1169 matches found
Drupal /xmlrpc.php 拒绝服务漏洞 poc
早在2012 年 12 月 17 日一些采用 PHP 的知名博客程序 WordPress被曝光存在严重的漏洞，该漏洞覆盖WordPress 全部已发布的版本（包括WordPress 3.8.1）。该漏洞的 WordPress 扫描工具也在很多论坛和网站发布出来。工具可以利用 WordPress 漏洞来进行扫描，也可以发起DDoS 攻击。经过测试，漏洞影响存在 xmlrpc.php 文件的全部版本。 Pingback 是三种类型的反向链接中的一种，当有人链接或者盗用作者文章时来通知作者的一种方法。可以让作者了解和跟踪文章被链接或被转载的情况。一些全球最受欢迎的 blog 系统比如...
Millions of WordPress and Drupal Websites Vulnerable to DoS Attack
Users running the website on a self-hosted WordPress or on Drupal are strongly recommended to update their websites to the latest version immediately. A moderately critical vulnerability was discovered in the way Drupal and WordPress implement XMLRPC, which can lead an attacker to disable your...
Wordpress XMLRPC DoS
Wordpress XMLRPC parsing is vulnerable to a XML based denial of service. This vulnerability affects Wordpress 3.5 - 3.9.2 3.8.4 and 3.7.4 are also patched. Module Options msf use auxiliary/dos/http/wordpress/xmlrpcdos msf undefinedxmlrpcdos show actions ...actions... msf undefinedxmlrpcdos set...
WordPress xmlrpc using the test tool multi-threaded version-bug warning-the black bar safety net
The following is the code import futures import requests from Queue import Queue XMLURL = "http://www.myhack58.com/" USERFILE = "username.txt" PASSFILE = "password.txt" THREADNUM = 2 0 data = """wp. getUsersBlogs%s%s""" task = Queuedef attack: while not task. empty: username = the task. get passt...
Wordpress xmlrpc. php brute force vulnerability-a vulnerability warning-the black bar safety net
wordpress is very popular open source blog, which provides remote POST method is used with pathxmlrpc.phpthis file recently broke xmlrpc vulnerability, the vulnerability principle is through the xmlrpc authentication, even when authentication fails, it will not be Wordpress to install the securit...
WordPress xmlrpc exploit tool-vulnerability warning-the black bar safety net
A few days ago saw the use of xmlrpc. php for WordPress brute-force attack on try Wordpress after installation the default with this vulnerability, the impact should be relatively large, the weak and the password of the party is very unfortunate message. So wrote this to use the tool, share to...
WordPress 1.5.1 - 3.5 XMLRPC pingback additional issues
...
WordPress 1.5.1 - 3.5 XMLRPC Pingback API Internal/External Port Scanning
...
WordPress 2.1.2 - Authenticated XMLRPC SQL Injection
...
Wordpress 2.2 - (xmlrpc.php) Remote SQL Injection
...
[SECURITY] Fedora 20 Update: cobbler-2.6.3-1.fc20
Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. There is also a web interface 'cobbler-web'. Cobbler's advanced features include importing...
[SECURITY] Fedora 19 Update: cobbler-2.6.3-1.fc19
Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. There is also a web interface 'cobbler-web'. Cobbler's advanced features include importing...
SAP Sybase Event Stream Processor esp_parse Remote Code Execution (CVE-2014-3457)
Two unsafe pointer dereference vulnerabilities have been reported in SAP Sybase Event Stream Processor ESP. These vulnerabilities are caused by the listening service accepting unsanitized pointers in XMLRPC requests. A remote attacker can leverage these vulnerabilities by sending crafted requests...
SAP Sybase Event Stream Processor esp_parse ConnectionType Unsafe Pointer Dereference (CVE-2014-3458)
Five unsafe pointer dereference vulnerabilities have been reported in SAP Sybase Event Stream Processor ESP. These vulnerabilities are caused by the listening service accepting unsanitized pointers in XMLRPC requests. By sending crafted requests to a vulnerable server, an remote attacker can caus...
Medium: php54
Issue Overview: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A denial of service flaw was found in the way the File Information fileinfo extension parsed certain...
XOOPS <= 2.0.11 xmlrpc.php SQL Injection Exploit
No description provided by source. !/usr/bin/perl Xoops = 2.0.11 xmlrpc.php sql injection exploit by RST/GHC based on http://www.gulftech.org/?node=research&articleid=00086-06292005 coded by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru example: r57xoops.pl -u http://www.xoops2.ru/xmlrpc.php ...
PHP <= 5.3.2 xmlrpc Extension Multiple Remote Denial of Service Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/38708/info PHP's xmlrpc extension library is prone to multiple denial-of-service vulnerabilities because it fails to properly handle crafted XML-RPC requests. Exploiting these issues allows remote attackers to cause...
Symantec Workspace Streaming Arbitrary File Upload
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include...
Wordpress <= 1.5.1.2 xmlrpc Interface SQL Injection Exploit
No description provided by source. !/usr/bin/perl -w sorry for the late posting, had to test it. /str0ke Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML RPC server...
openSUSE Security Update : cobbler (openSUSE-SU-2012:0655-1)
The xmlrpc interface of cobbler was prone to command injectoin %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-296. The text description of this plugin is C SUSE LLC...