Coppermine Photo Gallery <= 1.4.20 (BBCode IMG) Privilege Escalation

No description provided by source. +--------------------------------------------------------------------------+ | Coppermine Photo Gallery = 1.4.20 BBCode IMG Privilege Escalation PoC | +--------------------------------------------------------------------------+ | by Juri Gianni aka yeat -...

Coppermine Photo Gallery 1.4.20 - BBCode IMG Privilege Escalation

Coppermine Photo Gallery 1.4.20 - BBCode IMG Privilege Escalation +--------------------------------------------------------------------------+ | Coppermine Photo Gallery = 1.4.20 BBCode IMG Privilege Escalation PoC | +--------------------------------------------------------------------------+ | b...

Jaws language Parameter Multiple Local File Includes

Jaws, a Framework and Content Management System for building dynamic websites, is installed on the remote system. The installed version fails to filter input to the 'language' parameter before using it to include PHP code in '/upgrade/index.php' and '/install/index.php'. Regardless of PHP's...

PLE CMS 1.0 Beta 4.2 SQL Injection

--+++==============================================================+++-- --+++====== PLE CMS 1.0 beta 4.2 Blind SQL Injection Exploit ======+++-- --+++==============================================================+++-- ". "\n+ Ex. : php xpl.php localhost /PLECMS root...

OpenX fc.php MAX_type Parameter Traversal Local File Inclusion

The remote host is running OpenX formerly Openads, an open source ad serving application written in PHP. The installed version of OpenX does not validate user-supplied input to the 'MAXtype' parameter of the 'www/delivery/fc.php' script before using it in a PHP 'include' function. Regardless of...

HTTP NULL User ID and Password (deprecated)

Binary data 4842.prm...

Oracle Secure Backup NDMP_CONECT_CLIENT_AUTH Command Buffer Overflow Vulnerability

Oracle Secure Backup NDMPCONECTCLIENTAUTH Command Buffer Overflow Vulnerability 2009.January.13 Fortinet's FortiGuard Global Security Research Team Discovers Vulnerability in Oracle Secure Backup Summary: ======== A Buffer Overflow vulnerability exists Oracle Secure Backup 10.2.0.2 through a...

serv-u7 local exploit (php)-bug warning-the black bar safety net

Note: since the author is lazy, does not provide the log cleaning function that will leave the log: One, the su7 is the right there are several? There are two forms to get rid of su7 in. 1, login to the Administrator Console page ==get the OrganizationId for Add User ==get the global user of...

XOOPS Multiple Scripts mydirname Parameter Arbitrary Command Injection

The version of XOOPS installed on the remote host fails to filter user-supplied input to the 'mydirname' parameter of the 'onupdate.php', 'notification.php', and 'oninstall.php' scripts under the application's 'xoopslib/modules/protector' directory before passing it to PHP 'eval' functions...

XStandard Lite Plugin for Joomla! X_CMS_LIBRARY_PATH Header Directory Traversal

The version of Joomla! running on the remote host is distributed with a WYSIWYG editor plugin known as XStandard Lite. This plugin is affected by an information disclosure vulnerability in the attachmentlibrary.php script due to improper sanitization of user-supplied input to the XCMSLIBRARYPATH...

kernel: open() call allows setgid bit when user is not in new file's group

fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable...

BSD/x86 - setuid(0) + Break chroot (../ 10x Loop) + Bind TCP (2222/TCP) Shell Shellcode (133 bytes)

BSD/x86 - setuid0 + Break chroot ../ 10x Loop + Bind TCP 2222/TCP Shell Shellcode 133 bytes. Shellcode exploit for BSDx86 platform / The setuid0+chroot+bind shellcode it will: setuid0 put '../' 10 times in chroot open shell on 2222nd port Size 133 bytes OS BSD /rootteam/dev0id rootteam.void.ru...

CMS NetCat 3.12 (password_recovery.php) Blind SQL Injection Exploit

No description provided by source. ? / NetCat Blind SQL Injection exploit by s4avrd0w [email protected] Versions affected 3.12 More info: http://www.netcat.ru/ tested on version 3.12 usage: ./NetCatblindSQLexploit.php -s=NetCatserver -u=UserID The options are required: -u The user identifier number...

Moodle 'filter/tex/texed.php' 'pathname' Parameter Remote Command Execution

The version of Moodle installed on the remote host fails to sanitize user-supplied input to the 'pathname' parameter before using it in the 'filter/tex/texed.php' script in a commandline that is passed to the shell. Provided that PHP's 'registerglobals' setting and the TeX Notation filter has bot...

phpBB 3 (Mod Tag Board <= 4) Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl --------------------------------------------------------------- phpBB 3 Mod Tag Board = 4 Remote Blind SQL Injection Exploit by athos - stakerathotmaildotit http://bx67212.netsons.org/forum/viewforum.php?f=3...

phpBB 3 (Mod Tag Board <= 4) Remote Blind SQL Injection Exploit

Exploit for unknown platform in category web applications =============================================================== phpBB 3 Mod Tag Board = 4 Remote Blind SQL Injection Exploit =============================================================== !/usr/bin/perl...

Joomla! Component JMovies 1.1 - id SQL Injection

Joomla! Component JMovies 1.1 - id SQL Injection !/usr/bin/perl -w ----------------------------------------------------------- Joomla Component comjmovies 1.1 id SQL Injection Exploit by s3rg3770 with athos : demo http://www.disneyrama.com ---------------------------------------------------------...

CMS Made Simple admin/login.php cms_language Cookie Local File Inclusion

The remote host is running CMS Made Simple, a content management system written in PHP. The version of CMS Made Simple installed on the remote host fails to sanitize user-supplied input to the 'cmslanguage' cookie when passed to the 'admin/login.php' script before using it to include PHP code...

kernel: remove SUID when splicing into an inode

The genericfilesplicewrite function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified...

articlepublisherpro-insecure.txt

Article Publisher PRO Insecure Cookie Handling Vulnerability version: 1.5 ---------------------------------------------------------- Discovered By: ZoRLu Date: 01.11.2008 Home: www.z0rlu.blogspot.com contact: [email protected] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : N0T: a.q kpss :...