Ultimate Member < 1.3.76 - Unauthenticated Change Passwords

Ultimate Member versions below 1.3.76 contain a critical security issue that allows unauthenticated users to reset any users password to an arbitrary value...

FTPShell Client 5.24 PWD Remote Buffer Overflow

-- coding: utf-8 -- Exploit Title: FTPShell Client v5.24 PWD Remote Buffer Overflow Date: 16/11/2016 Author: Yunus YILDIRIM Th3GundY Team: CT-Zer0 @CRYPTTECH - http://www.ct-zer0.com Author Website: http://yildirimyunus.com Contact: [email protected] Software Link:...

FTPShell Client 5.24 - PWD Remote Buffer Overflow

FTPShell Client 5.24 - PWD Remote Buffer Overflow -- coding: utf-8 -- Exploit Title: FTPShell Client v5.24 PWD Remote Buffer Overflow Date: 16/11/2016 Author: Yunus YILDIRIM Th3GundY Team: CT-Zer0 @CRYPTTECH - http://www.ct-zer0.com Author Website: http://yildirimyunus.com Contact:...

K7 TotalSecurity 15.1.0.289 Privilege Escalation

===================================================== K7 TotalSecurity v15.1.0.289 - Unquoted Service Path Privilege Escalation ===================================================== Vendor Homepage: https://www.k7computing.com Date: 24 Oct 2016 Version : 15.1.0.289 Software Link:...

Windows/x64 - WinExec() Shellcode (93 bytes)

/ Title : Windows x64 WinExec shellcode Date : 15-10-2016 Author : Roziul Hasan Khan Shifat size : 93 bytes Tested on : Windows 7 Ultimate x64 / / Disassembly of section .text: 0000000000000000 : 0: 99 cltd 1: 65 48 8b 42 60 mov %gs:0x60%rdx,%rax 6: 48 8b 40 18 mov 0x18%rax,%rax a: 48 8b 70 10 mo...

wdCalendar 2 - SQL Injection

wdCalendar 2 - SQL Injection Exploit Title: wdcalendar version 2 sql injection vulnerability Google Dork: allinurl:"wdcalendar/edit.php" Date: 12/09/2016 Exploit Author: Alfonso Castillo Angel Software Link: https://github.com/ronisaha/wdCalendar Version: Version 2 Tested on: Windows 7 ultimate...

wdCalendar 2 - SQL Injection

Exploit for php platform in category web applications Exploit Title: wdcalendar version 2 sql injection vulnerability Google Dork: allinurl:"wdcalendar/edit.php" Date: 12/09/2016 Exploit Author: Alfonso Castillo Angel Software Link: https://github.com/ronisaha/wdCalendar Version: Version 2 Tested...

Windows x86 - Password Protected TCP Bind Shell (637 bytes)

Windows x86 - Password Protected TCP Bind Shell 637 bytes. Shellcode exploit for Winx86 platform / Title : Windows x86 password protected bind shell tcp shellcode Date : 12-09-2016 Author : Roziul Hasan Khan Shifat size : 637 bytes Tested On : Windows 7 ultimate x86 x64 Email : [email protected]...

Windows x86 - Bind Shell TCP Shellcode

Windows x86 - Bind Shell TCP Shellcode. Shellcode exploit for Winx86 platform / Title : Windows x86 bind shell tcp shellcode Author : Roziul Hasan Khan Shifat Date : 08-09-2016 Tested On : Windows 7 Ultimate , Starter x86 / //Note: This shellcode will only works on x86 / section .text global star...

Windows/x86 - Bind Shell TCP 4444 Shellcode (357 Bytes)

/ Title : Windows x86 bind shell tcp shellcode Author : Roziul Hasan Khan Shifat Date : 08-09-2016 Tested On : Windows 7 Ultimate , Starter x86 / //Note: This shellcode will only works on x86 / section .text global start start: xor ecx,ecx mov eax,fs:ecx+0x30 ;PEB mov eax,eax+0xc ;PEB.Ldr mov...

ultimate-guitar.com XSS vulnerability

Vulnerable URL: http://www.ultimate-guitar.com/search.php?approved1=1name=ugtname=mbtvccdk'%22alert'OPENBUGBOUNTY'...

WordPress Ultimate-Product-Catalog Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up personal blog sites.Ultimate-Product-Catalog is one of the product catalog plugin. A SQL injection vulnerability exists in WordPress...

WordPress Ultimate Product Catalog 3.9.8 Plugin - (do_shortcode via ajax) Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: Wordpress Ultimate-Product-Catalog getrow"SELECT FROM $cataloguestablename WHERE CatalogueID=" . $id; $CatalogueItems = $wpdb-getresults"SELECT FROM $catalogueitemstablename WHERE CatalogueID=" . $id . " ORDER BY Position";...

WordPress Plugin Ultimate Product Catalog 3.9.8 - do_shortcode via ajax Blind SQL Injection

WordPress Plugin Ultimate Product Catalog 3.9.8 - doshortcode via ajax Blind SQL Injection Exploit Title: Wordpress Ultimate-Product-Catalog getrow"SELECT FROM $cataloguestablename WHERE CatalogueID=" . $id; $CatalogueItems = $wpdb-getresults"SELECT FROM $catalogueitemstablename WHERE CatalogueID...

WordPress Plugin Ultimate Product Catalog 3.9.8 - do_shortcode via ajax Blind SQL Injection

Exploit Title: Wordpress Ultimate-Product-Catalog getrow"SELECT FROM $cataloguestablename WHERE CatalogueID=" . $id; $CatalogueItems = $wpdb-getresults"SELECT FROM $catalogueitemstablename WHERE CatalogueID=" . $id . " ORDER BY Position"; ... return $ProductString; The $id parameter is extracted...

CoolPlayer+ Portable 2.19.6 Stack Overflow

Exploit Title: CoolPlayer+ Portable build 2.19.6 - .m3u Stack Overflow Egghunter+ASLR bypass Exploit Author: Karn Ganeshen Download link: https://sourceforge.net/projects/portableapps/files/CoolPlayer%2B%20Portable/CoolPlayerPlusPortable2.19.6.paf.exe/download?usemirror=liquidtelecom Version:...

TFTP Server 1.4 - 'WRQ' Remote Buffer Overflow (Egghunter)

Exploit Title: TFTP Server 1.4 - WRQ Buffer Overflow Exploit Egghunter Exploit Author: Karn Ganeshen Vendor Homepage: http://sourceforge.net/projects/tftp-server/ Version: 1.4 Tested on: Windows Vista SP2 Coded this for Vista Ultimate, Service Pack 2 3-byte overwrite + short jump + Egghunter...

WordPress Ultimate Member Plugin <= 1.3.64 - Local File Inclusion

This plugin is prone to a PHP file inclusion vulnerability. Solution Update the plugin...

Ultimate Member < 1.3.65 - Local File Inclusion

It was discovered that Ultimate Member is vulnerable to PHP File Inclusion. In order to exploit this issue an attacker must be able to place an arbitrary PHP file on the target system. Afterwards the attacker needs to lure an authenticated admin to visit a malicious page. Through CSRF the attacke...

WordPress Ultimate Member 1.3.64 Local File Inclusion

------------------------------------------------------------------------ Ultimate Member Local File Inclusion vulnerability ------------------------------------------------------------------------ Burak Kelebek, July 2016 ------------------------------------------------------------------------...