First Android Malware Found Exploiting Dirty COW Linux Flaw to Gain Root Privileges

Nearly a year after the disclosure of the Dirty COW vulnerability that affected the Linux kernel, cybercriminals have started exploiting the vulnerability against Android users, researchers have warned. Publicly disclosed last year in October, Dirty COW was present in a section of the Linux...

Sharing Premium App Has Logic Design Flaws

Shared Premium APP is a mobile software that focuses on saving money on online shopping. Sharing Premium APP has a logical design loophole, the attacker can arbitrarily register users and arbitrarily reset passwords by grabbing packets and bursting verification codes...

Yet Another Android Malware Infects Over 4.2 Million Google Play Store Users

Even after so many efforts by Google, malicious apps somehow managed to fool its Play Store's anti-malware protections and infect people with malicious software. The same happened once again when at least 50 apps managed to make its way onto Google Play Store and were successfully downloaded as...

WAP-billing Trojan-Clickers on rise

During the preparation of the "IT threat evolution Q2 2017" report I found several common Trojans in the "Top 20 mobile malware programs" list that were stealing money from users using WAP-billing - a form of mobile payment that charges costs directly to the user's mobile phone bill so they don't...

manageo.fr XSS vulnerability

Vulnerable URL: https://www.manageo.fr/devenez-premium.html?s=818624884=16=presentation=fc=5=" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 76024 VIP website status:| No Check manageo.fr SSL connection:| Grade...

Premium Servers List Tracker 1.0 SQL Injection

Exploit Title: Premium Servers List Tracker v1.0 a SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits...

Premium Servers List Tracker 1.0 - SQL Injection

Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits...

Premium Servers List Tracker 1.0 - SQL Injection

Premium Servers List Tracker 1.0 - SQL Injection Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

Premium Servers List Tracker 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

WordPress FormCraft Form Builder 3.2.31 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: FormCraft - Premium WordPress Form Builder Heading Heading Text input field is vulnerable. The payload will execute when the form is displayed. ================== 8bitsec - https://twitter.com/8bitsec 0day.today 2018-04-04...

WordPress FormCraft 3 premium plugin <=3.2.31 - Authenticated Stored Cross-site scripting (XSS) vulnerability

Authenticated Stored Cross-site scripting XSS vulnerability found by 8bitsec in WordPress FormCraft 3 premium plugin alternative name - FormCraft Premium WordPress Form Builder. Solution 2017.07.29 - we were unable to find any information about patched version of WordPress FormCraft 3 premium...

WordPress Plugin Ads Pro < 3.4 - Cross-Site Scripting / SQL Injection

Exploit Title: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager = 5.0.12 AND time-based blind Payload: bsaprostats=1&[email protected]&bsaproid=xx AND SLEEP5 Credits & Authors: ================== 8bitsec - https://tw...

WordPress FormCraft Form Builder 3.2.31 Cross Site Scripting

Exploit Title: FormCraft - Premium WordPress Form Builder Heading Heading Text input field is vulnerable. The payload will execute when the form is displayed. ================== 8bitsec - https://twitter.com/8bitsec...

WordPress Plugin Ads Pro 3.4 - Cross-Site Scripting SQL Injection

WordPress Plugin Ads Pro 3.4 - Cross-Site Scripting SQL Injection Exploit Title: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager = 5.0.12 AND time-based blind Payload: bsaprostats=1&[email protected]&bsaproid=xx AND S...

Cyber Insurance Rates to Rise – What Should I Do?

Organizations manage risk in three ways: they accept it, they take out insurance against it, or they take active measures to diminish its potential impact. These active measures commonly include deploying or enhancing or removing technology, updating policies and procedures, instituting training...

WordPress Task Manager Pro plugin <=1.3.1 - Multiple Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Cross-Site Scripting XSS vulnerabilities found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on...

WordPress Task Manager Pro plugin <=1.3.1 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on the changelog of the...

Airbnb: Call back number not verified

The issue is with the "Confirm via call functionality" While adding mobile number,the application does not verify the number that is being called back. A malicious user can change the number to any premium rate numbers which charge particular amount from the caller. It was further noticed that...

Google Removes Two Ztorg Trojans from Play Marketplace

Google, for the second time this month, has removed malicious apps from Google Play that could have laid the groundwork for an attacker to root infected devices. A researcher with Kaspersky Lab on Tuesday described how attackers managed to evade settings set in place by Google Play’s VerifyApps...

Ztorg: from rooting to SMS

I've been monitoring Google Play Store for new Ztorg Trojans since September 2016, and have so far found several dozen new malicious apps. All of them were rooting malware that used exploits to gain root rights on the infected device. Then, in the second half of May 2017 I found one that wasn't...