3110 matches found
Quantum vmPRO Backdoor Command
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class Metasploit3 "Quantum vmPRO Backdoor Command", 'Description' = %q This module abuses a backdoor command in vmPRO 3.1.2. Any user,...
QNX 6.x phgrafx File Enumeration
QNX 6.x phgrafx file enumeration vulnerability by cenobyte 2013 - vulnerability description: QNX setuid root /usr/photon/bin/phgrafx allows any non-root user to enumerate files and directories due to opendir messages. - vulnerable platforms: QNX 6.5.0SP1 QNX 6.5.0 QNX 6.4.1 QNX 6.3.0 QNX 6.2.0 -...
Joomla 3.2.1 /index.php SQL注入漏洞
No description provided by source...
大汉xxgk（政府信息公开）系统某处越权+getshell
简要描述： 政府信息公开系统的getshell。和前两天发的那个拿shell方式是不一样的。 详细说明： 越权发生在setup/oprsetting.jsp 拿shell是在上传license文件的jsp中setup/oprlicenceinfo.jsp 漏洞证明： 此时已经将setup的登录密码清空。（有风险，请勿随意尝试，不要跟着我犯错……） 提交数据的时候清空密码即可登录成功 img src="https://images.seebug.org/upload/201403/032350491567f745ccbf670be2346bb5147a9878.png"...
程氏舞曲 Sql一枚 依旧无视Gpc。
简要描述： 程氏CMSV3.5 正式版 更新时间：2014-02-18 下载次数：13145 表示下载的这个 是最新的了把? 无需登录 无视Gpc。 详细说明： 在app/controllers/zj.php中 public function so $data='';$datacontent=''; $fid = $this-security-xssclean$this-uri-segment3; //方式 $key = $this-security-xssclean$this-uri-segment4; //关键字 $page =...
IBM BPMS 8.0.0.1 Privilege Escalation / Disclosure
IBM BPMS version 8.0.0.1 suffers from account reconfiguration, privilege escalation, and information disclosure vulnerabilities. Exploit Title: IBM BPMS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link:...
SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write
This module exploits a remote arbitrary file write vulnerability in SolidWorks Workgroup PDM 2014 SP2 and prior. For targets running Windows Vista or newer the payload is written to the startup folder for all users and executed upon next user logon. For targets before Windows Vista code execution...
ThinkSAAS逻辑漏洞可致拖库
简要描述： ThinkSAAS的一个逻辑漏洞导致可以实时备份网站数据库，同时可以获取备份数据库文件名。 下载实时备份的数据库实现脱裤。漏洞影响所有版本。 详细说明： thinksaas系统使用常量INTS来控制页面的访问，然后在每个功能模块用一句代码： defined'INTS' or die'Access Denied.'; 来限制访问，这样设计带来的问题是，一个文件包含可以通杀，越权访问执行任意功能模块。 看到/app/user/action/plugin.php代码： fetchallassoc"SHOW TABLES"; foreach$arrTables as $key=$it...
D-Link DIR-615 vE4 Firmware 5.10 - Cross-Site Request Forgery
D-Link DIR-615 vE4 Firmware 5.10 - Cross-Site Request Forgery Exploit Title: Dlink DIR-615 Hardware Version E4 Firmware Verion 5.10 CSRF Vulnerability Google Dork: N/A Date: 19/02/2014 Exploit Author: Dhruv Shah Vendor Homepage:...
D-link router CSRF exploit detailed explanation-vulnerability warning-the black bar safety net
A, introduction The purpose of this article is to demonstrate a CSRF vulnerability in D-link DIR-6 0 0 router-hardware version: BX firmware version: 2.16-CSRF vulnerability, for example. D-link CSRF vulnerability is already disclosed herein will be described in detail at the entire D-link CSRF...
VLC 2.1.2 (.asf) - Crash PoC
Exploit for multiple platform in category dos / poc !/usr/bin/python VLC Media Player up to 2.1.2 DOS POC Integer Division By zero in ASF Demuxer VLC Media Player is prone to DOS utilizing a division by zero error if minimium data packet size is equal to zero. this was tested on windows XP sp3 an...
Job Site 1.0 - Multiple Vulnerabilities
Job Site 1.0 - Multiple Vulnerabilities Jobsite logo - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...
IBM Business Process Manager - User Account Reconfiguration
Exploit Title: IBM BMPS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link: http://www-03.ibm.com/software/products/en/business-process-manager-family/ Version: 8.0.1.1 newest versions can also be vulnerable Vulnerability...
Eventy Online Scheduler V1.8 - Multiple Vulnerabilties
Eventy Online Scheduler version 1.8 suffers from cross site request forgery, cross site scripting, and remote SQL injection vulnerabilities. Eventy Online Scheduler V1.8 - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:...
Adult WebMaster PHP - Password Disclosure
Adult WebMaster PHP - Password Disclosure + Exploit:Adult Webmaster PHP - Password Disclosure + Author: vinicius777 + Email/Twitter: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/adultweb/ 1 Administrative Credential Disclosure PoC: root@kali:/ curl...
Adult Webmaster PHP - Password Disclosure Vulnerbility
Exploit for php platform in category web applications + Exploit:Adult Webmaster PHP - Password Disclosure + Author: vinicius777 + Email/Twitter: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/adultweb/ 1 Administrative Credential Disclosure PoC:...
PHPYUN逻辑错误无限刷积分
简要描述： PHPYUN逻辑错误无限积分所以标题党了一下！ 详细说明： 逻辑错误 未对用户输入严格过滤！ 问题发生在 member/model/com.class.php 1158行 $integral=$this-config"integralcomcomments"$POST'time'; ..... if$statis"integral"obj-ACTmsg"index.php?C=pay","你的".$this-config"integralpricename"."不足，请先充值";...
PHPYUN会员中心之外的模块可伪造任意用户登录
简要描述： 任意用户登录 详细说明： 之前看到一个cookie里面的uid 都可以做任意文件删除。 那么 肯定cookie没有效验合法性于是review代码 发现直接设置cookie可以登录用户 并且具有一定的权限（非member模块均有权限） 漏洞证明： 在网站提问区找一个ID 设置cookieuidcookieusernamecookieusertype 访问会员中心会提示登录 但是到提问板块 成功伪造用户提交一个问答 在测试一下邀请面试 可以邀请 不过没有分。。 其他地方应该还有 我就不一一列举了！...
PHPJabbers Hotel Booking System V3.0 - Multiple Vulnerabilties
Exploit for php platform in category web applications Hotel Booking System V3.0 - Multiple Vulnerabilties ==================================================================== .:. Author : HackXBack .:. Contact : email protected .:. Home : http://www.iphobos.com/blog/ .:. Script :...