CVE-2017-9101

CVE-2017-9101 affects PlaySMS 1.4 where import.php (Phonebook import) allows remote code execution. The vulnerability arises from improper handling of file contents during a CSV upload, enabling PHP code execution via payloads contained in the uploaded file name or User-Agent header. Public refer...

PT-2017-18703

Name of the Vulnerable Software and Affected Versions PlaySMS version 1.4 Description The issue allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file, specifically in the import.php feature, also known as the Phonebook import feature...

PlaySMS 1.4 - import.php Remote Code Execution

PlaySMS 1.4 - import.php Remote Code Execution Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php Date: 21-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22...

CVE-2017-9101: Unrestricted Upload of File with Dangerous Type

import.php aka the Phonebook import feature in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file...

PlaySMS 1.4 - 'import.php' Remote Code Execution

Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php Date: 21-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website: http://touhidshaikh.com/ Category: webapps ...

Zomato: Reflected XSS in Zomato Mobile - category parameter

Hi there. I have found a reflected XSS in Zomato.com mobile. This XSS affects mobile users of Zomato. Steps to reproduce: 1. Go to Zomato.com and change your user agent to mobile iPhone/Android user agent 2. Go to a certain restaurant/place and their photos e.g. site:...

PlaySMS 1.4 - Remote Code Execution

PlaySMS 1.4 - Remote Code Execution Exploit Title: PlaySMS 1.4 Remote Code Execution to Poisoning admin log Date: 19-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website: http://touhidshaikh.com/...

Fixed in Apache Tomcat 7.0.77

Important: Information Disclosure CVE-2017-5647 A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong...

Sync Breeze Enterprise 9.5.16 - GET Buffer Overflow (SEH) Exploit

Exploit for windows platform in category remote exploits !/usr/bin/env python Exploit Title: Sync Breeze Enterprise v9.5.16 - Remote buffer overflow SEH Date: 2017-03-29 Exploit Author: Daniel Teixeira Vendor Homepage: http://syncbreeze.com Software Link:...

CVE-2016-7955

The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report...

Tenable SecurityCenter 5.x < 5.4.3 Multiple Vulnerabilities (TNS-2017-04) (httpoxy)

According to its version, the installation of Tenable SecurityCenter on the remote host is affected by multiple vulnerabilities : - A flaw exists in the modsessioncrypto module due to encryption for data and cookies using the configured ciphers with possibly either CBC or ECB modes of operation...

e107 2.1.4 - keyword Blind SQL Injection

e107 2.1.4 - keyword Blind SQL Injection !/usr/bin/perl e107 = 2.1.4 "keyword" Blind SQL Injection Exploit -------------------------------------------------------------------------- Discovered by staker - stakerathotmaildotit Discovered on 09/03/2017 Site Vendor: http://www.e107.org BUG: Blind SQ...

Alienvault OSSIM/USM 5.3.0 Authentication Bypass Exploit

Exploit for php platform in category web applications Details ======= Product: Alienvault OSSIM/USM Vulnerability: Authentication Bypass Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-7955 Vulnerable Versions: =5.3.0 Fixed Version: 5.3.1 Vulnerability Details ===================== This...

dirsearch - Brute Force Directories and Files in Websites

dirsearch is a simple command line tool designed to brute force directories and files in websites. Operating Systems supported Windows XP/7/8/10 GNU/Linux MacOSX Features Multithreaded Keep alive connections Support for multiple extensions -e|--extensions asp,php Reporting plain text, JSON...

ReDoS via long UserAgent header

Overview Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed. Proof of Concept var useragent = require'useragent'; var badUserAgent = 'MSIE 0.0'+Array900000.join'0'+'XBLWP'; var request = 'GET /...

TM RG4332 Wireless Router - Arbitrary File Disclosure Vulnerability

Exploit for hardware platform in category web applications Exploit Title: TM RG4332 Wireless Router Traversal Arbitrary File Read Date: 27/01/2017 Exploit Author: Saeid Atabaki Version: RG4332V2.7.0 Tested on: RG4332 with minihttp 1.19 = 1...

Apache HTTP Server 2.4.x < 2.4.25 Multiple Vulnerabilities

Binary data 9908.prm...

DiskBoss Enterprise 7.5.12 - 'POST' Remote Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: DiskBoss Enterprise 7.5.12 SEH + Egghunter Buffer Overflow Date: 10-01-2017 Exploit Author: Wyndell Bibera Software Link: http://www.diskboss.com/setups/diskbossentsetupv7.5.12.exe Version: 7.5.12 Tested on: Windows XP Professional SP3 import socket ip =...

xsscrapy - XSS/SQLi Spider

Fast, thorough, XSS/SQLi spider. Give it a URL and it'll test every link it finds for cross-site scripting and some SQL injection vulnerabilities. See FAQ for more details about SQLi detection. From within the main folder run: ./xsscrapy.py -u http://example.com If you wish to login then crawl:...

LocalTapiola: Reflected XSS on sankarikoulutus (viestinta.lahitapiola.fi)

Basic report information Summary: Hi, The ctx parameter in http://viestinta.lahitapiola.fi/webApp/sankarikoulutus, can be exploited to perform an XSS Attack. Description: When a user clicks on a map area, The following POST request is generated : POST / HTTP/1.1 Host: viestinta.lahitapiola.fi...