56796 matches found
ThinkSNS微吧储存型XSS(无视WAF,无过滤插入任意代码)
简要描述： ThinkSNS微吧储存型XSS无视WAF,无任何过滤,可插入任意代码 官网demo测试。 详细说明： 进入http://demo.thinksns.com/t3/weiba 发布新贴， 在正文里面输入HTML转码后的脚本，例如： alert1; HTML编码后为： 即为我们要加到正文的内容。 确定之后即可看到脚本被执行了。 看看代码： apps/weiba/Lib/Action/IndexAction.class.php 413 public function postDetail 414 $postid = intval$GET'postid'; 415...
iBackup 10.0.0.32 - Local Privilege Escalation
No description provided by source. Exploit Title: iBackup = 10.0.0.32 Local Privilege Escalation Date: 23/01/2014 Author: Glafkos Charalambous glafkos.charalambousatunithreat.com Version: 10.0.0.32 Vendor: IBackup Vendor URL: https://www.ibackup.com/ CVE-2014-5507 Vulnerability Details There are...
Typo3 JobControl 2.14.0 - Cross Site Scripting / SQL Injection
No description provided by source. Mogwai Security Advisory MSA-2014-02 ---------------------------------------------------------------------- Title: JobControl dmmjobcontrol Multiple Vulnerabilities Product: dmmjobcontrol Typo3 Extension Affected versions: 2.14.0 Impact: high Remote: yes Product...
Serenity Client Management Portal 1.0.1 - Multiple Vulnerabilities
No description provided by source. Exploit Title: Serenity Client Management Portal Multiple Vulnerabilities Date: 08-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.0.1 Software Link: http://codecanyon.net/item/serenity-client-management-portal/9136098 Software Test Link:...
HttpCombiner ASP.NET - Remote File Disclosure Vulnerability
No description provided by source. Exploit Title: HttpCombiner ASP.NET Remote File Disclosure Vulnerability Google Dork: filetype:txt intext:HttpCombiner.ashx Date: 2014-10-10 Exploit Author: Hoang Anh Thai Vendor Homepage:...
Tenda A32 Router - CSRF Vulnerability
No description provided by source. Exploit Title: Tenda A32 Router CSRF Vulnerabilityreboot the Router CVE ID :CVE-2014-7281 Date: 2014-10-10 Exploit Author: zixian Vendor Homepage: http://tenda.com.cn/ Software Link: http://tenda.com.cn/Catalog/Product/325 Version: V5.07.53CN When the...
Konke Smart Plug K - Authentication Bypass Vulnerability
No description provided by source. ----------------------------------------------------------------------- Konke Smart Plug Authentication Bypass Vulnerability ----------------------------------------------------------------------- Author : gamehacker&zixian Mail :...
i.Mage 1.11 - Local Crash PoC
No description provided by source. !/usr/bin/python Exploit Title:i.Mage Local Crash Poc Homepage:http://www.memecode.com/image.php Software Link:http://sourceforge.net/projects/image-editor/files/i.mage-win32-v111.exe/download Version:i.i.Mage v1.11 Win32 Release Description:i.Mage is a small an...
VMware Workstations 10.0.0.40273 vmx86.sys Arbitrary Kernel Read
No description provided by source. Title: VMWare vmx86.sys Arbitrary Kernel Read Advisory ID: KL-001-2014-004 Publication Date: 2014.11.04 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-004.txt 1. Vulnerability Details Affected Vendor: VMWare Affected Product:...
ZTE ZXDSL 831CII - Insecure Direct Object Reference
No description provided by source. Exploit Title: ZTE ZXDSL 831 Insecure Direct Object Reference Date: 11/3/2014 Exploit Author: Paulos Yibelo Vendor Homepage: zte.com.cn Software Link: - Version: - Tested on: Windows 7 CVE :- ZTE ZXDSL 831CII suffers from an insecure direct object reference...
WebDisk+ 2.1 iOS - Code Execution Vulnerability
No description provided by source. Document Title: =============== WebDisk+ v2.1 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1349 Release Date: ============= 2014-10-23 Vulnerability Laboratory ID VL-ID:...
YourMembers Plugin - Blind SQL Injection
No description provided by source. Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin CVE: N/A Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007...
Drupal Core <= 7.32 - SQL Injection (PHP)
No description provided by source. ?php ----------------------------------------------------------------------------- Exploit Title: Drupal core 7.x - SQL Injection Date: Oct 16 2014 Exploit Author: Dustin Dörr Software Link: http://www.drupal.com/ Version: Drupal core 7.x versions prior to 7.32...
MS14-060 Microsoft Windows OLE Package Manager Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FILEFORMAT include...
Enalean Tuleap 7.4.99.5 - Remote Command Execution
No description provided by source. Vulnerability title: Tuleap = 7.4.99.5 Remote Command Execution in Enalean Tuleap CVE: CVE-2014-7178 Vendor: Enalean Product: Tuleap Affected version: 7.4.99.5 and earlier Fixed version: 7.5 Reported by: Jerzy Kramarz Details: Tuleap does not validate the syntax...
Binary File Descriptor Library (libbfd) - Out-of-Bounds Crash
No description provided by source. Many shell users, and certainly a lot of the people working in computer forensics or other fields of information security, have a habit of running /usr/bin/strings on binary files originating from the Internet. Their understanding is that the tool simply scans t...
MAARCH 1.4 - Arbitrary File Upload
No description provided by source. / Exploit Title: Maarch 1.4 Arbitrary file upload Google Dork: intext:"Maarch Maerys Archive v2.1 logo" Date: 29/10/2014 Exploit Author: Adrien Thierry Exploit Advisory: http://asylum.seraum.com/Security-Alert-GED-ECM-Maarch-Critical-Vulnerabilities.html Vendor...
Ammyy Admin 3.5 - RCE
No description provided by source. Mirror: http://www.exploit-db.com/sploits/aa0day.zip The Revenge of the Scammers This exploit is an 0day in Ammyy Admin http://www.ammyy.com/en/ a remote desktop type software that is well known for being the software that many fake tech support phone scammers...
Creative Contact Form (Wordpress 0.9.7 and Joomla 2.0.0) - Shell Upload Vulnerability
No description provided by source...
Windows OLE - Remote Code Execution "Sandworm" Exploit (MS14-060)
No description provided by source. !/usr/bin/python Windows OLE RCE Exploit MS14-060 CVE-2014-4114 Sandworm Author: Mike Czumak Tv3rn1x - @SecuritySift Written: 10/21/2014 Tested Platforms: Windows 7 SP1 w/ exploit script run on Kali Linux You are free to reuse this code in part or in whole wit...
Bacula-Web 5.2.10 /joblogs.php SQL注入漏洞
No description provided by source...
ncredible PBX 2.0.6.5.0 - Remote Command Execution
No description provided by source. !/usr/bin/perl Title: Incredible PBX remote command execution exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Discovered: 1 September 2014 Coded: 21 October 2014 Published: 21 October 2014 MorXploit Research http://www.MorXploit.com Vendor: PBX in a...
IBM Tivoli Monitoring 6.2.2 kbbacf1 - Privilege Escalation
No description provided by source. !/bin/sh Title: IBM Tivoli Monitoring V6.2.2 kbbacf1 privilege escalation exploit CVE: CVE-2013-5467 Vendor Homepage: http://www-03.ibm.com/software/products/pl/tivomoni Author: Robert Jaroszuk Tested on: RedHat 5, Centos 5 Vulnerable version: IBM Tivoli...
DotNetNuke DNNspot Store 3.0.0 Arbitary File Upload
No description provided by source. Exploit Title: DotNetNuke DNNspot Store UploadifyHandler.ashx = 3.0.0 Arbitary File Upload Date: 23/01/2014 Author: Glafkos Charalambous Version: 3.0.0 Vendor: DNNspot Vendor URL: https://www.dnnspot.com Google Dork: inurl:/DesktopModules/DNNspot-Store/ root@kal...
XCloner Wordpress/Joomla! Plugin - Multiple Vulnerabilities
No description provided by source. Title: XCloner Wordpress/Joomla! backup Plugin v3.1.1 Wordpress v3.5.1 Joomla! Vulnerabilities Author: Larry W. Cashdollar, @larry0 Date: 10/17/2014 Download: https://wordpress.org/plugins/xcloner-backup-and-restore/ Download:...
Belkin n750 jump login Parameter Buffer Overflow
No description provided by source. """ Source: https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/ A vulnerability in the guest network web interface of the Belkin N750 DB Wi-Fi Dual-Band N+ Gigabit Router with firmware F9K1103WW1.10.16m, allows ...
某学科竞赛系统存在SQL注入漏洞
简要描述： RT 详细说明： 南京先极科技有限公司的学科竞赛系统存在SQL注入漏洞 前人也有提交这个公司的，我就写5个案例 注入连接：MoreNews.aspx?NewsType=DongTai 案例： mask 区域 1.http://.. /xkjs/MoreNews.aspx?NewsType=TongZhi mask 区域 1.http://.. /js/MoreNews.aspx?NewsType=TongZhi mask 区域 1.http://.. /xkjs/MoreNews.aspx?NewsType=TongZhi mask 区域 1.http://...
phpSound Music Sharing Platform 1.0.5 - Multiple XSS Vulnerabilities
No description provided by source. Exploit Title: phpSound Music Sharing Platform Multiple XSS Vulnerabilities Date: 08-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.0.5 Vendor Link: http://codecanyon.net/item/phpsound-music-sharing-platform/9016117 Software Test Link:...
Croogo 2.0.0 - Multiple Stored XSS Vulnerabilities
No description provided by source. Croogo 2.0.0 Multiple Stored XSS Vulnerabilities Vendor: Fahad Ibnay Heylaal Product web page: http://www.croogo.org Affected version: 2.0.0 Summary: Croogo is a free, open source, content management system for PHP, released under The MIT License. It is powered...
Drupal Core <= 7.32 - SQL Injection (#1)
No description provided by source...
vBulletin Tapatalk - Blind SQL Injection
No description provided by source. !/usr/bin/env python -- coding: utf-8 -- ''' @author: tintinweb 0x721427D8 ''' import urllib2, urllib import xmlrpclib,re, urllib2,string,itertools,time from distutils.version import LooseVersion class Exploitobject: def initself, target, debug=0 :...
File Manager 4.2.10 iOS - Code Execution Vulnerability
No description provided by source. Document Title: =============== File Manager v4.2.10 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1343 Release Date: ============= 2014-10-21 Vulnerability Laboratory ID VL-ID:...
HP Data Protector EXEC_INTEGUTIL Remote Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Tcp include...
MINIX 3.3.0 Local Denial of Service PoC
No description provided by source. Exploit Title: MINIX 3.3.0 Local Denial of Service Exploit Author: nitr0us Vendor Homepage: www.minix3.org Software Link: http://www.minix3.org/download/index.html Version: 3.3.0 Tested on: MINIX 3.3.0 x86 Attached three PoCs malformed ELFs and a screenshot of t...
Linux Local Root => 2.6.39 (32-bit & 64-bit) - Mempodipper #2
No description provided by source. /Exploit code is here: http://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c Blog post about it is here: http://blog.zx2c4.com/749 / / Mempodipper by zx2c4 Linux Local Root Exploit Rather than put my write up here, per usual, this time I've put it in a rather...
Joomla Akeeba Kickstart Unserialize Remote Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' require 'json' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include...
wordpress infusionsoft 1.5.10 /wp-content/plugins/infusionsoft/Infusionsoft/utilities/code_generator.php 文件上传漏洞
No description provided by source...
Internet Explorer 8 MS14-035 Use-After-Free Exploit
影响平台： Windows Server 2003 Service Pack 2 Windows Vista Service Pack 2 Windows Server 2008 Service Pack 2 Windows 7 Service Pack 1 Windows Server 2008 R2 Service Pack 1 漏洞简介： 这个漏洞是由TrendLabs私下发给微软，并且成为微软14年6月份补丁，编号MS14-035。尽管这个漏洞已经修复，这是个值得学习的UAF案例。 触发这个漏洞的POC如下： !-- Exploit Title: MS14-035...
Mac OS X Mavericks IOBluetoothHCIUserClient Privilege Escalation
No description provided by source. / pwn.c, by @rpaleari and @joystick This PoC exploits a missing sign check in IOBluetoothHCIUserClient::SimpleDispatchWL. Tested on Mac OS X Mavericks 10.9.4/10.9.5. Compile with: gcc -Wall -o pwn,.c -framework IOKit / include stdio.h include string.h include...
Telefonica O2 Connection Manager 8.7 - Service Trusted Path Privilege Escalation
No description provided by source. Telefonica O2 Connection Manager 8.7 Service Trusted Path Privilege Escalation Vendor: Telefonica S.A. Product web page: http://www.telefonica.com | http://www.o2.co.uk Affected version: 8.7.6.792 Summary: O2 Connection Manager will help you to manage your...
PHP-Fusion 7.02.07 - SQL Injection
No description provided by source. Exploit Title: PHP-Fusion 7.02.07 SQL Injection Date: 06/11/2014 Exploit Author: Mauricio Correa Vendor Homepage: www.php-fusion.co.uk Software Link: http://ufpr.dl.sourceforge.net/project/php-fusion/PHP-Fusion%20Archives/7.x/ PHP-Fusion-7.02.07.zip Version:...
CorelDRAW X7 CDR File (CdrTxt.dll) Off-By-One Stack Corruption Vulnerability
No description provided by source. CorelDRAW X7 CDR File CdrTxt.dll Off-By-One Stack Corruption Vulnerability Vendor: Corel Corporation Product web page: http://www.corel.com Affected version: 17.1.0.572 X7 - 32bit/64bit EN 15.0.0.486 X5 - 32bit EN Summary: CorelDRAW is one of the image-creating...
Numara / BMC Track-It! FileStorageService Arbitrary File Upload
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...
X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...
Croogo 2.0.0 - Arbitrary PHP Code Execution Exploit
No description provided by source. !/usr/bin/env python Croogo 2.0.0 Arbitrary PHP Code Execution Exploit Vendor: Fahad Ibnay Heylaal Product web page: http://www.croogo.org Affected version: 2.0.0 Summary: Croogo is a free, open source, content management system for PHP, released under The MIT...
ZTE ZXDSL-931VII - Unauthenticated Configuration Dump
No description provided by source. Exploit Title: ZTE ZXDSL-931VII Unauthenticated Configuration Dump Google Dork: use your imagination Date: 09-12-2014 Exploit Author: L0ukanik0sGR Vendor Homepage: www.zte.com.cn Software Link:...
Filemaker Pro 13.03 & Advanced 12.04 - Login Bypass and Privilege Escalation
No description provided by source. Filemaker Login Bypass and Privilege Escalation ======================================================================= ADVISORY INFORMATION Title: Filemaker Login Bypass and Privilege Escalation Discovery date: 19/10/2014 Release date: 19/10/2014 Vendor Homepag...
Magento Server MAGMI Plugin - Remote File Inclusion (RFI)
No description provided by source. Exploit found date: 10/24/2014 Security Researcher name: Parvinder Bhasin Contact info: [email protected] twitter: @parvinderb - scorpio Currently tested version: Magento version: Magento CE - 1.8 older MAGMI version: v0.7.17a older Download software...
Drupal Core <= 7.32 - SQL Injection (#2)
No description provided by source. !/usr/bin/python Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Inspired by yukyuk's P.o.C https://www.reddit.com/user/fyukyuk Tested on Drupal 7.31 with BackBox 3.x This material is intended for educational purposes only and t...