378 matches found
ipfire-2-25-auth-rce
Ipfire 2-25 core update 156 인증된 RCE 패킷 설치 시 시스템 명령 실행 시스템이 HTML만으로 7zip을 가져옴 그리고 tmp 디렉터리 확인 버전 2.25 - core update 156 ipfire는 로그인 후 nobody 권한으로 임의의 OS 명령 실행을 허용함 루트가 되자! SUID 바이너리 확인 백업 프로그램이 다른 스크립트를 실행함. /var/ipfire/backup/bin/backup.pl bash 스크립트이며 권한이 매우 좋아 보임 bash 스크립트에 쓰기를 시도함. 오류 없음. 좋음!...
CVE-2014-6271-IPFire
CVE-2014-6271 Реализация CVE-2014-6271 на Python: IP Fire =2.15 ShellShock RCE Основано на модуле Metasploit для той же уязвимости EDB ID: 34839 Эксплойт автоматический. Полный список параметров см. в ./CVE-2014-6271.py --help Предупреждение: Код в этом репозитории может использоваться только в...
IPFire_2.25_RCE_Authenticated
IPFire 2.25 원격 코드 실행 인증됨 - CVE-2021-33393 본 익스플로잇은 CVE-2021-33393 https://nvd.nist.gov/vuln/detail/CVE-2021-33393을 기반으로 하며, Mücahit Saratar https://github.com/KaanaryOverFlow/ipfire-2-25-auth-rce의 원본 익스플로잇을 확장하여 루트 권한으로 리버스 셸을 획득합니다. 사용법 리스너 시작: nc -lvnp 4444 익스플로잇 실행: python exploit.py...
IPFire_2.19_RCE_Authenticated
IPFire 2.19 OINKCODE RCE PoC Python-реализация PoC для аутентифицированной уязвимости внедрения команд на странице ids.cgi IPFire 2.19 через параметр OINKCODE. Только для авторизованного тестирования безопасности и учебных лабораторий. Запускайте этот PoC только против систем, которыми вы владеет...
Exploit for CVE-2021-33393
IPFire2.25RCEAuthenticated This exploit is based on CVE-202...
CVE-2019-25399
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...
CVE-2019-25400
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grpname, remark, SRVNAME, SRVPORT,...
CVE-2019-25399
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...
CVE-2019-25400
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grpname, remark, SRVNAME, SRVPORT,...
CVE-2019-25398
IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts through VPN configuration parameters. Attackers can submit POST requests with script payloads in parameters like VPNIP, DMTU, ccdname,...
CVE-2019-25398
IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts through VPN configuration parameters. Attackers can submit POST requests with script payloads in parameters like VPNIP, DMTU, ccdname,...
CVE-2019-25397
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the KEY1, IP, HOST, or DOM parameters to...
CVE-2019-25397
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the KEY1, IP, HOST, or DOM parameters to...
CVE-2019-25396
IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious scripts through POST parameters. Attackers can submit crafted requests with script payloads in the MAXDISKUSAGE or MAXDOWNLOADRATE paramete...
CVE-2019-25396
IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious scripts through POST parameters. Attackers can submit crafted requests with script payloads in the MAXDISKUSAGE or MAXDOWNLOADRATE paramete...
CVE-2019-25400 IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grpname, remark, SRVNAME, SRVPORT,...
CVE-2019-25400
CVE-2019-25400 affects IPFire 2.21 Core Update 127. The vulnerabilities are multiple reflected XSS in the fwhosts.cgi script, exploitable via numerous parameters (e.g., HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp_name, remark, SRV_NAME, SRV_PORT, SRVGRP_NAME, SRVGRP_REMARK, updatesr...
CVE-2019-25400 IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grpname, remark, SRVNAME, SRVPORT,...
CVE-2019-25399 IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...
CVE-2019-25399 IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...