0.1 - Metaphor Stagefright (ASLR Bypass)

Google Android 5.0.1 - Metaphor Stagefright ASLR Bypass Source: https://github.com/NorthBit/Metaphor Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd. Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf Twitter:...

Tor: Use-after-free during XML transformations (MFSA-2016-27)

Hello, I'm not sure how to understand the rules regarding "Bonus over Base Bounty/Mozilla Bounty for code execution exploits". Are vulnerabilities affecting Firefox ESR 38.7 covered by this section? If yes, you may be interested by MFSA 2016-27 aka CVE-2016-1964:...

Android One - mt_wifi IOCTL_GET_STRUCT Privilege Escalation

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=678 The wireless driver for the Android One sprout devices has a bad copyfromuser in the handling for the wireless driver socket private read ioctl IOCTLGETSTRUCT with subcommand...

Android One - mt_wifi IOCTL_GET_STRUCT Privilege Escalation

Android One - mtwifi IOCTLGETSTRUCT Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=678 The wireless driver for the Android One sprout devices has a bad copyfromuser in the handling for the wireless driver socket private read ioctl IOCTLGETSTRUCT with...

SM Soft Tech CMS 1.0 SQL Injection

========================================================== + Title :- SM SOFT TECH CMS - SQL INJECTION + Date :- 24 - MAR - 2016 + Vendor Homepage :- http://www.smsofttech.net/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks :...

Adobe Flash - Uninitialized Stack Parameter Access in MovieClip.swapDepths UaF Fix

Adobe Flash - Uninitialized Stack Parameter Access in MovieClip.swapDepths UaF Fix Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=715 The ActionScript parameter conversion in the fix for issue 403 https://code.google.com/p/google-security-research/issues/detail?id=403 can...

Adobe Flash - Uninitialized Stack Parameter Access in MovieClip.swapDepths UaF Fix

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=715 The ActionScript parameter conversion in the fix for issue 403 https://code.google.com/p/google-security-research/issues/detail?id=403 can sometimes access a parameter on the native stack that is uninitialized. If: mc.swapDepth...

Adobe Flash - Uninitialized Stack Parameter Access in AsBroadcaster.broadcastMessage UaF Fix

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=717 The ActionScript parameter conversion in the fix for an issue in the December Flash bulletin https://helpx.adobe.com/security/products/flash-player/apsb15-32.html, most likely...