CVE-2017-15304

CVE-2017-15304 affects Airtame HDMI dongle Web Panel. The /bin/login.php vulnerability in firmware before 3.0 lets an attacker set a session id via a Cookie: PHPSESSID header, enabling persistent admin access even after a password change. Impact: unauthorized admin session persistence. Affected: ...

Internet Bug Bounty: Roundcube virtualmin privilege escalation (CVE-2017-8114)

Description Password plugin in its virtualmin driver allows to an attacker, that has a valid username/password to login in his web panel, to execute malicious inputs. This could allow to an attacker to reset victim's password and in some scenarios getting a system shell. CVE CVE-2017-8114 Details...

CVE-2016-10043

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

Command injection

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

CVE-2016-10043

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

CVE-2016-10043

Radisys MRF Web Panel (SWMS) 9.0.1 is vulnerable to OS command injection via the MSM_MACRO_NAME POST parameter in /swms/ms.cgi. An attacker can use the pipe character (|) to inject arbitrary commands and retrieve output from responses, enabling possible unauthorized command execution, with risks ...

CVE-2016-10043

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

MRF Web Panel 9.0.1 OS Command Injection

Title: MRF Web Panel OS Command Injection Vendor: Radisys Vendor Homepage: http://www.radisys.com Product: MRF Web Panel SWMS Version: 9.0.1 CVE: CVE-2016-10043 CWE: CWE-78 Risk Level: High Discovery: Filippos Mastrogiannis, Loukas Alkis & Dimitrios Maragkos COSMOTE OTE Group Information & Networ...

Radisys MRF - Command Injection

Radisys MRF - Command Injection Title: MRF Web Panel OS Command Injection Vendor: Radisys Vendor Homepage: http://www.radisys.com Product: MRF Web Panel SWMS Version: 9.0.1 CVE: CVE-2016-10043 CWE: CWE-78 Risk Level: High Discovery: Filippos Mastrogiannis, Loukas Alkis & Dimitrios Maragkos COSMOT...

Radisys MRF - Command Injection Vulnerability

Exploit for cgi platform in category web applications Title: MRF Web Panel OS Command Injection Vendor: Radisys Vendor Homepage: http://www.radisys.com Product: MRF Web Panel SWMS Version: 9.0.1 CVE: CVE-2016-10043 CWE: CWE-78 Risk Level: High Discovery: Filippos Mastrogiannis, Loukas Alkis &...

Radisys MRF - Command Injection

Title: MRF Web Panel OS Command Injection Vendor: Radisys Vendor Homepage: http://www.radisys.com Product: MRF Web Panel SWMS Version: 9.0.1 CVE: CVE-2016-10043 CWE: CWE-78 Risk Level: High Discovery: Filippos Mastrogiannis, Loukas Alkis & Dimitrios Maragkos COSMOTE OTE Group Information & Networ...

Chromebackdoor graniet v3.0 web panel Multi Vulnerability

Exploit for php platform in category web applications Exploit Title: botnet graniet chrome backdoor v3.0 web panel multi vulnerability Date: 10-1-2017 Exploit Author: alqnas eslam Vendor Homepage:fb.com/alqnas4 Software Link:https://github.com/graniet/chromebackdoor Tested on:any os 1- cross site...

CVE-2017-5521

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote...

Phoenix Exploit Kit - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Phoenix Exploit Kit Remote Code Execution', 'Description' = %q This module exploits a Remote Code Execution in the web panel of...

Phoenix Exploit Kit Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Phoenix Exploit Kit Remote Code Execution', 'Description' = %q This module exploits a Remote Code Execution in the web panel of...

Zemra Botnet CnC Web Panel Remote Code Execution Exploit

This Metasploit module exploits the CnC web panel of Zemra Botnet which contains a backdoor inside its leaked source code. Zemra is a crimeware bot that can be used to conduct DDoS attacks and is detected by Symantec as Backdoor.Zemra. This module requires Metasploit: http://metasploit.com/downlo...

Zemra Botnet CnC Web Panel Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Zemra Botnet CnC Web Panel Remote Code Execution', 'Description' = %q This module exploits the CnC web panel of Zemra Botnet which...

Alpha Networks ADSL2/2+ Wireless Router ASL-26555 Password Disclosure

No description provided by source. - Title: Alpha Networks ADSL2/2+ Wireless Router ASL-26555 Remote Administration Password Disclosure - Author: Alberto Ortega @a0rtega [email protected] - Version: Tested on firmware version v2.0.0.30BES. Laboratory subject:...

Sports Clubs Web Panel 0.0.1 - Remote Game Delete Exploit

No description provided by source. !/usr/bin/perl -W Sports Clubs Web Panel 0.0.1 Remote Game Delete Exploit File affected: include/draw-delete.php id Vuln Code: 06: $did = $GET'id'; 08: mysqlqueryDELETE FROM draw WHERE did='$did'; by ka0x ka0x01 at gmail dot com D.O.M Labs - Security Researchers...

Sports Clubs Web Panel 0.0.1 - Remote File Upload Vulnerability

No description provided by source. --==+============================================================================+==-- --==+ Sports Clubs Web Panel 0.0.1 Remote File upload +==-- --==+============================================================================+==-- Discovered By: Stack +...