Kodak Image Viewer - TIFTIFF Code Execution (MS07-055)

Kodak Image Viewer - TIFTIFF Code Execution MS07-055 / MS07-055 Kodak Image Viewer TIF/TIFF Code Execution Proof Of Concept by Hong Gil-Dong, Jeon Woo-chi Hwang-Hee?1542, Prime Minister in Korea Once upon a time, One servant of Hwang-Hee was arguing with another servant. they asked Hwang-Hee to...

EVA-Web 1.1 2.2 - index.php3 Remote File Inclusion

EVA-Web 1.1 2.2 - index.php3 Remote File Inclusion / \ / \ | | | | | | | | | | | / | | | | | | | ' / | | ' \ / \ | | | | || | || | | | \ | | | | / | , |/ /|| ||| |||| / | |/ Program Title EVA-Web 1.1=2.2 Remote File Inclusion Note A patch was released some time ago..but there was never an...

Microsoft Windows Vista - Forged ARP packet Network Stack Denial of Service

Microsoft Windows Vista - Forged ARP packet Network Stack Denial of Service !/usr/bin/env python :: Kristian Hermansen :: Date: 20070514 Reference: CVE-2007-1531 Description: Microsoft Windows Vista SP0 dumps interfaces when it receives this ARP packet. This DoS is useful for an internet cafe,...

PHPSecurityAdmin 4.0.2 - Logout.php Remote File Inclusion

PHPSecurityAdmin 4.0.2 - Logout.php Remote File Inclusion source: https://www.securityfocus.com/bid/23801/info PHPSecurityAdmin is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise...

F3Site 2.1 - Remote Code Execution

F3Site 2.1 - Remote Code Execution ? // //Kacper & str0ke Settings $exploitname = "F3Site = 2.1 Remote Code Execution Exploit"; $scriptname = "F3Site 2.1"; $scriptsite = "http://dhost.info/compmaster/"; $dork = '"Powered by F3Site"'; //to work exploit you need admin session, and cookies prefix //...

simple file manager 0.24a - Multiple Vulnerabilities

simple file manager 0.24a - Multiple Vulnerabilities /\ | flame vrs Simple File Manager | | http://onedotoh.sourceforge.net/ | | Various Vulnerbilities Including: | / /+++++++++++++++++++++++++++++++++++++++++++\ | Using the scripts supplied by the webapp: | | Reading of Arbitrary files | |...

IBM eGatherer 3.20.0284.0 - ActiveX Remote Code Execution (Metasploit)

IBM eGatherer 3.20.0284.0 - ActiveX Remote Code Execution Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the cor...

Linux Kernel 2.6.13 2.6.17.4 - sys_prctl() Local Privilege Escalation (1)

Linux Kernel 2.6.13 2.6.17.4 - sysprctl Local Privilege Escalation 1 // / Local r00t Exploit for: / / Linux Kernel PRCTL Core Dump Handling / / BID 18874 / CVE-2006-2451 / / Kernel 2.6.x = 2.6.13 && main PoC code / / - RoMaNSoFt local root code / / 10.Jul.2006 / // include include include include...

ScozNews 1.2.1 - mainpath Remote File Inclusion

ScozNews 1.2.1 - mainpath Remote File Inclusion DEVIL TEAM THE BEST POLISH TEAM ScozNews v1.2.1 - Remote File Include Find by Kacper Rahim. Greetings For ALL DEVIL TEAM members, Special DragonHeart : Contact: [email protected] or http://www.devilteam.yum.pl dork: "Powered By ScozNews"...

RealPlayer 10.5 (6.0.12.1040-1348) - SWF Buffer Overflow (PoC)

RealPlayer 10.5 6.0.12.1040-1348 - SWF Buffer Overflow PoC !/usr/bin/perl RealPlayer: Buffer overflow vulnerability / PoC CVE-2006-0323 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323 RealNetworks Advisory http://service.real.com/realplayer/security/03162006player/en/ Federico L. Boss...

PHP-Nuke 7.x - Multiple Remote File Inclusions

PHP-Nuke 7.x - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/18186/info PHP-Nuke is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issue...

W-Agora 4.1.6 - a redir_url.php?key SQL Injection

W-Agora 4.1.6 - a redirurl.php?key SQL Injection source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to...

Hassan Consulting Shopping Cart 1.18 - Directory Traversal

Hassan Consulting Shopping Cart 1.18 - Directory Traversal source: https://www.securityfocus.com/bid/1777/info The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot "..". Therefore, requesting the following URL will displa...

Dairy Farm Shop Management System 1.0 - username SQL Injection

Dairy Farm Shop Management System 1.0 - username SQL Injection Exploit Title: Dairy Farm Shop Management System 1.0 - 'username' SQL Injection Google Dork: N/A Date: 2020-01-03 Exploit Author: Chris Inzinga Vendor Homepage: https://phpgurukul.com/ Software Link:...

WordPress Core 5.3.x - xmlrpc.php Denial of Service

WordPress Core 5.3.x - xmlrpc.php Denial of Service !/usr/bin/env python WordPress methodNamepingback.ping" entry += f"paramspingback/COUNT" entry += f"paramspingback/uuid.uuid4" entry += f"target/?p=1" entry += f"target/e" taxes DB more return entry def buildrequestpingback,target,entries: prefi...

msdn.com

Pentest notes for: msdn.com Exploit Pack Nmap 7.80 scan initiated Tue Dec 3 09:58:32 2019 as: /usr/bin/nmap -sV -A -oA log/msdn.com msdn.com Nmap scan report for msdn.com 13.77.161.179 Host is up 0.17s latency. Other addresses for msdn.com not scanned: 104.215.148.63 40.76.4.15 40.112.72.205...

SmartHouse Webapp 6.5.33 - Cross-Site Request Forgery

SmartHouse Webapp 6.5.33 - Cross-Site Request Forgery Exploit Title: SmartHouse Webapp 6.5.33 - Cross-Site Request Forgery Discovery by: LiquidWorm Date: 2019-12-02 Vendor Homepage: Tested Version: 6.5.33.17072501 CVE: N/A Advisory ID: ZSL-2019-5543 Advisory URL:...

WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting

WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Exploit Title: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Google Dork: inurl:/wp-content/themes/zoner/ Date: 2019-09-24 Exploit Author: m0ze Vendor Homepage: https://fruitfulcode.com/ Software...

WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting

WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting Exploit Title: WordPress Download Manager Cross-site Scripting Discovery Date: 2019-04-13 Exploit Author: ThuraMoeMyint Author Link: https://twitter.com/mgthuramoemyint Vendor Homepage: https://www.wpdownloadmanager.com Software Link...

ManageEngine opManager 12.3.150 - Authenticated Code Execution

ManageEngine opManager 12.3.150 - Authenticated Code Execution !/usr/bin/env python3 Exploit Title: ManageEngine opManager Authenticated Code Execution Google Dork: N/A Date: 08/13/2019 Exploit Author: @kindredsec Vendor Homepage: https://www.manageengine.com/ Software Link:...

SOCA Access Control System 180612 - Information Disclosure

SOCA Access Control System 180612 - Information Disclosure SOCA Access Control System 180612 Information Disclosure Vendor: SOCA Technology Co., Ltd Product web page: http://www.socatech.com Affected version: 180612, 170000 and 141007 Summary: The company's products include proximity and...

Zoho ManageEngine ADManager Plus 6.6 (Build 6659) - Privilege Escalation

Zoho ManageEngine ADManager Plus 6.6 Build 6659 - Privilege Escalation Exploit Title: Zoho ManageEngine ADManager Plus 6.6 Build 6659 Privilege Escalation Date: 15th April 2019 Exploit Author: Digital Interruption Vendor Homepage: https://www.manageengine.co.uk/ Version: 6.6 Build 6658 Tested on:...

CentOS Web Panel 0.9.8.793 (Free) 0.9.8.753 (Pro) - Cross-Site Scripting

CentOS Web Panel 0.9.8.793 Free 0.9.8.753 Pro - Cross-Site Scripting Exploit Title: CentOS Web Panel v0.9.8.793 Free and v0.9.8.753 Pro - Email Field Stored Cross-Site Scripting Vulnerability Google Dork: N/A Date: 06 - April - 2019 Exploit Author: DKM Vendor Homepage: http://centos-webpanel.com...

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an ite...

Linux Kernel 4.4 (Ubuntu 16.04) - snd_timer_user_ccallback() Kernel Pointer Leak

Linux Kernel 4.4 Ubuntu 16.04 - sndtimeruserccallback Kernel Pointer Leak include include include include include include include include include include include include include include Exploit Title: Linux Kernel 4.4 Ubuntu 16.04 - Leak kernel pointer in sndtimeruserccallback Google Dork: - Date...

BEWARD Intercom 2.3.1 - Credentials Disclosure

BEWARD Intercom 2.3.1 - Credentials Disclosure !/usr/bin/env python -- coding: utf8 -- BEWARD Intercom 2.3.1 Credentials Disclosure Vendor: Beward R&D Co., Ltd Product web page: https://www.beward.net Affected version: 2.3.1.34471 2.3.0 2.2.11 2.2.10.5 2.2.9 2.2.8.9 2.2.7.4 Note: For versions abo...

Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data

Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data Exploit Title: Ajera Timesheets = 9.10.16 - Deserialization of untrusted data Date: 2019-01-03 Exploit Author: Anthony Cole Vendor Homepage: https://www.deltek.com/en/products/project-erp/ajera Version: = 9.10.16 Contact:...

WSTMart 2.0.8 - Cross-Site Scripting

WSTMart 2.0.8 - Cross-Site Scripting Exploit Title: WSTMart 2.0.8 - Cross-Site Scripting Date: 2018-12-23 Exploit Author: linfeng Vendor Homepage: https://github.com/wstmall/wstmart/ Software Link: http://www.wstmart.net/ Version: WSTMart 2.0.8181212 CVE: CVE-2018-20367 0x01 stored XSS PoC Functi...

Kubernetes - (Unauthenticated) Arbitrary Requests

Kubernetes - Unauthenticated Arbitrary Requests !/usr/bin/env python3 import argparse from ssl import wrapsocket from json import loads, dumps from socket import createconnection def requeststage1base, version, target: stage1 = "" with open'ustage1', 'r' as stage1fd: stage1 = stage1fd.read return...

DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting

DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Date: 2018-11-22 Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod https://github.com/domainmod/domainmod Version:...

School Attendance Monitoring System 1.0 - Cross-Site Request Forgery (Update Admin)

School Attendance Monitoring System 1.0 - Cross-Site Request Forgery Update Admin Exploit Title: School Attendance Monitoring System 1.0 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe...

DamiCMS 6.0.0 - Cross-Site Request Forgery (Change Admin Password)

DamiCMS 6.0.0 - Cross-Site Request Forgery Change Admin Password Exploit Title: DamiCMS 6.0.0 - Cross-Site Request Forgery Change Admin Password Author: AutismJH Date: 2018-08-30 Vendor Homepage: https://github.com/731276192/damicms Software Link: https://github.com/731276192/damicms Version: 6.0...

ManageEngine Exchange Reporter Plus Build 5311 - Remote Code Execution

ManageEngine Exchange Reporter Plus Build 5311 - Remote Code Execution Exploit Title: ManageEngine Exchange Reporter Plus = 5310 Unauthenticated RCE Date: 28-06-2018 Software Link: https://www.manageengine.com/products/exchange-reports/ Exploit Author: Kacper Szurek Contact:...

WUZHI CMS 4.1.0 - tag[pinyin] Cross-Site Scripting

WUZHI CMS 4.1.0 - tagpinyin Cross-Site Scripting Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability Date: 2018-4-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE: CVE-2018-10311 An...

SickRage v2018.03.09 - Clear-Text Credentials HTTP Response

SickRage v2018.03.09 - Clear-Text Credentials HTTP Response Exploit Title: SickRage v2018.03.09 - Clear-Text Credentials HTTP Response Date: 2018-04-01 Exploit Author: Sven Fassbender Vendor Homepage: https://sickrage.github.io Software Link: https://github.com/SickRage/SickRage Version:...

Frog CMS 0.9.5 - Persistent Cross-Site Scripting

Frog CMS 0.9.5 - Persistent Cross-Site Scripting Exploit Title: Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings Date: 2018-04-23 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/philippe/FrogCMS Software Link:...

Cobub Razor 0.8.0 - SQL injection

Cobub Razor 0.8.0 - SQL injection Exploit Title: Cobub Razor 0.8.0 SQL injection Vulnerability Date: 2018-04-16 Exploit Author: Kyhvedn（[email protected]、[email protected]） Vendor Homepage: http://www.cobub.com/ Software Link: https://github.com/cobub/razor Version: 0.8.0 CVE : CVE-2018-80...

WordPress Plugin Background Takeover 4.1.4 - Directory Traversal

WordPress Plugin Background Takeover 4.1.4 - Directory Traversal Exploit Title: WP Background Takeover, Directory Traversal = 4.1.4 Google Dork: inurl:/plugins/wpsite-background-takeover Date: 2018-03-08 Exploit Author: Colette Chamberland, Defiant, Inc. Vendor Homepage: https://99robots.com...

Joomla! Component Acymailing Starter 5.9.5 - CSV Macro Injection

Joomla! Component Acymailing Starter 5.9.5 - CSV Macro Injection Exploit Title: Joomla! Component Acymailing Starter 5.9.5 CSV Macro Injection Google Dork: N/A Date: 22-03-2018 Exploit Author: Sureshbabu Narvaneni Vendor Homepage: https://www.acyba.com Software Link:...

WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting

WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting Exploit Title : Relevanssi Wordpress Search Plugin Reflected Cross Site Scripting XSS Date: 23-03-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://www.relevanssi.com Softwar...

Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 170109) - Access Control Bypass

Hikvision IP Camera versions 5.2.0 - 5.3.9 Builds 140721 170109 - Access Control Bypass Exploit Title: Hikvision IP Camera versions 5.2.0 - 5.3.9 Builds: 140721 - 170109 Backdoor Date: 15-03-2018 Vendor Homepage: http://www.hikvision.com/en/ Exploit Author: Matamorphosis Category: Web Apps...

Linux Kernel 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation

Linux Kernel 4.4.0-116 Ubuntu 16.04.4 - Local Privilege Escalation / Ubuntu 16.04.4 kernel priv esc all credits to @bleidl - vnik / // Tested on: // 4.4.0-116-generic 140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x8664 // if different kernel adjust CRED offset + check kernel stack size include...

Joomla! Component Solidres 2.5.1 - SQL Injection

Joomla! Component Solidres 2.5.1 - SQL Injection Exploit Title: Joomla! Component Solidres 2.5.1 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://solidres.com/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/solidres/...

Joomla! Component Saxum Astro 4.0.14 - SQL Injection

Joomla! Component Saxum Astro 4.0.14 - SQL Injection Exploit Title: Joomla! Component Saxum Astro 4.0.14 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.saxum2003.hu/ Software Link: https://extensions.joomla.org/extensions/extension/living/astrology-a-horoscope/saxumastro/...

macOS - sysctl_vfs_generic_conf Stack Leak Through Struct Padding

macOS - sysctlvfsgenericconf Stack Leak Through Struct Padding / The sysctls vfs.generic.conf. are handled by sysctlvfsgenericconf, which is implemented as follows: static int sysctlvfsgenericconf SYSCTLHANDLERARGS int name, namelen; struct vfstable vfsp; struct vfsconf vfsc; voidoidp; name = arg...

Joomla! Component JEXTN FAQ Pro 4.0.0 - id SQL Injection

Joomla! Component JEXTN FAQ Pro 4.0.0 - id SQL Injection Exploit Title: Joomla! Component JEXTN FAQ Pro 4.0.0 - SQL Injection Dork: N/A Date: 24.12.2017 Vendor Homepage: http://jextn.com/ Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/faq/jextn-faq-pro...

Readymade Video Sharing Script 3.2 - HTML Injection

Readymade Video Sharing Script 3.2 - HTML Injection Exploit Title: Readymade Video Sharing Script 3.2 - HTML Injection Dork: N/A Date: 13.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/php-video-sharing-script/ Demo:...

Apple macOSiOS - Kernel Double Free due to IOSurfaceRootUserClient not Respecting MIG Ownership Rules

Apple macOSiOS - Kernel Double Free due to IOSurfaceRootUserClient not Respecting MIG Ownership Rules I have previously detailed the lifetime management paradigms in MIG in the writeups for: CVE-2016-7612 https://bugs.chromium.org/p/project-zero/issues/detail?id=926 and CVE-2016-7633...

Apple macOS XNU Kernel - Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures

Apple macOS XNU Kernel - Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1372 the kernel libproc API proclistuptrs has the following comment in it's userspace header: / Enumerate potential...

KMPlayer 4.2.2.4 - Denial of Service

KMPlayer 4.2.2.4 - Denial of Service ! /usr/bin/perl Exploit Title: KMPlayer .nsv Denial of Service Date: 2017-11-22 Exploit Author: R.Yavari Version: v4.2.2.4 Tested on: Windows 10 , Windows 7 other version should be affected NSV is Streaming video container format developed by Nullsoft; used fo...