Drupal (SA-CORE-2019-008) Wordspaces Extension Access Bypass PoC

PenTestIT RSS Feed Last week, an advisory SA-CORE-2019-008 addressing a Drupal access bypass vulnerability was made public. MITRE assigned CVE-2019-6342 to this critical vulnerability. This is post to document the steps I took to create a PoC for SA-CORE-2019-008. Last such post on this blog was...

Web Ofisi Firma Rehberi 1 SQL Injection

Exploit Title: Web Ofisi Firma Rehberi 1 - 'il' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html Demo Site: http://demobul.net/firma-rehberi-v1/ Version: v1 Tested on: Kali Linux CVE: N/A ----- PoC: SQLi -----...

Web Ofisi Firma Rehberi 1 - il SQL Injection

Web Ofisi Firma Rehberi 1 - il SQL Injection Exploit Title: Web Ofisi Firma Rehberi 1 - 'il' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html Demo Site: http://demobul.net/firma-rehberi-v1/ Version: v1 Tested on...

Web Ofisi Rent a Car 3 - klima SQL Injection

Web Ofisi Rent a Car 3 - klima SQL Injection Exploit Title: Web Ofisi Rent a Car 3 - 'klima' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/rent-a-car-v3.html Demo Site: http://demobul.net/rentacarv3/ Version: v3 Tested on: Kali Linux CVE:...

Web Ofisi Firma 13 - oz SQL Injection

Web Ofisi Firma 13 - oz SQL Injection Exploit Title: Web Ofisi Firma 13 - 'oz' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/kurumsal-firma-v13-sinirsiz-dil.html Demo Site: http://demobul.net/firmav13/ Version: v13 Tested on: Kali Linux...

Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection

Exploit Title: Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/platinum-e-ticaret-v5.html Demo Site: http://demobul.net/eticaretv5/ Version: v5 Tested on: Kali Linux CVE: N/A ----- PoC 1: SQLi -----...

Web Ofisi Emlak 2 - (ara) SQL Injection Vulnerability

Exploit for linux platform in category web applications Exploit Title: Web Ofisi Emlak 2 - 'ara' SQL Injection Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/emlak-scripti-v2.html Demo Site: http://demobul.net/emlakv2/ Version: v2 Tested on: Kali Linux CVE: N/A ----- Po...

Web Ofisi Firma Rehberi 1 - (il) SQL Injection Vulnerability

Exploit for linux platform in category web applications Exploit Title: Web Ofisi Firma Rehberi 1 - 'il' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html Demo Site: http://demobul.net/firma-rehberi-v1/ Version: v...

Web Ofisi Platinum E-Ticaret 5 - (q) SQL Injection Vulnerability

Exploit for linux platform in category web applications Exploit Title: Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/platinum-e-ticaret-v5.html Demo Site: http://demobul.net/eticaretv5/ Version: v5 Tested on: Kali Linu...

Web Ofisi Emlak 2 SQL Injection

Exploit Title: Web Ofisi Emlak 2 - 'ara' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/emlak-scripti-v2.html Demo Site: http://demobul.net/emlakv2/ Version: v2 Tested on: Kali Linux CVE: N/A ----- PoC: SQLi ----- Request:...

Microsoft Windows 10 1903/1809 - RPCSS Activation Kernel Security Callback Privilege Escalation

Windows: RPCSS Activation Kernel Security Callback EoP Platform: Windows 10 1903/1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The RPCSS Activation Kernel RPC server’s security callback can be bypassed resulti...

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation Windows: RPCSS Activation Kernel Security Callback EoP Platform: Windows 10 1903/1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User...

Docker Privileged Container Escape

This module escapes from a privileged Docker container and obtains root on the host machine by abusing the Linux cgroup notification on release feature. This exploit should work against any container started with the following flags: --cap-add=SYSADMIN, --privileged. Module Options msf use...

Huawei HG530 Reboot / Restore Authentication Bypass

Huawei HG530 Multiple Unauthenticated reboot and restore Vulnerability =========================== The Huawei HG530 suffers from multiple Unauthenticated reboot and restore vulnerability allows local attackers to reboot the device or to restore to factory Configuration without user interaction...

WP Code Highlight.js < 0.6.3 - CSRF to Stored XSS

Lack of CSRF checks could allow attackers to make a logged in admin create XSS payloads. PoC...

MAPLE Computer WBT SNMP Administrator 2.0.195.15 Buffer Overflow

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAPLE-WBT-SNMP-ADMINISTRATOR-v2.0.195.15-REMOTE-BUFFER-OVERFLOW-CODE-EXECUTION-0DAY.txt + ISR: Apparition Security Vendor www.computerlab.com Product MAPLE Computer WBT SNMP...

Microsoft Windows - NtUserSetWindowFNID Win32k User Callback Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows NtUserSetWindowFNID Win32k User Callback', 'Description' = %q An elevation of privilege vulnerability exists in Windows when the Win32k...

Exploit for Injection in Atlassian Jira_Server

CVE-2019-11581 Atlassian JIRA Template injection vulnerabil...

CentOS Control Web Panel 0.9.8.836 Privilege Escalation

//====================================================================\ || || || CWP Control Web Panel 0.9.8.836 - 0.9.8.839 || || Root Privilege Escalation || || || \====================================================================//...

CVE-2019-1010034

Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" defined at databasecode.php line 1018 is vulnerable to a boolean-based blind sql injection. This function call can be triggered by...