Construtiva CIS Manager CMS POST SQLi

TL;DR; ====== . PRODUCT : Construtiva CIS Manager . TYPE : SQLi http://site/autenticar/lembrarlogin.asp POST email . CVE : CVE-2014-3749 Software Description ==================== . The CIS Manager platform is a complete and powerful tool to manage sites and corporative portals on the Internet. Th...

Yealink VoIP Phone SIP-T38G - Remote Command Execution

Title: Yealink VoIP Phone SIP-T38G Remote Command Execution Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5758 Description: Using cgiServer.exx we are able to send OS command using the...

Unrestricted Upload of File with Dangerous Type in BoltWire

High-Tech Bridge Security Research Lab discovered vulnerability in BoltWire, which can be exploited to execute arbitrary PHP code on the target system and gain complete control over vulnerable web application. 1 Unrestricted Upload of File with Dangerous Type in BoltWire: CVE-2014-4169 The...

Slack: SSRF on https://whitehataudit.slack.com/account/photo

During post request to https://whitehataudit.slack.com/account/photo: POST /account/photo HTTP/1.1 Host: whitehataudit.slack.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:29.0 Gecko/20100101 Firefox/29.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8...

Srun3000命令执行第5弹

简要描述： 第5弹 详细说明： 这回是post的命令执行而且需要注释掉后面的参数。 if $POST'act' == "auth" $command = "/srun3/radius/bin/radtest ".trim $POST'uname' ." ".trim $POST'pass' ." ".$array'serverip'." 10 ".$array'secret'; //后面注释掉就好 if $fp = popen $command, "r" //这里 $con = fread $fp, 10240 ; pclose $fp ; 漏洞证明：...

SQL Injection in Dolphin | HTB23216

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in Dolphin, which can be exploited to perform SQL injection attacks and obtain sensitive information from the application database. 1 SQL Injection in Dolphin: CVE-2014-3810 The vulnerability exists due to insufficient...

CVE-2014-2046 - Unauthenticated Credential And Configuration Retrieval In Broadcom Ltd PIPA C211

Vulnerability title: Unauthenticated Credential And Configuration Retrieval In Broadcom Ltd PIPA C211 CVE: CVE-2014-2046 Vendor: Broadcom Ltd Product: PIPA C211 Affected version: Soft Rev: SR1.1, HW Rev: PIPA C211 rev2 Fixed version: N/A Reported by: Jerzy Kramarz Details: By sending a crafted PO...

Beetel 450TC2 Router - Cross-Site Request Forgery (Admin Password)

docume...

Beetel 450TC2 Router - Cross-Site Request Forgery (Admin Password)

Beetel 450TC2 Router - Cross-Site Request Forgery Admin Password ​​ input type=...

StopTheHacker: Reflected cross site scripting in login page

It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. Once exploited It is possible to steal or manipulate a legitimate user’s session credentials including session cookies. Request ...

cFos Personal Net 3.09 - Remote Heap Memory Corruption (Denial of Service)

cFos Personal Net v3.09 Remote Heap Memory Corruption Denial of Service Vendor: cFos Software GmbH Product web page: https://www.cfos.de Affected version: 3.09 Summary: cFos Personal Net PNet is a full-featured HTTP server intended for personal and professional use. For personal use, instead of...

WordPress Work-The-Flow 1.2.1 Shell Upload

Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf upload panel and intercept the POST request to...

Wordpress Work-The-Flow Plugin 1.2.1 - Arbitrary File Upload

Exploit for php platform in category web applications Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf upload...

WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload

WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf...

WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload

Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf upload panel and intercept the POST request to...

Localize: Full Path Disclosure

Not my best piece of work, but the following file results in a full path disclosure if reviewphraseobject is given the wrong parameter. http://www.localize.io/review/3C/languages/5 POST...

Easytalk垂直权限问题（逻辑漏洞可提权getshell）

简要描述： Easytalk处理用户数据的时候未足够过滤，导致可以进行权限提升 详细说明： 晚上习惯性的打开代码分析分析函数，看到了这样一处 漏洞文件: /Easytalk/Home/Lib/Action/GuideAction.class.php //保存设置,注册用户时候，向导保存设置 public function doset $user=M'Users'; $userdata=$POST"user";//获取用户提交的所有数据 // ok，此处的用户userdata数据是来自post的，而并未过滤一些敏感字段 $userdata"nickname"=...

Xangati XSR / XNR - 'gui_input_test.pl' Remote Command Execution

source: https://www.securityfocus.com/bid/66819/info Xangati XSR And XNR are prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary commands in the context of the...

Quick.CMS 5.4 - Multiple Vulnerabilities

Exploit Title: QuickCms 5.4 Multiple Vulnerabilites Date: 04/08/2014 Author: shpendk Software Link: http://opensolution.org/download,en,18.html?sFile=Quick.Cms/Quick.Cmsv5.4.zip Version: 5.4 Tested on: Xampp on Windows Reflected XSS Vulnerability in Admin Area: Trigger:...

Joomla Pbbooking 2.4 Cross Site Scripting

Hello, Cross-site scripting XSS vulnerability in the Pbbooking 2.4 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via POST request to manage.php. POC: alert'XSS'" / Best regards...