SA-CONTRIB-2010-088 - Content Construction Kit (CCK) - Access Bypass

The Content Construction Kit CCK project is a set of modules that allows you to add custom fields to nodes using a web browser. The CCK "Node Reference" module provides a backend URL that is used for asynchronous requests by the "autocomplete" widget to locate nodes the user can reference. In som...

SopCast 3.2.9 - Remote Command Execution

SopCast 3.2.9 - Remote Command Execution Sopcast POC by Sud0 Tested on XP SP3 EN on VBox with IE 7 Spraying a lot to get a nice unicode usable address 0x20260078 I sprayed with a set of P/P/R instructions to come back to the stack Need internet connection on the box to trigger the vuln Wait for t...

SopCast 3.2.9 - Remote Command Execution

Sopcast POC by Sud0 Tested on XP SP3 EN on VBox with IE 7 Spraying a lot to get a nice unicode usable address 0x20260078 I sprayed with a set of P/P/R instructions to come back to the stack Need internet connection on the box to trigger the vuln Wait for the Spray to finish IE will seem freezed f...

Quick N Easy FTP Server 3.9.1 Buffer Overflow

Software: Quick Easy FTP Server =3.9.1 Vulnerability Published :2010-07-22 Vulnerability Update Time :2010-07-25 Vendor: No vendor response Impact: Low Bug Description: Quick Easy FTP Server does not validate the USER command input size leading to a Denial Of Service flaw while sending more than...

Quick Easy FTP Server USER command Vulnerability

Software: Quick Easy FTP Server =3.9.1 Vulnerability Published :2010-07-22 Vulnerability Update Time :2010-07-25 Vendor: No vendor response Impact: Low Bug Description: Quick Easy FTP Server does not validate the USER command input size leading to a Denial Of Service flaw while sending more than...

FathFTP 1.8 - 'DeleteFile Method' ActiveX Buffer Overflow (SEH)

' Exploit Title: FathFTP 1.8 SEH DeleteFile ActiveX Buffer Overflow ' Author: MadjiX ' Software Link: http://www.fathsoft.com/fathftp.html ' Version 1.7 : http://www.exploit-db.com/exploits/14269/ Thanks Blake ' RasIsConnected 1.8 : http://www.exploit-db.com/exploits/14539/ ' Tested on: Windows X...

FathFTP 1.8 - 'EnumFiles Method' ActiveX Buffer Overflow (SEH)

' Exploit Title: FathFTP 1.8 SEH EnumFiles ActiveX Buffer Overflow ' Author: MadjiX ' Software Link: http://www.fathsoft.com/fathftp.html ' Version 1.7 : http://www.exploit-db.com/exploits/14269/ Thanks Blake ' RasIsConnected 1.8 : http://www.exploit-db.com/exploits/14539/ ' Tested on: Windows XP...

Amazon S3 Information Disclosure

I'm not sure if this is the right channel, but I stumbled upon this while trying to manage some of my own files. Although I didn't to get anything further than a list, I'm guessing there's a lot more than could be done. This is an Amazon S3 bucket exploit/bug. Requirement: Have an amazon s3 accou...

SigPlus Pro 3.74 Buffer Overflow

!-- =================================================================================================== SigPlus Pro v3.74 ActiveX Signature Capture LCDWriteString Remote BoF JIT Spray - aslr/dep bypass Author: mrme - @StevenSeeley Download:...

Xerver 4.32 Source Disclosure and HTTP Authentication Bypass

No description provided by source. Exploit Title: Xerver Source Disclosure and HTTP Auth Bypass Date: 01 Aug 2010 Author: Ben Schmidt aka supernothing Software: http://www.javascript.nu/xerver/ Version: 4.32 and prior Tested on: Windows XP SP3 CVE: N/A This file is derived from part of the...

WEBANDHOST CMS SQL Injection Vulnerability

Exploit for php platform in category web applications ========================================== WEBANDHOST CMS SQL Injection Vulnerability ========================================== Exploit Title: WEBANDHOST CMS SQL Injection Vulnerability Author: H-SK33PY Software Link: http://www.webandhost.de...

SigPlus Pro 3.74 - ActiveX 'LCDWriteString()' Remote Buffer Overflow JIT Spray (ASLR + DEP Bypass)

!-- =================================================================================================== SigPlus Pro v3.74 ActiveX Signature Capture LCDWriteString Remote BoF JIT Spray - aslr/dep bypass Author: mrme - @StevenSeeley Download:...

TYPO3 Security Bulletin

It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Broken Access Control. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.1.0 till 4.8.0 including Vulnerability Type: Broken Access...

XAOS CMS SQL Injection

Exploit Title: XAOS CMS SQL Injection Vulnerability Date: 25/07/2010 Author: H-SK33PY Software Link: http://www.xaos.it/ Version: N/A Google dork : Powered by XAOS systems Platform / Tested on: linux Category: webapplications Code : SQLi & BSQLi...

XAOS systems SQL Injection Vulnerability

Exploit for php platform in category web applications ======================================== XAOS systems SQL Injection Vulnerability ======================================== Date: 25/07/2010 Author: H-SK33PY Software Link: http://www.xaos.it/ Version: N/A Google dork : Powered by XAOS systems...

XAOS CMS - SQL Injection

XAOS CMS - SQL Injection Exploit Title: XAOS CMS SQL Injection Vulnerability Date: 25/07/2010 Author: H-SK33PY Software Link: http://www.xaos.it/ Version: N/A Google dork : Powered by XAOS systems Platform / Tested on: linux Category: webapplications Code : SQLi & BSQLi...

XAOS CMS - SQL Injection

Exploit Title: XAOS CMS SQL Injection Vulnerability Date: 25/07/2010 Author: H-SK33PY Software Link: http://www.xaos.it/ Version: N/A Google dork : Powered by XAOS systems Platform / Tested on: linux Category: webapplications Code : SQLi & BSQLi...

vBulletin 3.8.6 faq.php Information Disclosure Vulnerability

Exploit for php platform in category web applications =============================================================== vBulletinR 3.8.6 faq.php Information Disclosure Vulnerability ===============================================================...

vBulletin 3.8.6 - 'faq.php' Information Disclosure

010101010101010101010101010101010101010101010101010101010 0 0 1 Iranian Datacoders Security Team 2010 0 0 010101010101010101010101010101010101010101010101010101010 Original Advisory: http://forum.intern0t.net/exploits-vulnerabilities-pocs/2857-vbulletin-3-8-6-critical-information-disclosure.html...

WordPress Plugin myLDlinker SQL Injection

010101010101010101010101010101010101010101010101010101010 0 0 1 Iranian Datacoders Security Team 2010 0 0 010101010101010101010101010101010101010101010101010101010 Exploit Title: Word Press SQL Injection in myLDlinker.php Plugin Date: 23/07/2010 Author: H-SK33PY Software Link:...