Solarwinds Orion Service SQL Injection

I found a couple SQL injection vulnerabilities in the core Orion service used in most of the Solarwinds products SAM, IPAM, NPM, NCM, etc…. This service provides a consistent configuration and authentication layer across the products. To be exact, the vulnerable applications and versions are:...

Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation Exploit

This module exploits a stacked SQL injection in order to add an administrator user to the SolarWinds Orion database. Usage Info msf use auxiliary/gather/solarwindsorionsqli msf auxiliarysolarwindsorionsqli show actions ...actions... msf auxiliarysolarwindsorionsqli set ACTION msf...

Seagate Business NAS Unauthenticated Remote Command Execution Exploit

Some Seagate Business NAS devices are vulnerable to command execution via a local file include vulnerability hidden in the language parameter of the CodeIgniter session cookie. The vulnerability manifests in the way the language files are included in the code on the login page, and hence is open ...

PHPMoAdmin 1.1.2 Remote Code Execution

This module exploits an arbitrary PHP command execution vulnerability due to a dangerous use of eval in PHPMoAdmin. Module Options msf use exploit/multi/http/phpmoadmin/exec msf undefinedexec show actions ...actions... msf undefinedexec set ACTION msf undefinedexec show options ...show and set...

Seagate Business NAS Firmware Vulnerabilities Disclosed

Firmware running on certain Seagate network-attached storage devices that are popular with small businesses and home offices, are vulnerable to remote attacks. Researchers at Beyond Binary, a security consulting firm in Australia, on Sunday went public with their disclosure after a nearly...

Seagate NAS appears remote code execution vulnerability-vulnerability warning-the black bar safety net

Foreign security researcher OJ Reeves found the Seagate NAS one remote code execution vulnerability, and in the last year of the 1 0-month 7 Report to the official, but 1 3 0 days past the official still does not fix the vulnerability, so today he released the vulnerability details. ! Overview...

Persistent Systems Client Automation - Command Injection Remote Code Execution (Metasploit)

Persistent Systems Client Automation - Command Injection Remote Code Execution Metasploit Exploit Title: Persistent Systems Client Automation PSCA, formerly HPCA or Radia Command Injection Remote Code Execution Vulnerability Date: 2014-10-01 Exploit Author: Ben Turner Vendor Homepage: Previosuly...

Persistent Systems Client Automation - Command Injection Remote Code Execution (Metasploit)

Exploit Title: Persistent Systems Client Automation PSCA, formerly HPCA or Radia Command Injection Remote Code Execution Vulnerability Date: 2014-10-01 Exploit Author: Ben Turner Vendor Homepage: Previosuly HP, now http://www.persistentsys.com/ Version: 7.9, 8.1, 9.0, 9.1 Tested on: Windows XP,...

HP Client Automation Command Injection Exploit

This Metasploit module exploits a command injection vulnerability on HP Client Automation, distributed actually as Persistent Systems Client Automation. The vulnerability exists in the Notify Daemon radexecd.exe, which doesn't authenticate execution requests by default neither. This Metasploit...

D-Link/TRENDnet - NCC Service Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'D-Link/TRENDnet NCC Service Command Injection', 'Description' = %q This module exploits a remote command injection vulnerabilit...

Printer File Deletion Scanner

This module deletes a file on a set of printers using the Printer Job Language PJL protocol. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "rex/proto/pjl" class MetasploitModule "Printer File Deletion...

WordPress Holding Pattern Theme Arbitrary File Upload

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'socket' class Metasploit3 'WordPress Holding Pattern Theme Arbitrary File Upload', 'Description' = %q This module exploits a file upload...

Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation

This module exploits a stacked SQL injection in order to add an administrator user to the SolarWinds Orion database. Module Options msf use auxiliary/gather/solarwinds/orionsqli msf undefinedorionsqli show actions ...actions... msf undefinedorionsqli set ACTION msf undefinedorionsqli show options...

HP Client - Automation Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'HP Client Automation Command Injection', 'Description' = %q This module exploits a command injection vulnerability on HP Client...

WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner

This module attempts to exploit a UNION-based SQL injection in Contus Video Gallery for Wordpress version 2.7 and likely prior in order if the instance is vulnerable. Module Options msf use auxiliary/scanner/http/wp/contusvideogallerysqli msf undefinedcontusvideogallerysqli show actions...

WordPress Admin Shell Upload

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' class Metasploit3 'WordPress Admin Shell Upload', 'Description' = %q This module will generate a plugin, pack the payload into it...

Zabbix 2.0.5 Password Disclosure

This module requires Metasploit Date: 25-09-2013 Author: Pablo González Vendor Homepage: Zabbix - http://www.zabbix.com Software Link: http://www.zabbix.com Version: 2.0.5 Tested On: Linux Ubuntu, Suse, CentOS CVE: CVE-2013-5572 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5572 More Inf...

Zabbix 2.0.5 - Cleartext ldap_bind_password Password Disclosure (MSF) Exploit

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldapbindpassword value in the HTML source code. This module requires Metasploit Date: 25-09-2013 Author: Pablo González Vendor Homepage: Zabbix -...

Zabbix 2.0.5 - Cleartext ldap_bind_Password Password Disclosure (Metasploit)

Zabbix 2.0.5 - Cleartext ldapbindPassword Password Disclosure Metasploit This module requires Metasploit Date: 25-09-2013 Author: Pablo González Vendor Homepage: Zabbix - http://www.zabbix.com Software Link: http://www.zabbix.com Version: 2.0.5 Tested On: Linux Ubuntu, Suse, CentOS CVE:...

D-Link DCS-931L File Upload

This module exploits a file upload vulnerability in D-Link DCS-931L network cameras. The setFileUpload functionality allows authenticated users to upload files to anywhere on the file system, allowing system files to be overwritten, resulting in execution of arbitrary commands. This module has be...