CVE-2008-3903: Exposure of Sensitive Information to an Unauthorized Actor

Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and C.2.x.x before C.2.3.3; s800i 1.3.x before 1.3.0.2; and Trixbox PBX 2.6.1, when Digest authentication and authalwaysreje...

trixbox261-pwn.txt

!/usr/bin/python TrixBox 2.6.1 langChoice remote root exploit muts from offensive-security.com chris from offensive-security.com All credits to Jean-Michel BESNARD Same same, but different. http://www.offensive-security.com/0day/trixbox.py.txt id uid=0root gid=0root...

trixbox 2.6.1 (langChoice) Remote Root Exploit (py)

No description provided by source. !/usr/bin/python TrixBox 2.6.1 langChoice remote root exploit muts from offensive-security.com chris from offensive-security.com All credits to Jean-Michel BESNARD [email protected] Same same, but different. http://www.offensive-security.com/0day/trixbox.py.tx...

Fonality trixbox 2.6.1 - langChoice Remote Code Execution (Python)

Fonality trixbox 2.6.1 - langChoice Remote Code Execution Python !/usr/bin/python TrixBox 2.6.1 langChoice remote root exploit muts from offensive-security.com All credits to Jean-Michel BESNARD Same same, but different. http://www.offensive-security.com/0day/trixbox.py.txt id uid=0root gid=0root...

trixbox 2.6.1 (langChoice) Remote Root Exploit (py)

Exploit for linux platform in category remote exploits =================================================== trixbox 2.6.1 langChoice Remote Root Exploit py =================================================== !/usr/bin/python TrixBox 2.6.1 langChoice remote root exploit muts from...

trixbox-lfi.txt

I have discovered a file inclusion in Trixbox that may be exploited to run arbitrary code and eventually obtain a root shell. The vendor Fonality has been noticed about this issue. They have fixed it and shall release a patch this week. I have already posted an exploit giving a shell with...

trixbox (langChoice) Local File Inclusion Exploit (connect-back)

No description provided by source. !/usr/bin/perl -w Jean-Michel BESNARD - LEXSI Audit 2008-07-08 perl trixboxfi.pl 192.168.1.212 Please listen carefully as our menu option has changed Choose from the following options: 1 Remote TCP shell 2 Read local file 1 Host and port the reverse shell should...

Fonality trixbox - 'langChoice' Local File Inclusion (connect-back) (2)

!/usr/bin/perl -w Jean-Michel BESNARD / LEXSI Audit 2008-07-09 This is an update of the previous exploit. We can now get a root shell, thanks to sudo. perl trixboxfiv2.pl 192.168.1.212 Please listen carefully as our menu option has changed Choose from the following options: 1 Remote TCP shell 2...

trixbox (langChoice) Local File Inclusion Exploit (connect-back) v2

Exploit for linux platform in category remote exploits =================================================================== trixbox langChoice Local File Inclusion Exploit connect-back v2 =================================================================== !/usr/bin/perl -w Jean-Michel BESNARD /...

Fonality trixbox - langChoice Local File Inclusion (connect-back) (2)

Fonality trixbox - langChoice Local File Inclusion connect-back 2 !/usr/bin/perl -w Jean-Michel BESNARD / LEXSI Audit 2008-07-09 This is an update of the previous exploit. We can now get a root shell, thanks to sudo. perl trixboxfiv2.pl 192.168.1.212 Please listen carefully as our menu option has...

Trixbox langChoice PHP Local File Inclusion

This module injects php into the trixbox session file and then, in a second call, evaluates that code by manipulating the langChoice parameter as described in OSVDB-50421. Module Options msf use exploit/unix/webapp/trixbox/langchoice msf undefinedlangchoice show actions ...actions... msf...

trixbox Dashboard user/index.php langChoice Parameter Local File Inclusion

The version of trixbox dashboard installed on the remote host fails to sanitize user-supplied input to the 'langChoice' parameter of the 'user/index.php' script before using it to include PHP code. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker could leverage this issu...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in trixbox 2.4.2.0 allow remote attackers to inject arbitrary web script or HTML via the query string to index.php in 1 user/ or 2 maint/...

CVE-2008-0540

Multiple cross-site scripting XSS vulnerabilities in trixbox 2.4.2.0 allow remote attackers to inject arbitrary web script or HTML via the query string to index.php in 1 user/ or 2 maint/...

CVE-2008-0540

CVE-2008-0540 affects trixbox 2.4.2.0 and concerns reflected/cross-site scripting in index.php via the query string in (1) user/ and (2) maint/. The root cause is unvalidated input in query parameters leading to injection of arbitrary script/HTML. Public disclosures in NVD and related feeds confi...

CVE-2008-0540

Multiple cross-site scripting XSS vulnerabilities in trixbox 2.4.2.0 allow remote attackers to inject arbitrary web script or HTML via the query string to index.php in 1 user/ or 2 maint/...

Fonality trixbox 2.4.2 - Cross-Site Scripting (1)

source: https://www.securityfocus.com/bid/27460/info The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...

Fonality trixbox 2.4.2 - Cross-Site Scripting (2)

Fonality trixbox 2.4.2 - Cross-Site Scripting 2 source: https://www.securityfocus.com/bid/27460/info The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to...

Fonality trixbox 2.4.2 - Cross-Site Scripting (1)

Fonality trixbox 2.4.2 - Cross-Site Scripting 1 source: https://www.securityfocus.com/bid/27460/info The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to...

Fonality trixbox 2.4.2 - Cross-Site Scripting (2)

source: https://www.securityfocus.com/bid/27460/info The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...