wpcmdexec.pl.txt

!/usr/bin/perl -w Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML RPC server vulnerabilities I discovered to extract a password hash & use that hash to execute shell...

WordPress <= 1.5.1.2 - SQL injection

Because of this vulnerability in XMLRPC server, attackers can execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file. Solution Update the WordPress to the latest available version at least 1.5.1.3...

Mandrake Linux Security Advisory : php-pear (MDKSA-2005:109)

A vulnerability was discovered by GulfTech Security in the PHP XML RPC project. This vulnerability is considered critical and can lead to remote code execution. The vulnerability also exists in the PEAR XMLRPC implementation. Mandriva ships with the PEAR XMLRPC implementation and it has been...

Advisory 02/2005: Remote code execution in Serendipity

Hardened PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Remote code execution in Serendipity Release Date: 2005/06/29 Last Modified: 2005/06/29 Author: Christopher Kunz [email protected] Application: Serendipity = 0.8.2 Severity: Arbitrary remote code execution...

WordPress < 1.5.1.3 XMLRPC SQL Injection

The version of WordPress installed on the remote host is affected by a SQL injection vulnerability because the bundled XML-RPC library fails to properly sanitize user-supplied input to the 'xmlrpc.php' script. An attacker can exploit this flaw to launch SQL injection attacks that could lead to...

Wordpress <= 1.5.1.2 xmlrpc Interface SQL Injection Exploit

Exploit for unknown platform in category web applications =========================================================== Wordpress wp.pl http://pathto/wp admin 1 "id;uname -a;pwd;uptime" Trying Host http://pathto/wp ... + The XMLRPC server seems to be working + Char 1 is 2 + Char 2 is 1 + Cha...

Xoops < 2.0.12 Multiple XSS / SQL Injection

Binary data 3041.prm...

Wordpress &lt;= 1.5.1.2 xmlrpc Interface SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w sorry for the late posting, had to test it. /str0ke Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML RPC server...

XOOPS 2.0.11 && Earlier Multiple Vulnerabilities

GulfTech Security Research June 28th, 2005 Vendor : XOOPS URL : http://www.xoops.org/ Version : XOOPS 2.0.11 And Earlier Risk : Multiple Vulnerabilities Description: XOOPS is a very popular dynamic web content management system written in Object Oriented PHP. One of the features of XOOPS is it's...

WordPress 1.5.1.2 - xmlrpc Interface SQL Injection

WordPress 1.5.1.2 - xmlrpc Interface SQL Injection !/usr/bin/perl -w sorry for the late posting, had to test it. /str0ke Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML R...

WordPress Core 1.5.1.2 - 'xmlrpc' Interface SQL Injection

!/usr/bin/perl -w sorry for the late posting, had to test it. /str0ke Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML RPC server vulnerabilities I discovered to extract a...

USN-146-1: Ruby vulnerability

Nobuhiro IMAI discovered that the changed default value of the Modulepublicinstancemethods method broke the security protection of XMLRPC server handlers. A remote attacker could exploit this to execute arbitrary commands on an XMLRPC server...

WordPress <= 1.5.1.2 - XMLRPC Eval Injection

...

Fedora Core 4 : ruby-1.8.2-7.fc4.2 (2005-475)

Wed Jun 22 2005 Akira TAGOH - 1.8.2-7.fc4.2 - ruby-1.8.2-xmlrpc-CVE-2005-1992.patch: fixed the arbitrary command execution on XMLRPC server. 161096 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Ruby object-oriented language protection bypass

Error in XMLRPC module...

ruby -- arbitrary command execution on XMLRPC server

Nobuhiro IMAI reports: the default value modification on Modulepublicinstancemethods from false to true breaks s.addhandlerXMLRPC::iPIMethods"sample", MyHandler.new style security protection. This problem could allow a remote attacker to execute arbitrary commands on XMLRPC server of libruby...

[SA15767] Ruby XMLRPC Server Arbitrary Command Execution

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

CVE-2005-1992

The XMLRPC server in utils.rb for the ruby library libruby 1.8 sets an invalid default value that prevents "security protection" using handlers, which allows remote attackers to execute arbitrary commands...

CVE-2005-1992

CVE-2005-1992 affects Ruby’s XMLRPC implementation. The XMLRPC server in utils.rb (Ruby libruby 1.8) uses an insecure default for public_instance_methods, enabling a remote attacker to trigger the XMLRPC handler to execute arbitrary commands. Impact is remote code execution via the XMLRPC service...

CVE-2005-1992

The XMLRPC server in utils.rb for the ruby library libruby 1.8 sets an invalid default value that prevents "security protection" using handlers, which allows remote attackers to execute arbitrary commands...