sNews 1.7.1 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title : Snews CMS upload sheller Author : Ashiyane Digital Security Team Google Dork : "This site is powered by sNews" Date : 04/11/2016 Type : webapps Platform : PHP Vendor Homepage : http://snewscms.com/ Software link :...

WordPress: WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosure

Issue 1: Method checks if first argument is an array and if it is, it avoids the rest of the arguments and uses the first argument array values as input. Issue 2: When input query has %s in it, then it quote and this guides to sql injection in case query that need to be prepared have quoted user...

Rapid PHP Editor 14.1 - Remote Command Execution

Rapid PHP Editor 14.1 - Remote Command Execution + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/RAPID-PHP-EDITOR-REMOTE-CMD-EXEC.txt + ISR: Apparition Security Vendor: ====================== www.rapidphpeditor.com Produc...

nodCMS - Cross-Site Request Forgery

nodCMS - Cross-Site Request Forgery Exploit Title : nodcms Cross Site Request Forgery Author : Ashiyane Digital Security Team Google Dork : - Date : 29/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.nodcms.com/en Software link :...

sNews 1.7.1 - Cross-Site Request Forgery

sNews 1.7.1 - Cross-Site Request Forgery Exploit Title : Snews CMS Cross Site Request Forgery Author : Ashiyane Digital Security Team Google Dork : "This site is powered by sNews" Date : 1/11/2016 Type : webapps Platform : PHP Vendor Homepage : http://snewscms.com/ Software link :...

Memcached 1.4.33 - PoC (1)

Exploit for linux platform in category dos / poc Source: http://paper.seebug.org/95/ import struct import socket import sys MEMCACHEDREQUESTMAGIC = "\x80" OPCODEPREPENDQ = "\x1a" keylen = struct.pack"!H",0xfa extralen = "\x00" datatype = "\x00" vbucket = "\x00\x00" bodylen = struct.pack"!I",0...

Intel(R) HD Graphics 10.18.10.4358 Privilege Escalation

===================================================== Exploit Title : IntelR HD Graphics - Unquoted Service Path Privilege Escalation Date Discovered : 2016-10-14 Affected Products: Intel Atom Product: IntelR HD Graphics - Software 10.18.10.4358 Exploitation Technique: Local Severity Level: Mediu...

nodCMS - Cross-Site Request Forgery

Exploit Title : nodcms Cross Site Request Forgery Author : Ashiyane Digital Security Team Google Dork : - Date : 29/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.nodcms.com/en Software link : https://github.com/khodakhah/nodcms/archive/master.zip CSRF PoC create User:...

Redaxo 5.2.0 - Cross-Site Request Forgery

Exploit Title : redaxo CMS CSRFAdd Admin Author : Ashiyane Digital Security Team Google Dork : intitle:Login · REDAXO Date : 1/11/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.redaxo.org/ Software link :http://www.redaxo.org/de/download/file/?f=redaxo5.2.0.zip Version : 5.2lates...

SweetRice 1.5.1 Cross Site Request Forgery

document.forms0.submit;...

Alienvault OSSIM/USM 5.3.1 Persistent Cross Site Scripting

Details ======= Product: Alienvault OSSIM/USM Vulnerability: Stored XSS Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-8581 CVSS: 3.5 Vulnerable Versions: Current Sessions. POC === The POC uses jQuery to send all session IDs on the "Current Sessions" page to an arbitrary site Google, in this...

Alienvault OSSIMUSM 5.3.1 - SQL Injection

Alienvault OSSIMUSM 5.3.1 - SQL Injection Details ======= Product: Alienvault OSSIM/USM Vulnerability: SQL Injection Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-8582 Vulnerable Versions: =5.3.1 Fixed Version: 5.3.2 Vulnerability Details ===================== A SQL injection vulnerability...

MySQL / MariaDB / PerconaDB - mention the rights/conditions of competition vulnerability(POC)-vulnerability warning-the black bar safety net

Vulnerability found person: Dawid Golunski Vulnerability level: severe CVE number: CVE-2 0 1 6-6 6 6 3 / CVE-2 0 1 6-5 6 1 6 Vulnerability impact: MariaDB 5.5.52 10.1.18 10.0.28 MySQL = 5.5.51 = 5.6.32 = 5.7.14 Percona Server 5.5.51-38.2 5.6.32-7 8-1 5.7.14-8 Percona XtraDB Cluster 5.6.32-25.17...

Alienvault OSSIM/USM 5.3.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Details ======= Product: Alienvault OSSIM/USM Vulnerability: SQL Injection Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-8582 Vulnerable Versions: =5.3.1 Fixed Version: 5.3.2 Vulnerability Details ===================== A SQL injection...

Memcached fix multiple high-risk vulnerabilities can lead to code execution, denial of service-vulnerability warning-the black bar safety net

! Background description Memcached is a free open-source, high-performance, distributed memory object caching system. Memcached is based on LiveJournal's Danga Interactive company of Brad Fitzpatric led the development of a software. Has now become MySpace, the hatena and Facebook, the Vox,...

SweetRice 1.5.1 - Cross-Site Request Forgery

document.forms0.submit;...

Blockchain: Reflected XSS on blockchain.info

The application at https://blockchain.info is vulnerable to reflected XSS/HTML injection through the URL at the block-index page. Proof of concept === The following PoC contains the payload "XSS here which displays the text in heading size...

How to use Rowhammer vulnerability Root Android phone with Video demo+Exploit source code-the vulnerabilities and early warning-the black bar safety net

! Recently, security research experts through research found a root the Android phone to the new method, i.e., by Rowhammer vulnerability to root Android phone. In addition, the attacker can even use this exploit with presently known Android vulnerabilities Bandroid and Stagefright to the target...

Memcached 1.4.33 - Crash (PoC)

Memcached 1.4.33 - Crash PoC Source: http://paper.seebug.org/95/ import struct import socket import sys MEMCACHEDREQUESTMAGIC = "\x80" OPCODEPREPENDQ = "\x1a" keylen = struct.pack"!H",0xfa extralen = "\x00" datatype = "\x00" vbucket = "\x00\x00" bodylen = struct.pack"!I",0 opaque =...

NVIDIA Driver - Escape Code Leaks Uninitialised ExAllocatePoolWithTag Memory to Userspace Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=892 The handler for the DxgkDdiEscape escape code 0x70000D4 has the following pseudocode: void fastcall escape70000D4NvMiniportDeviceContext a1, NvEscapeData a2 Escape70000D4...