1445 matches found
PrestaShop 1.6.1.19 - BlowFish ECD Privilege Escalation
PrestaShop 1.6.1.19 - BlowFish ECD Privilege Escalation !/usr/bin/env python3 PrestaShop = 1.6.1.19 Privilege Escalation Charles Fol 2018-07-10 See https://ambionics.io/blog/prestashop-privilege-escalation The condition for this exploit to work is for an employee to have the same password as a...
PrestaShop < 1.6.1.19 - 'BlowFish ECD' Privilege Escalation
!/usr/bin/env python3 PrestaShop = 1.6.1.19 Privilege Escalation Charles Fol 2018-07-10 See https://ambionics.io/blog/prestashop-privilege-escalation The condition for this exploit to work is for an employee to have the same password as a customer. The exploit will yield a valid employee cookie f...
Debian: Security Advisory (DSA-4247-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
phpMyAdmin Authenticated Remote Code Execution Exploit
phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code by application. The module has been tested with phpMyAdmin v4.8.1. This module requires Metasploit: https://metasploit.com/download Current source:...
CMS Made Simple 2.2.5 - (Authenticated) Remote Code Execution
CMS Made Simple 2.2.5 - Authenticated Remote Code Execution Exploit Title: CMS Made Simple 2.2.5 authenticated Remote Code Execution Date: 3rd of July, 2018 Exploit Author: Mustafa Hasan @strukt93 Vendor Homepage: http://www.cmsmadesimple.org/ Software Link:...
CVE-2018-6563
Multiple cross-site request forgery CSRF vulnerabilities in totemomail Encryption Gateway before 6.0.0Build371 allow remote attackers to hijack the authentication of users for requests that 1 change user settings, 2 send emails, or 3 change contact information by leveraging lack of an anti-CSRF...
CVE-2018-6563
Multiple cross-site request forgery CSRF vulnerabilities in totemomail Encryption Gateway before 6.0.0Build371 allow remote attackers to hijack the authentication of users for requests that 1 change user settings, 2 send emails, or 3 change contact information by leveraging lack of an anti-CSRF...
phpMyAdmin Authenticated Remote Code Execution
phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code by application. The module has been tested with phpMyAdmin v4.8.1. Module Options msf use exploit/multi/http/phpmyadmin/lfirce msf undefinedlfirce show actions...
CVE-2018-11406
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the...
Monstra CMS < 3.0.4 - Cross-Site Scripting Exploit
Exploit for php platform in category web applications Title: Monstra CMS www.target.com' url = input'Target : ' print' Required admin's PHPSESSID.' PHPSESSID = input'PHPSESSID : ' pagename = input'Pagename : ' script = input'Script : ' target = 'http://' + url +...
Monstra CMS 3.0.4 - Cross-Site Scripting (1)
Monstra CMS 3.0.4 - Cross-Site Scripting 1 Title: Monstra CMS www.target.com' url = input'Target : ' print' Required admin's PHPSESSID.' PHPSESSID = input'PHPSESSID : ' pagename = input'Pagename : ' script = input'Script : ' target = 'http://' + url + '/admin/index.php?id=pages&action=addpage'...
Monstra CMS < 3.0.4 - Cross-Site Scripting (1)
Title: Monstra CMS www.target.com' url = input'Target : ' print' Required admin's PHPSESSID.' PHPSESSID = input'PHPSESSID : ' pagename = input'Pagename : ' script = input'Script : ' target = 'http://' + url + '/admin/index.php?id=pages&action=addpage' cookie = 'PHPSESSID':PHPSESSID data =...
Liberapay: Csrf token does not meet security design
Almost all APIs in liberapay.com have csrf tokens.However, this token is not useful for the specified user. In the case that the user is not logged in, the csrf token is also generated, and after the login is successful, the token does not change.And the csrf tokens generated by other web browser...
Liberapay: CSRF token manipulation in every possible form submits. NO server side Validation
Web Application is generating CSRFtoken values inside cookies which is not a best practice for web applications the revelation of cookies can reveal CSRF Tokens as well. Authenticity tokens should be kept separate from cookies and should be isolated to change operations in the account only...
Liberapay: The csrf token remains same after user logs in
Description As the CSRF token doesn't change after login. Any other user that uses the same workstation is vulnerable. A safer way would be to use dynamic CSRF token or just change the token after login, so attacker doesn't get hold of this. Details of the attacks scenario in a shared workstation...
Liberapay: csrf token did not changed after login/logout many times
hello team, your csrf token did not expired and after login and logout many times , i found that your csrf token is generated same as last one. Impact if an attacker found an xss on your domain and you fixed it but attacker still has csrf token of user, attacker can use it to perform any action...
Liberapay: Same CSRF token is being used for deleting other platform login’s within an account and across other liberapay Account’s
We’ve got “Accounts Elsewhere” option in the profile section. where we can connect our liberapay account with multiple other platform accounts. While deleting those Multiple other platform accounts same CSRF token is being used. I’ve signed up with a couple of liberapay accounts. Where I found th...
CVE-2018-11538
servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the uname, upasswd1, upasswd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass...
Cross site request forgery (csrf)
servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the uname, upasswd1, upasswd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass...