vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload', 'Description' = %q vTiger CRM allows an user to...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload Vulnerability

vTiger CRM allows an user to bypass authentication when requesting SOAP services. In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP service. By combining both vulnerabilities an attacker can upload and execute PHP code. This Metasploit module has been tested...

IBM Forms Viewer Unicode Buffer Overflow

This Metasploit module exploits a stack-based buffer overflow in IBM Forms Viewer. The vulnerability is due to a dangerous usage of strcpy-like function, and occurs while parsing malformed XFDL files, with a long fontname value. This Metasploit module has been tested successfully on IBM Forms...

SerComm Device Configuration Dump

This module will dump the configuration of several SerComm devices. These devices typically include routers from NetGear and Linksys. This module was tested successfully against the NetGear DG834 series ADSL modem router. Module Options msf use auxiliary/admin/misc/sercomm/dumpconfig msf...

SerComm Network Device Backdoor Detection

This module can identify SerComm manufactured network devices which contain a backdoor, allowing command injection or account disclosure. Module Options msf use auxiliary/scanner/misc/sercomm/backdoorscanner msf undefinedbackdoorscanner show actions ...actions... msf undefinedbackdoorscanner set...

RealPlayer RMP File Version Attribute Buffer Overflow

Added: 12/27/2013 CVE: CVE-2013-6877 BID: 64398 OSVDB: 101356 Background RealNetworks RealPlayer includes an embedded player which plays media embedded in a web page. Problem RealNetworks Windows RealPlayer 17.0.2.206 and earlier versions are vulnerable to remote code execution due to improper...

HP SiteScope 'issueSiebelCmd' SOAP请求远程代码执行漏洞

BUGTRAQ ID: 63478 CVECAN ID: CVE-2013-4835 HP SiteScope是无代理监控软件，可维护其分布式IT基础架构的可用性和性能。 HP SiteScope 11.22之前版本在处理"issueSiebelCmd" SOAP请求的实现上存在安全漏洞，成功利用后可导致执行任意代码。 0 HP SiteScope 11.22 厂商补丁： HP -- HP已经为此发布了一个安全公告（HPSBMU02933）以及相应补丁: HPSBMU02933：HP SiteScope, issueSiebelCmd SOAP Request, Remote Code...

openSIS "modname" PHP代码注入漏洞

CVECAN ID: CVE-2013-1349 openSIS是开源学生信息系统。 openSIS 5.2版本没有正确过滤ajax.php内的"modname"参数值，可导致注入和执行任意PHP代码。 0 opensis opensis 5.2 厂商补丁： opensis ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.opensis.com/ openSIS: http://sourceforge.net/p/opensis-ce/bugs/59/ Egidio Romano:...

OpenSIS 'modname' PHP Code Execution Vulnerability

This Metasploit module exploits a PHP code execution vulnerability in OpenSIS versions 4.5 to 5.2 which allows any authenticated user to execute arbitrary PHP code under the context of the web-server user. The 'ajax.php' file calls 'eval' with user controlled data from the 'modname' parameter. Th...

HP LoadRunner Virtual User Generator EmulationAdmin service directory traversal

Added: 12/18/2013 CVE: CVE-2013-4837 BID: 63475 OSVDB: 99231 Background HP LoadRunner is a software performance testing solution. Problem A directory traversal vulnerability in the Virtual User Generator EmulationAdmin service allows remote attackers to upload files to arbitrary locations using t...

ICS-CERT Warns of Flaw in Wind Farm Management App

The ICS-CERT is warning users about a reflected cross-site scripting vulnerability in a control interface for a wind-farm control portal manufactured by Nordex. The bug is remotely exploitable and could enable an attacker to run code on a vulnerable machine. The Nordex NC2 is a control portal for...

Nvidia (nvsvc) Display Driver Service Local Privilege Escalation

Exploit for windows platform in category local exploits require 'msf/core' require 'rex' require 'msf/core/post/common' require 'msf/core/post/windows/priv' require 'msf/core/post/windows/process' require 'msf/core/post/windows/reflectivedllinjection' require 'msf/core/post/windows/services' clas...

Microsoft Windows ndproxy.sys Local Privilege Escalation

Exploit for windows platform in category local exploits require 'msf/core' require 'rex' class Metasploit3 'Microsoft Windows ndproxy.sys Local Privilege Escalation', 'Description' = %q This module exploits a flaw in the ndproxy.sys driver on Windows XP SP3 and Windows 2003 SP2 systems, exploited...

IBM Forms Viewer栈缓冲区溢出漏洞

CVECAN ID: CVE-2013-5447 IBM Forms Viewer是其中的一个客户端程序，它能够打开、填写、签署、提交和保存XFDL表单，可作为独立的应用程序或以嵌入在Web浏览器内的方式显示表单。 IBM Forms Viewer 4.0.0.3之前的4.x版本和8.0.1.1前的8.x版本中存在基于栈的缓冲区溢出漏洞。远程攻击者可借助特制的XFDL表单利用该漏洞执行任意代码。 0 IBM Forms Viewer 4.0 IBM Forms Viewer 4.0.0.1 IBM Forms Viewer 4.0.0.2 IBM Forms Viewer 8.0 IBM...

vBulletin 5 - 'index.php/ajax/api/reputation/vote?nodeid' SQL Injection (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection', 'Description' = %q This module exploits a SQL injection...

vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection

Exploit for php platform in category remote exploits require 'msf/core' class Metasploit3 'vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection', 'Description' = %q This module exploits a SQL injection vulnerability found in vBulletin 5 that has been used in the wild since...

ElasticSearch Dynamic Script Arbitrary Java Execution

This module exploits a remote command execution RCE vulnerability in ElasticSearch, exploitable by default on ElasticSearch prior to 1.2.0. The bug is found in the REST API, which does not require authentication, where the search function allows dynamic scripts execution. It can be used for remot...

osCmax e-Commerce 2.5.3 Cross Site Scripting / Shell Upload

Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail : submitat1337day.com 1 0 0 1 1 0 I'm KedAns-Dz member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Title : osCmax...

Eaton Network Shutdown Module 3.21 PHP Code Injection

Eaton Network Shutdown module versions 3.21 and below suffer from a remote PHP code injection vulnerability. This is a python exploit for a previously disclosed finding. !/usr/bin/env python Quick 'n' Dirty - Metasploit module didn't do it for me 2013 - Filip Waeytens - http://www.wsec.be Usage...

Eaton Network Shutdown Module 3.21 - Remote PHP Code Injection

!/usr/bin/env python Quick 'n' Dirty - Metasploit module didn't do it for me 2013 - Filip Waeytens - http://www.wsec.be Usage Example: $ python eaton.py 192.168.1.9 "net user" User accounts for \ ------------------------------------------------------------------------------- Guest LocalAdmin The...