CVE-2013-4881

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php...

CVE-2013-4881

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php...

BigACE 2.7.8 - Cross-Site Request Forgery (Add Admin)

Exploit Title: Bigace CMS CSRF - Adding an admin account Date: 2013 29 July Exploit Author: Yashar shahinzadeh Credit goes for: ha.cker.ir Vendor Homepage: http://www.bigace.de/ Tested on: Linux & Windows, PHP 5.2.9 Affected Version : 2.7.8 Contacts: http://Twitter.com/YShahinzadeh ,...

Design/Logic Flaw

The create method in app/controllers/userscontroller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by 1 changing the admin flag or 2 assigning an arbitrary role...

Elevation of global permission from Administrator to System administrator

With "Administrator" permission I go to the global permissions page http://:7990/admin/permissions. 1. Type in the name of another user without any global permissions. 2. Select "System Administrator" as permission. 3. Press save. Expected result: Stash would deny me creating a "System...

Meng Jie home textile jboss configuration improper has been invaded many times-the vulnerability and early warning-the black bar safety net

Estimated you also have seen, just haven't submitted. Supposedly now is a positive card manufacturers, the author fixes it. Detailed description: Information leak: http://amb.mendale.com.cn/status?full=true From the figure we can see that in my screenshot, still someone in to access the...

Symantec Messaging Gateway Save.do Cross Site Request Forgery - Improved Performance (CVE-2012-0308)

A cross-site request forgery CSRF vulnerability has been reported in Symantec Messaging Gateway. The vulnerability is due to errors while validating user input. A remote attacker can exploit this vulnerability by enticing a user to open a specially crafted URI. Successful exploitation would allow...

PHPBoost 4.0 <= (FileUpload/Disclosure) Multiple Vulnerabilities

PHPBoost 4.0 Multiple Vulnerabilities - Remote File Upload - Full Informations Disclosure 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change arbitrary user passwords via a nouveau action in the security module to cars/ADMIN/index.php; 2 create a user or...

MySQL (Linux) - Database Privilege Escalation

use DBI; $|=1; =for comment MySQL privilege elevation Exploit This exploit adds a new admin user. By Kingcope Tested on Debian Lenny mysql-5.0.51a OpenSuSE 11.4 5.1.53-log How it works: This exploit makes use of several things: The attacker is in possession of a mysql user with 'file' privileges...

SAP /sap/bc/soap/rfc SOAP Service SUSR_RFC_USER_INTERFACE Function User Creation

This module makes use of the SUSRRFCUSERINTERFACE function, through the SOAP /sap/bc/soap/rfc service, for creating/modifying users on a SAP. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on,...

SAP /sap/bc/soap/rfc SOAP Service BAPI_USER_CREATE1 Function User Creation

This module makes use of the BAPIUSERCREATE1 function, through the SOAP /sap/bc/soap/rfc service, for creating/modifying users on a SAP. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on, inspire...

Pinterestclones XSS/CSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Pinterestclones Multiple Vulnerabilities Author: DaOne Price: $199.99 Software Link: http://www.pinterestclones.com/ Google Dork: N/A Persistent XSS How to exploit: 1-go to : http://site.com/createusernamen/ 2-Put anything in th...

Symantec Web Gateway 5.0.3.18 - Blind SQL Injection Backdoor via MySQL Triggers

Symantec Web Gateway 5.0.3.18 - Blind SQL Injection Backdoor via MySQL Triggers Exploit Title: Symantec Web Gateway 5.0.3.18 Blind SQLi Backdoor via MySQL Triggers Date: Jul 23 2012 Author: muts Version: Symantec Web Gateway 5.0.3.18 Vendor URL: http://www.symantec.com Timeline: 12 Jun 2012:...

tomcat: password disclosure vulnerability

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

tomcat: password disclosure vulnerability

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

Bugtraq-I : Distribution for Pentesting and forensics

Bugtraq-I : Distribution for Pentesting and forensics Bugtraq system offers the most comprehensive distribution, optimal, stable and automatic security to date. Bugtraq is a distribution based on the 2.6.38 kernel has a wide range of penetration and forensic tools. Bugtraq can be installed from a...

[DSECRG-11-040] SAP NetWeaver SPML - XML CSRF user creation

DSECRG-11-040 SAP NetWeaver SPML - XML CSRF user creation Attacker can create a new user in J2EE Engine using CSRF attack on SPML service. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: CSRF Reported: 14.03.2011 Vendor response: 15.03.2011 Date of...

network tracker .95 - Persistent Cross-Site Scripting

Exploit Title: Network Tracker .95 Stored XSS Date: 08-18-2011 Author: G13 Software link: http://networktracker.org/ Version: .95 ISSUE The application contains a option which allows anyone to create a user. If this option is left enabled an attacker could launch a stored XSS attack against the...

PXE Exploit Server

$Id: pxexploit.rb 13493 2011-08-05 17:10:27Z scriptjunkie $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...