vBSEO proc_deutf() Remote PHP Code Injection

This module exploits a vulnerability in the 'procdeutf' function defined in /includes/functionsvbseocpabstract.php for vBSEO versions 3.6.0 and earlier. User input passed through 'charrepl' POST parameter isn't properly sanitized before being used in a call to pregreplace function which uses the...

Apache Struts Remote Command Execution

This module exploits a remote command execution vulnerability in Apache Struts versions use exploit/multi/http/struts/codeexecexceptiondelegator msf undefinedcodeexecexceptiondelegator show actions ...actions... msf undefinedcodeexecexceptiondelegator set ACTION msf...

FreeBSD Telnet Service Encryption Key ID Buffer Overflow

This module exploits a buffer overflow in the encryption option handler of the FreeBSD telnet service. Module Options msf use exploit/freebsd/telnet/telnet/encryptkeyid msf undefinedencryptkeyid show actions ...actions... msf undefinedencryptkeyid set ACTION msf undefinedencryptkeyid show options...

Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow

This module exploits a buffer overflow in the encryption option handler of the Linux BSD-derived telnet service inetutils or krb5-telnet. Most Linux distributions use NetKit-derived telnet daemons, so this flaw only applies to a small subset of Linux systems running telnetd. Module Options msf us...

MS11-080 AfdJoinLeaf Privilege Escalation

This module exploits a flaw in the AfdJoinLeaf function of the afd.sys driver to overwrite data in kernel space. An address within the HalDispatchTable is overwritten and when triggered with a call to NtQueryIntervalProfile will execute shellcode. This module will elevate itself to SYSTEM, then...

CCMPlayer 1.5 m3u Playlist Stack Based Buffer Overflow

This module exploits a stack based buffer overflow in CCMPlayer 1.5. Opening a m3u playlist with a long track name, a SEH exception record can be overwritten with parts of the controllable buffer. SEH execution is triggered after an invalid read of an injectable address, thus allowing arbitrary...

PmWiki pagelist.php Remote PHP Code Injection Exploit

This module exploits an arbitrary command execution vulnerability in PmWiki from 2.0.0 to 2.2.34. The vulnerable function is inside /scripts/pagelist.php. Module Options msf use exploit/multi/http/pmwiki/pagelist msf undefinedpagelist show actions ...actions... msf undefinedpagelist set ACTION ms...

AbsoluteFTP 1.9.6 - 2.2.10 LIST Command Remote Buffer Overflow

This module exploits VanDyke Software AbsoluteFTP by overflowing a filename buffer related to the LIST command. Module Options msf use exploit/windows/ftp/absolute/ftplistbof msf undefinedftplistbof show actions ...actions... msf undefinedftplistbof set ACTION msf undefinedftplistbof show options...

phpLDAPadmin orderby Parameter Arbitrary PHP Code Execution

The version of phpLDAPadmin installed on the remote host does not sanitize input to the 'orderby' parameter of the 'cmd.php' script when 'cmd' is set to 'queryengine' before using it in a call to 'createfunction'. An unauthenticated, remote attacker can leverage this issue to execute arbitrary PH...

phpLDAPadmin query_engine Remote PHP Code Injection

This module exploits a vulnerability in the lib/functions.php for phpLDAPadmin versions 1.2.1.1 and earlier that allows attackers input parsed directly to the createfunction php function. A patch was issued that uses a whitelist regex expression to check the user supplied input before being parse...

Plone and Zope XMLTools Remote Command Execution

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p class in OFS/misc.py and the use of Python modules. Module Options msf use...

ScriptFTP 3.3 - Remote Buffer Overflow (Metasploit)

Exploit Title: ScriptFTP 3.3 Remote Buffer Overflow MSF Date: Sept 20 2011 Author: otoy Version: 3.3 Tested on: Windows XP SP3 CVE : - EDB-ID: 17876 Thanks: cyb3r.anbu, spentera-team, dE-team, offsec, exploit-db, corelanc0d3r class Metasploit3 'ScriptFTP 3.3 Remote Buffer Overflow', 'Description'...

CyberLink Power2Go name Attribute (p2g) Stack Buffer Overflow Exploit

This module exploits a stack buffer overflow in CyberLink Power2Go version 8.x The vulnerability is triggered when opening a malformed p2g file containing an overly long string in the 'name' attribute of the file element. This results in overwriting a structured exception handler record. Module...

Free MP3 CD Ripper 1.1 WAV File Stack Buffer Overflow

This module exploits a stack based buffer overflow found in Free MP3 CD Ripper 1.1. The overflow is triggered when an unsuspecting user opens a malicious WAV file. Module Options msf use exploit/windows/fileformat/free/mp3ripperwav msf undefinedmp3ripperwav show actions ...actions... msf...

CA Arcserve D2D GWT RPC Credential Information Disclosure

This module exploits an information disclosure vulnerability in the CA Arcserve D2D r15 web server. The information disclosure can be triggered by sending a specially crafted RPC request to the homepage servlet. This causes CA Arcserve to disclosure the username and password in cleartext used for...

CA Arcserve D2D - GWT RPC Credential Information Disclosure (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'CA Arcserve D2D GWT RPC Credential Information Disclosure', 'Description' = %q This module exploits an information disclosure...

Avaya WinPMD UniteHostRouter Buffer Overflow

This module exploits a stack buffer overflow in Avaya WinPMD. The vulnerability exists in the UniteHostRouter service, due to the insecure usage of memcpy when parsing specially crafted "To:" headers. The module has been tested successfully on Avaya WinPMD 3.8.2 over Windows XP SP3 and Windows 20...

SPlayer 3.7 Buffer Overflow

!/usr/bin/python Exploit Title: SPlayer Software Link: http://www.splayer.org/index.en.html Versions: URL ctrl+u ... 3. Input the server URL and Click OK ... 4. Boom!/calc ... Method 2: 1. Execute this script ... 2. Launch SPlayer and click Open ctrl+o ... 3. Browse to any playlist file m3u, pls ...

ISC DHCP Zero Length ClientID Denial of Service Module

This module performs a Denial of Service Attack against the ISC DHCP server, versions 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1. It sends out a DHCP Request message with a 0-length clientid option for an IP address on the appropriate range for the dhcp server. When ISC DHCP Server tries to hash...

Log1 CMS writeInfo() PHP Code Injection

This module exploits the "Ajax File and Image Manager" component that can be found in log1 CMS. In function.base.php of this component, the 'data' parameter in writeInfo allows any malicious user to have direct control of writing data to file data.php, which results in arbitrary remote code...