HP Connected Backup 8.68.8.6 - Local Privilege Escalation

HP Connected Backup 8.68.8.6 - Local Privilege Escalation Tested on HP Connected Backup version 8.8.2.0 on Windows 7 x64 import os import sys import time import requests from bs4 import BeautifulSoup def sendrequestbody: url="http://localhost:16386/" headers = "Content-Type": "text/xml;...

CentOS Web Panel 0.9.8.12 - row_id domain SQL Injection

CentOS Web Panel 0.9.8.12 - rowid domain SQL Injection Document Title: =============== CentOS Web Panel v0.9.8.12 - Remote SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1833 Release Date: ============= 2018-01-22...

Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin)

Photography CMS 1.0 - Cross-Site Request Forgery Add Admin New Admin Username: Password: Confirm Password: Email: $"ekleabi".live'click',function $.ajax type: "POST", url: "http://ronnieswietek.com/cc/clients/resources/ajax/ajaxnewadmin.php", data: username:$".efe username".val, password1:$".efe...

Blizzard Update Agent - JSON RPC DNS Rebinding

Blizzard Update Agent - JSON RPC DNS Rebinding All blizzard games are installed alongside a shared tool called "Blizzard Update Agent", investor.activision.com claims they have "500 million monthly active users", who presumably all have this utility installed. The agent utility creates an JSON RP...

Tumder 2.1 - SQL Injection

Tumder 2.1 - SQL Injection Exploit Title: Tumder - An Arcade Games Platform 2.1 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://sndr.co.ve/ Software Link: https://codecanyon.net/item/tumder-an-arcade-games-platform/18726994 Version: 2.1 Category: Webapps Tested on:...

LiveCRM SaaS Cloud 1.0 - SQL Injection

LiveCRM SaaS Cloud 1.0 - SQL Injection Exploit Title: LiveCRM SaaS Cloud 1.0 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://livecrm.co/ Software Link: https://codecanyon.net/item/livecrm-saas-cloud-cloud-based-open-source-complete-business-management-solution-crm/21219419...

MixPad 5.00 - Buffer Overflow

MixPad 5.00 - Buffer Overflow !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: NCH Software MixPad v5.00 - Unicode Buffer Overflow Date: 21-01-2017 Vulnerable Software: NCH Software MixPad Vendor Homepage: http://www.nch.com.au/mixpad Version: v5.00 Software Link:...

RAVPower 2.000.056 - Memory Disclosure

RAVPower 2.000.056 - Memory Disclosure """ Exploit Title: RAVPower - remote stack disclosure Date: 22/01/2018 Exploit Author: Daniele Linguaglossa Vendor Homepage: https://www.ravpower.com/ Software Link: https://www.ravpower.com/ Version: 2.000.056 Tested on: OSX CVE : CVE-2018-5319 """ import...

Zechat 1.5 - SQL Injection

Zechat 1.5 - SQL Injection Exploit Title: Facebook Style Php Ajax Chat - Zechat 1.5 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://bylancer.com/ Software Link: https://codecanyon.net/item/facebook-style-php-ajax-chat-zechat/16491266 Version: 1.5 Category: Webapps Tested on:...

Affiligator 2.1.0 - SQL Injection

Affiligator 2.1.0 - SQL Injection Exploit Title: Affiligator - Affiliate Webshop Management System 2.1.0 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: https://www.getaffiligator.com/ Software Link: https://codecanyon.net/item/affiligator-affiliate-webshop-management-system/21214946...

RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin)

RSVP Invitation Online 1.0 - Cross-Site Request Forgery Update Admin...

NEC Univerge SV9100SV8100 WebPro 10.0 - Configuration Download

NEC Univerge SV9100SV8100 WebPro 10.0 - Configuration Download NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download Vendor: NEC Corporation Product web page: http://www.nec.com Affected version: WebPro =10.00 DSP Firmware Version: 12.11.00.02 Summary: NEC's UNIVERGE® SV9100 is the...

Flexible Poll 1.2 - SQL Injection

Flexible Poll 1.2 - SQL Injection Exploit Title: Flexible Poll 1.2 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://ddywpro.com/ Software Link: https://codecanyon.net/item/flexible-poll/4363114 Version: 1.2 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-5988...

Easy Car Script 2014 - SQL Injection

Easy Car Script 2014 - SQL Injection Exploit Title: Easy Car Script 2014 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://www.easyphotostore.com/ Software Link: http://www.easycarscript.com/ Version: 2014 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-5986 Explo...

Wchat 1.5 - SQL Injection

Wchat 1.5 - SQL Injection Exploit Title: Wchat - Fully Responsive PHP AJAX Chat Script 1.5 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://bylancer.com/ Software Link: https://codecanyon.net/item/wchat-fully-responsive-phpajax-chat/18047319 Version: 1.5 Category: Webapps Tested...

Herospeed - TelnetSwitch Remote Stack Overflow Overwrite Password Enable TelnetD

Herospeed - TelnetSwitch Remote Stack Overflow Overwrite Password Enable TelnetD !/usr/bin/env python2.7 Herospeed TelnetSwitch daemon running on TCP/787, for allowing enable of the telnetd. Where one small stack overflow allows us to overwrite the dynamicly generated password and enable telnetd...

AsusWRT Router 3.0.0.4.380.7743 - LAN Remote Code Execution

AsusWRT Router 3.0.0.4.380.7743 - LAN Remote Code Execution Unauthenticated LAN remote code execution in AsusWRT Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 22/01/2018 / Last...

OTRS 5.0.x6.0.x - Remote Command Execution

OTRS 5.0.x6.0.x - Remote Command Execution Exploit Title: OTRS Shell Access Date: 21-01-2018 Exploit Author: Bæln0rn Vendor Homepage: https://www.otrs.com/ Software Link: http://ftp.otrs.org/pub/otrs/ Version: 4.0.1 - 4.0.26, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1 Tested on: OTRS 5.0.2/CentOS 7.2.1511 CVE...

Shopware 5.2.55.3 - Cross-Site Scripting

Shopware 5.2.55.3 - Cross-Site Scripting Document Title: =============== Shopware 5.2.5 & v5.3 - Multiple Cross Site Scripting Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1922 Shopware Security Tracking ID: SW-19834 Security Updat...

PHPFreeChat 1.7 - Denial of Service

PHPFreeChat 1.7 - Denial of Service Exploit Title: phpFreeChat 1.7 and earlier - Denial of Service Version: 1.7 and earlier Date: 21/01/2018 Vendor Homepage: http://www.phpfreechat.net Software Link: http://www.phpfreechat.net/download Exploit Author: A. Pakbaz CVE : CVE-2018-5954 1 $pid=pcntlfor...

Oracle JDeveloper 11.1.x12.x - Directory Traversal

Oracle JDeveloper 11.1.x12.x - Directory Traversal + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ORACLE-JDEVELOPER-DIRECTORY-TRAVERSAL.txt + ISR: apparition security Vendor: ============= www.oracle.com Product:...

CentOS Web Panel 0.9.8.12 - Multiple Vulnerabilities

CentOS Web Panel 0.9.8.12 - Multiple Vulnerabilities Document Title: =============== CentOS Web Panel v0.9.8.12 - Multiple Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1836 Release Date: ============= 2018-01-19...

macOS 10.13 (17A365) - Kernel Memory Disclosure due to Lack of Bounds Checking in AppleIntelCapriController::getDisplayPipeCapability

macOS 10.13 17A365 - Kernel Memory Disclosure due to Lack of Bounds Checking in AppleIntelCapriController::getDisplayPipeCapability / AppleIntelCapriController::getDisplayPipeCapability reads an attacker-controlled dword value from a userclient structure input buffer which it uses to index a smal...

Primefaces 5.x - Remote Code Execution (Metasploit)

Primefaces 5.x - Remote Code Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2017-1000486 Primefaces Remote Code Execution Exploit', 'Description' = %q This module...

GitStack 2.3.10 - Remote Code Execution

GitStack 2.3.10 - Remote Code Execution Exploit: GitStack 2.3.10 Unauthenticated Remote Code Execution Date: 18.01.2018 Software Link: https://gitstack.com/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: remote 1. Description...

FuzzerTCP

This is yet a simple fuzzer written in Python that uses SCAPY to create IP packages and send them over a socket, it works as a server/client and logs all packet in hexadecimal to make it easier to modify. Fuzzer Author: Juan Sacco Date and time: 31 October 2017 Description: This a yet simple fuzz...

FuzzerLocal

This is yet a simple fuzzer written in Python that bruteforce a local binary using a De Bruijn pattern and xRand to trigger Segmentation faults, also it tries to guess the arguments using an Alphabet and Random list. Fuzzer Author: Juan Sacco Date and time: 18 Jan 2018 import argparse import os...

BamBamPackages

BAM BAM Packages Fuzzer/Exploiter for packages from report using arguments !/bin/bash GREEN='\0330;32m' RED='\0330;31m' WHITE='\0331;37m' YELLOW='\0331;33m' NC='\0330m' No Color ropper="python Ropper-master/Ropper.py " ropgadget="python ROPgadget-master/ROPgadget.py " if "$EUID" -ne 0 then printf...

BamBamLocal

BAM BAM Local Fuzzer/Exploiter for local binaries using arguments !/bin/bash GREEN='\0330;32m' RED='\0330;31m' YELLOW='\0331;33m' NC='\0330m' No Color ropper="python Ropper-master/Ropper.py " ropgadget="python ROPgadget-master/ROPgadget.py " printf "$GREEN BAM BAM Local Fuzzer/Exploiter - Author:...

Smiths Medical Medfusion 4000 - DHCP Denial of Service

Smiths Medical Medfusion 4000 - DHCP Denial of Service !/usr/bin/python3 """PoC for MQX RTCS code execution via DHCP options overflow. This is just a quick hack to prove the vulnerability and was designed to run on a private network with the target device. """ import datetime import socket def...

SugarCRM 3.5.1 - Cross-Site Scripting

SugarCRM 3.5.1 - Cross-Site Scripting Exploit Title: sugarCRM 3.5.1 XSS refeclted Date: 16/01/2017 Exploit Author: Guilherme Assmann Vendor Homepage: https://www.sugarcrm.com/ Version: 3.5.1 Tested on: kali linux, windows 7, 8.1, 10, ubuntu - Firefox Download...

Microsoft Edge Chakra - AsmJSByteCodeGenerator::EmitCall Out-of-Bounds Read

Microsoft Edge Chakra - AsmJSByteCodeGenerator::EmitCall Out-of-Bounds Read / AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used as callee. The method handles those invalid calls in the same way it handles valid calls such as...

Belkin N600DB Wireless Router - Multiple Vulnerabilities

Belkin N600DB Wireless Router - Multiple Vulnerabilities Exploit Title: Belkin N600DB Wireless Router | Multiple Vulnerabilities Date: 16/01/2018 Exploit Author: Wadeek Hardware Version: F9K1102as v3 Firmware Version: 3.04.11 Vendor Homepage: http://www.belkin.com/fr/support/product/?pid=F9K1102a...

Microsoft Edge Chakra - Incorrect Scope Handling

Microsoft Edge Chakra - Incorrect Scope Handling // PoC: function funcarg = function printfunc; // SetHasOwnLocalInClosure should be called for the param scope in the PostVisitFunction function. printfunc; function func ; // Chakra fails to distinguish whether the function is referenced in the...

Master IP CAM 01 - Multiple Vulnerabilities

Master IP CAM 01 - Multiple Vulnerabilities Exploit Title: Master IP CAM 01 Multiple Vulnerabilities Date: 17-01-2018 Remote: Yes Exploit Authors: Daniele Linguaglossa, Raffaele Sabato Contact: https://twitter.com/dzonerzy, https://twitter.com/syrion89 Vendor: Master IP CAM Version: 3.3.4.2103 CV...

Microsoft Edge Chakra JIT - Out-of-Bounds Write

Microsoft Edge Chakra JIT - Out-of-Bounds Write // Here's the PoC demonstrating OOB write. function optarr, start, end for let i = start; i end; i++ if i === 10 i += 0; // -- a arri = 2.3023e-320; function main let arr = new Array100; arr.fill1.1; for let i = 0; i 1000; i++ optarr, 0, 3; optarr, ...

Microsoft Edge Chakra JIT - Stack-to-Heap Copy

Microsoft Edge Chakra JIT - Stack-to-Heap Copy / If variables don't escape the scope, the variables can be allocated to the stack. However, there are some situations, such as when a bailout happens or accessing to arguments containing stack-allocated variables, where those variables should not...

Zomato Clone Script - Arbitrary File Upload

Zomato Clone Script - Arbitrary File Upload Zomato Clone - Arbitrary File Upload Date: 16.01.2018 Vendor Homepage: http://www.phpscriptsmall.com/ Software Link: http://www.exclusivescript.com/product/099S4111872/php-scripts/zomato-clone-script Demo: http://jhinstitute.com/demo/foodpanda/ Version:...

Microsoft Edge Chakra JIT - Incorrect Bounds Calculation

Microsoft Edge Chakra JIT - Incorrect Bounds Calculation / Let's start with comments in the "GlobOpt::TrackIntSpecializedAddSubConstant" method. // Track bounds for add or sub with a constant. For instance, consider b = a + 2. The value of 'b' should track // that it is equal to the value of 'a' ...

Microsoft Edge Chakra - JavascriptGeneratorFunction::GetPropertyBuiltIns Type Confusion

Microsoft Edge Chakra - JavascriptGeneratorFunction::GetPropertyBuiltIns Type Confusion / Here's a snippet of the method. bool JavascriptGeneratorFunction::GetPropertyBuiltInsVar originalInstance, PropertyId propertyId, Var value, PropertyValueInfo info, ScriptContext requestContext, BOOL result ...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes (2)

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes 2 / Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: / // Enable the flag using '\n'.repeat0x1000 evalfunction f with function printf; ; ; +...

Reservo Image Hosting Script 1.5 - Cross-Site Scripting

Reservo Image Hosting Script 1.5 - Cross-Site Scripting Exploit Title: Reservo Image Hosting Script 1.5 - Cross Site Scripting Date: 15-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: reservo.co Version: 1.6 CVE-ID: CVE-2018-5705 With suppor...

D-Link DSL-2640R - DNS Change

D-Link DSL-2640R - DNS Change D-Link DSL-2640R Unauthenticated Remote DNS Change Vulnerability Firmware Version: UK1.06 Hardware Version: B1 Copyright 2018 c Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg/ Description: The vulnerability exist in the web interface...

glibc 2.26 - getcwd() Local Privilege Escalation

glibc 2.26 - getcwd Local Privilege Escalation / This software is provided by the copyright owner "as is" and any expressed or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall the...

Domains Hostings Manager PRO 3.0 - Authentication Bypass

Domains Hostings Manager PRO 3.0 - Authentication Bypass Exploit Title: Domains & Hostings Manager PRO v 3.0 - Authentication Bypass Date: 13.01.2018 Vendor Homepage: http://endavi.com/ Software Buy: https://codecanyon.net/item/advanced-domains-and-hostings-pro-v3-multiuser/10368735 Demo:...

Adminer 4.3.1 - Server-Side Request Forgery

Adminer 4.3.1 - Server-Side Request Forgery + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt + ISR: apparition security Vendor: ============== www.adminer.org Product...

D-Link DNS-325 ShareCenter 1.05B03 - Multiple Vulnerabilities

D-Link DNS-325 ShareCenter 1.05B03 - Multiple Vulnerabilities D-Link DNS-325 ShareCenter Multiple Vulnerabilities Vendor: D-Link Product: D-Link DNS-325 ShareCenter Version: = 1.05B03 Website: http://sharecenter.dlink.com/products/DNS-325 / / / / / / / / / / / / / / / / / / / / / \ / // / // / / ...

SysGauge Server 3.6.18 - Remote Buffer Overflow

SysGauge Server 3.6.18 - Remote Buffer Overflow Exploit Title: SysGauge Server 3.6.18 - Buffer Overflow Exploit Author: Ahmad Mahfouz Description: Sysgauge Server Unauthenticated Remote Buffer Overflow SEH Contact: http://twitter.com/eln1x Date: 12/01/2018 CVE: CVE-2018-5359 Version: 3.6.18 Teste...

Synology Photo Station 6.8.2-3461 - SYNOPHOTO_Flickr_MultiUpload Race Condition File Write Remote Code Execution

Synology Photo Station 6.8.2-3461 - SYNOPHOTOFlickrMultiUpload Race Condition File Write Remote Code Execution !/usr/local/bin/python """ Synology Photo Station = 6.8.2-3461 latest SYNOPHOTOFlickrMultiUpload Race Condition File Write Remote Code Execution Vulnerability Found by: mrme Tested:...

PerfexCRM 1.9.7 - Arbitrary File Upload

PerfexCRM 1.9.7 - Arbitrary File Upload Exploit Title: PerfexCRM 1.9.7 – Unrestricted php5 File upload Exploit Author: Ahmad Mahfouz Description: PerfexCRM 1.9.7 prone to unrestricted file upload that lead to system take over by misconfigured elfinder plugin Contact: http://twitter.com/eln1x Date...