Shuttle Tech ADSL Wireless 920 WM - Multiple Vulnerabilities

Shuttle Tech ADSL Wireless 920 WM - Multiple Vulnerabilities Exploit Title : Shuttle Tech ADSL WIRELESS 920 WM - Multiple Vulnerabilities Version: Gan9.8U6X-B-TW-R1B0201T1RP Exploit Author : Persian Hack Team Tested on Win Date 2016/12/05 1. Cross Site Scripting PoC : First We Need To login To...

PDF Shaper Buffer Overflow Exploit

PDF Shaper is prone to a security vulnerability when processing PDF files. The vulnerability appear when we use Convert PDF to Image and use a specially crafted PDF file. This Metasploit module has been tested successfully on Win Xp, Win 7, Win 8, Win 10. This module requires Metasploit:...

PDF Shaper Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'PDF Shaper Buffer Overflow', 'Description' = %q PDF Shaper is prone to a security vulnerability when processing PDF files. The...

WordPress MailChimp 4.0.7 Cross Site Request Forgery / Cross Site Scripting

Exploit Title : WordPress Plugin MailChimp 4.0.7 - Cross-Site Request Forgery / Persistent Cross-Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : https://wordpress.org/plugins/mailchimp-for-wp/ Category: Webapps Tested on: Win Version: 4.0.7 Date: 2016/11/19 PoC: I would like t...

PDF Shaper Buffer Overflow

PDF Shaper is prone to a security vulnerability when processing PDF files. The vulnerability appears when we use Convert PDF to Image and use a specially crafted PDF file. This module has been tested successfully on Win XP, Win 7, Win 8, Win 10. This module requires Metasploit:...

NVIDIA Driver - No Bounds Checking in Escape 0x7000170 Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=936 The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writing...

NVIDIA Driver - Unchecked Write to User-Provided Pointer in Escape 0x600000D Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=911 The DxgkDdiEscape handler for 0x600000D passes an unchecked user provided pointer as the destination for a memcpy call. This leads to kernel memory corruption. Win 10 x64 372.5...

NVIDIA Driver - Unchecked User-Provided Pointer in Escape 0x5000027 Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=937 The DxgkDdiEscape handler for 0x5000027 accepts a user provided pointer, but does no checks on it before using it. ... DWORD userptr = escape5000027data-userptr; v32 = userptr2...

NVIDIA Driver - Unchecked Write to User-Provided Pointer in Escape 0x600000D

NVIDIA Driver - Unchecked Write to User-Provided Pointer in Escape 0x600000D Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=911 The DxgkDdiEscape handler for 0x600000D passes an unchecked user provided pointer as the destination for a memcpy call. This leads to kernel memory...

NVIDIA Driver - Escape 0x100010b Missing Bounds Check

NVIDIA Driver - Escape 0x100010b Missing Bounds Check Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=927 The DxgkDdiEscape handler for escape code 0x100010b looks like: char escape100010bNvMiniportDeviceContext miniportcontext, HANDLE handle, unsigned int idx PVOID Object; if...

NVIDIA Driver - Unchecked User-Provided Pointer in Escape 0x5000027

NVIDIA Driver - Unchecked User-Provided Pointer in Escape 0x5000027 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=937 The DxgkDdiEscape handler for 0x5000027 accepts a user provided pointer, but does no checks on it before using it. ... DWORD userptr = escape5000027data-userpt...

NVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9

NVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=947 The escape handler for 0x10000e9 lacks bounds checks, and passes a user specified size as the size to memcpy, resulting in a stack buffer overflow: bool...

NVIDIA Driver - Escape 0x100010b Missing Bounds Check

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=927 The DxgkDdiEscape handler for escape code 0x100010b looks like: char escape100010bNvMiniportDeviceContext miniportcontext, HANDLE handle, unsigned int idx PVOID Object; if !handle dodebugthingo; Object = PVOID...

NVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=947 The escape handler for 0x10000e9 lacks bounds checks, and passes a user specified size as the size to memcpy, resulting in a stack buffer overflow: bool escape10000e9NvMiniportDeviceContext a1, Escape10000e9 escape ... LOBYTEa9...

Drupal 6.22 - menupereid SQL injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Drupal 6.22 - menupereid SQL injection Vulnerability Exploit Author : xBADGIRL21 Category: Webapps Tested on: Win | Linux Version: Drupal 6.22 Date: 2016/07/04 PoC: http://www.site.com/content/menucustom?menupereid=SQLi + test:...

Joomla DVFolderContent 1.0.2 Local File Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title : Joomla DVFolderContent V1.0.2 Module - Local File Disclosure Exploit Author : Persian Hack Team Vendor Homepage : http://www.dvextensions.de/en/extensions/dvfoldercontent Category Webapps Tested on Win Version : V1.0.2 Date...

WordPress KBoard 2.7 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : WordPress Plugin KBoard 2.7 - SQL Injection Exploit Author : Persian Hack Team Homepage : http://persian-team.ir Google Dork : intitle:"KBoard 2.7" Vendor Homepage : http://www.cosmosfarm.com/products/kboard Category Webapps...

Joomla DVFolderContent 1.0.2 Local File Disclosure

Exploit Title : Joomla DVFolderContent V1.0.2 Module - Local File Disclosure Exploit Author : Persian Hack Team Vendor Homepage : http://www.dvextensions.de/en/extensions/dvfoldercontent Category Webapps Tested on Win Version : V1.0.2 Date 2016/10/01 PoC The Vulnerable page is...

WordPress KBoard Cross Site Scripting

Exploit Title : WordPress Plugin KBoard - Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.cosmosfarm.com/products/kboard Category Webapps Tested on Win Version : Before 4.4 Date 2016/09/26 PoC =Cross Site Scripting : Payload : 1" onmouseover=prompt"Persian"...

WordPress KBoard 2.7 SQL Injection

Exploit Title : WordPress Plugin KBoard 2.7 - SQL Injection Exploit Author : Persian Hack Team Homepage : http://persian-team.ir Google Dork : intitle:"KBoard 2.7" Vendor Homepage : http://www.cosmosfarm.com/products/kboard Category Webapps Tested on Win Version : 2.7 Date 2016/09/26 PoC = Sql...