foobar2000 1.3.8 - .m3u Local Crash (PoC)

foobar2000 1.3.8 - .m3u Local Crash PoC Exploit Title: foobar2000 1.3.8 .m3u Local Crash PoC Date: 12-06-2015 Exploit Author: 0neb1n Vendor Homepage: http://www.foobar2000.org/ Software Link: http://www.foobar2000.org/getfile/e246984718ab7ab58fa1e0b072ff05a4/foobar2000v1.3.8.exe Version: 1.3.8...

FC2 / Rakuten Cross Site Scripting

FC2 & Rakuten Online Websites Multiple XSS Cross-site Scripting and Open Redirect Cyber Vulnerabilities FC2 and Rakuten are the first and second top ranking Japanese local online websites. This post introduces several XSS Cross-site Scripting and Open Redirect bugs of them. The Alexa rank of...

FiverrScript CSRF Vulnerability (Add New Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: FiverrScript CSRF Vulnerability add New admin Author: Mahmoud Gamal @Zombiehelp54 Google Dork: intext:Powered by FiverrScript Date: 10/06/2015 Exploit Author: Scriptolution Vendor Homepage: http://scriptolution.com Software Link...

Bonita BPM 6.5.1 Directory Traversal / Open Redirect

Advisory ID: HTB23259 Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015 Vendor Patch: June 9, 2015 Public Disclosure:...

Libmimedir - '.VCF' Memory Corruption (PoC)

!/usr/bin/python libmimedir-free.py Libmimedir VCF Memory Corruption PoC CVE-2015-3205 Jeremy Brown jbrown3264/gmail June 2015 -Synopsis- Adding two NULL bytes to the end of a VCF file allows a user to manipulate free calls which occur during it's lexer's memory clean-up procedure. This could lea...

Easy2Map <= 1.24 - SQL Injection

The Function.php file uses sprintf to format queries being sent to the database, this doesn't provide proper sanitisation of user input or properly parameterises the query. PoC $ sqlmap -u 'http://www.example.com/wp-admin/admin-ajax.php' --data="mapID=11='+or+1%3D%3D1%3B=e2mimgsavemapname"...

Microsoft Internet Explorer 11 - Crash (PoC) (2)

function boom var divA = document.createElement"div"; document.body.appendChilddivA; try //divA.contentEditable = "true"; divA.outerHTML = "AAAA"; var context = divA'msGetInputContext'; catch exception...

Freebox OS Web interface 3.0.2 XSS, CSRF

Hello list, Here are two CVEs I reported to Freebox, a french ISP: - CVE-2014-9382 - CSRF in VPN user account creation - CVE-2014-9405 - XSS Vulnerable product: Freebox OS Web interface 3.0.2. CVE-2014-9382 - CSRF in Freebox OS Web interface 3.0.2 allowing VPN user account creation...

Easy2Map Photos <= 1.0.9 - SQL Injection

The code in Functions.php is vulnerable to SQL Injection because they are not parameterising or sanitising user input. PoC sqlmap -u 'http://www.example.com/wp-admin/admin-ajax.php' --data="mapID=11='+or+1%3D%3D1%3B=e2mimgsavemapname" --cookie=COOKIEHERE --level=5 --risk=3...

Microsoft Internet Explorer 11 - Crash (PoC) (2)

Microsoft Internet Explorer 11 - Crash PoC 2 function boom var divA = document.createElement"div"; document.body.appendChilddivA; try //divA.contentEditable = "true"; divA.outerHTML = "AAAA"; var context = divA'msGetInputContext'; catch exception...

Shopify: [www.*.myshopify.com] CRLF Injection

CRLF Injection via Request-URI PoC: http://www.myshopify.com/xxcrlftest%0aSet-Cookie:test=test3;domain=.myshopify.com; https://www.blackfan.myshopify.com/xxx%0aSet-Cookie:test=test2;domain=.myshopify.com; HTTP Response: HTTP/1.1 302 Moved Temporarily ... Location: http://myshopify.com/xxcrlftest...

1 Click Extract Audio 2.3.6 - Activex Buffer Overflow Exploit

Exploit for windows platform in category local exploits 1 Click Extract Audio Activex Buffer Overflow Affected version=2.3.6 Vendor Homepage:http://www.dvdvideotool.com/index.htm Software Link:www.dvdvideotool.com/1ClickExtractAudio.exe The vulnerability lies in the COM component used by the...

Technical analysis: local SWF files can be any local file leaked to the Internet-vulnerability warning-the black bar safety net

Flash file in design time it allows local swf files to read arbitrary local files. Flash Player version is not higher than 7, the local SWF files with other SWF file is interactive and can be accessed from any remote or local location of the loaded data. Principles In Flash Player 8 and later, SW...

Private Shell SSH Client 3.3 - Crash PoC

Exploit for windows platform in category dos / poc ''' Exploit title: privateshell SSH Client v.3.3 denial of service vulnerability Date: 27-5-2015 Vendor homepage: www.privateshell.com Software Link: http://www.privateshell.com/files/pshell.exe Version: 3.3 Author: 3unnym00n Details: -------- wh...

FreeBox 3.0.2 Cross Site Request Forgery / Cross Site Scripting

Hello list, Here are two CVEs I reported to Freebox, a french ISP: - CVE-2014-9382 - CSRF in VPN user account creation - CVE-2014-9405 - XSS Vulnerable product: Freebox OS Web interface 3.0.2. CVE-2014-9382 - CSRF in Freebox OS Web interface 3.0.2 allowing VPN user account creation...

Airties - login-cgi Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Airties login-cgi Buffer Overflow', 'Description' = %q This module exploits a remote buffer overflow vulnerability on several Airtie...

Wireless Photo Transfer v3.0 iOS - File Include Vulnerability

Document Title: =============== Wireless Photo Transfer v3.0 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1492 Release Date: ============= 2015-05-12 Vulnerability Laboratory ID VL-ID:...

WordPress UserPro 2.33 Cross Site Scripting

Exploit Title: WordPress Plugin: UserPro XSS Vulnerability Google Dork: inurl:wp-content/plugins/userpro/ Date: 27 May 2015 Exploit Author: FaisaL Ahmed rEd X Author Homepage: http://faisalahmed.me/ Vendor Homepage:http://userproplugin.com/userpro Software Link:...

VK.com: Able to intercept app Traffic after choosing up the Secured Connection using SSL (HTTPS)

Install the app Login with Valid credentials Settings - Choose Secured connection HTTPS Close the app Set the proxy and Open the app verify that Connection isn't Secured and able to intercept PFA POC Expected Result : Secured layer & SSL PINING should be applied successfully...

Airties login-cgi Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Airties login-cgi Buffer Overflow', 'Description' = %q This module exploits a remote buffer overflow vulnerability on several Airtie...