CVE-2021-26551

An issue was discovered in SmartFoxServer 2.17.0. An attacker can execute arbitrary Python code, and bypass the javashell.py protection mechanism, by creating /config/ConsoleModuleUnlock.txt and editing /config/admin/admintool.xml to enable the Console module...

CVE-2021-26551

SmartFoxServer 2.17.0 is affected by CVE-2021-26551, allowing an attacker to execute arbitrary Python code by enabling the Console module. The attack is carried out by creating /config/ConsoleModuleUnlock.txt and editing /config/admin/admintool.xml to bypass the javashell.py protection mechanism ...

CVE-2021-26550

CVE-2021-26550 affects SmartFoxServer 2X, specifically version 2.17.0. The issue enables cleartext password disclosure via the configuration file /config/server.xml. The root cause, as described in multiple sources, is that sensitive information is stored in an unencrypted XML file, allowing a lo...

CVE-2021-26550

An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml...

CVE-2021-26549

An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site...

CVE-2021-26549

CVE-2021-26549 : SmartFoxServer 2X/2.17.0 exposes a cross-site scripting vulnerability in the AdminTool console where input is not properly sanitized before reflection. This enables an attacker to inject arbitrary HTML/JS that can execute in a user’s browser within the context of the affected sit...

CVE-2021-26550: Cleartext Storage of Sensitive Information

An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml...

CVE-2021-26551: Improper Control of Generation of Code

An issue was discovered in SmartFoxServer 2.17.0. An attacker can execute arbitrary Python code, and bypass the javashell.py protection mechanism, by creating /config/ConsoleModuleUnlock.txt and editing /config/admin/admintool.xml to enable the Console module...

CVE-2021-26549: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site...

PT-2021-17032

Name of the Vulnerable Software and Affected Versions SmartFoxServer version 2.17.0 Description An issue in SmartFoxServer allows cleartext password disclosure via the "config/server.xml" file, which is accessible through the "/config/server.xml" API endpoint. Recommendations For SmartFoxServer...

PT-2021-17033

Name of the Vulnerable Software and Affected Versions SmartFoxServer version 2.17.0 Description An issue allows an attacker to execute arbitrary Python code and bypass the javashell.py protection mechanism. This can be achieved by creating a file named /config/ConsoleModuleUnlock.txt and editing...

PT-2021-17031

Name of the Vulnerable Software and Affected Versions SmartFoxServer version 2.17.0 Description A cross-site scripting XSS issue was discovered. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code ...

SmartFoxServer 2X 2.17.0 - God Mode Console Remote Code Execution Exploit

Exploit Title: SmartFoxServer 2X 2.17.0 - God Mode Console Remote Code Execution Exploit Author: LiquidWorm Vendor Homepage: https://www.smartfoxserver.com Vendor: gotoAndPlay Product web page: https://www.smartfoxserver.com Affected version: Server: 2.17.0 Remote Admin: 3.2.6 SmartFoxServer 2X,...

SmartFoxServer 2X 2.17.0 Credential Disclosure

SmartFoxServer 2X 2.17.0 Credentials Disclosure Vendor: gotoAndPlay Product web page: https://www.smartfoxserver.com Affected version: Server: 2.17.0 Remote Admin: 3.2.6 SmartFoxServer 2X, Pro, Basic Summary: SmartFoxServer SFS is a comprehensive SDK for rapidly developing multiplayer games and...

SmartFoxServer 2X 2.17.0 Remote Code Execution

SmartFoxServer 2X 2.17.0 God Mode Console Remote Code Execution Vendor: gotoAndPlay Product web page: https://www.smartfoxserver.com Affected version: Server: 2.17.0 Remote Admin: 3.2.6 SmartFoxServer 2X, Pro, Basic Summary: SmartFoxServer SFS is a comprehensive SDK for rapidly developing...

SmartFoxServer security vulnerabilities

SmartFoxServer is a software development program for rapid development of multiplayer games and applications via Adobe Flash/Flex/Air, Unity, HTML5, iOS, Universal Windows Platform, Android, Java, C ++, etc. SmartFoxServer is a software development program from SmartFoxServer, USA. The software...

GotoAndPlay SNC SmartFoxServer Cross-Site Scripting Vulnerability

GotoAndPlay SNC SmartFoxServer is a development tool from GotoAndPlay SNC, USA. It provides rapid development of multiplayer games and applications. A cross-site scripting vulnerability exists in SmartFoxServer version 2.17.0. The vulnerability stems from a lack of proper validation of client-sid...

SmartFoxServer code injection vulnerability

SmartFoxServer is a software development program for rapid development of multiplayer games and applications via Adobe Flash/Flex/Air, Unity, HTML5, iOS, Universal Windows Platform, Android, Java, C ++, etc. SmartFoxServer is a software development program from SmartFoxServer, USA. The software...

SmartFoxServer 2X 2.17.0 - Credentials Disclosure Vulnerability

Exploit Title: SmartFoxServer 2X 2.17.0 - Credentials Disclosure Exploit Author: LiquidWorm Vendor Homepage: https://www.smartfoxserver.com SmartFoxServer 2X 2.17.0 Credentials Disclosure Vendor: gotoAndPlay Product web page: https://www.smartfoxserver.com Affected version: Server: 2.17.0 Remote...

SmartFoxServer 2X 2.17.0 - God Mode Console WebSocket XSS

Exploit Title: SmartFoxServer 2X 2.17.0 - God Mode Console WebSocket XSS Date: 29.01.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.smartfoxserver.com Vendor: gotoAndPlay Product web page: https://www.smartfoxserver.com Affected version: Server: 2.17.0 Remote Admin: 3.2.6...