bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2017-01-07

Browse source 
1 new exploits

Google Android max86902 Driver - 'sysfs' Interfaces Race Condition

Microsoft Windows 10 Edge - 'chakra.dll' Info Leak / Type Confusion Remote Code Execution
Microsoft Edge (Windows 10) - 'chakra.dll' Info Leak / Type Confusion Remote Code Execution

doop CMS 1.3.7 - (page) Local File Inclusion
doop CMS 1.3.7 - Local File Inclusion

Basic-CMS - 'acm2000.mdb' Remote Database Disclosure
Basic-CMS - Remote Database Disclosure

CMS NetCat 3.12 - (password_recovery.php) Blind SQL Injection
CMS NetCat 3.12 - 'password_recovery.php' Blind SQL Injection
StormBoard 1.0.1 - (thread.php id) SQL Injection
Joomla! Component com_lowcosthotels - 'id' Blind SQL Injection
Joomla! Component com_allhotels - 'id' Blind SQL Injection
StormBoard 1.0.1 - SQL Injection
Joomla! Component com_lowcosthotels - Blind SQL Injection
Joomla! Component com_allhotels - Blind SQL Injection

ILIAS 3.7.4 - (ref_id) Blind SQL Injection
ILIAS 3.7.4 - 'ref_id' Parameter Blind SQL Injection
Joomla! Component Live Ticker 1.0 - (tid) Blind SQL Injection
Joomla! Component mdigg 2.2.8 - (category) SQL Injection
Joomla! Component 5starhotels - 'id' SQL Injection
Joomla! Component Live Ticker 1.0 - Blind SQL Injection
Joomla! Component mDigg 2.2.8 - 'category' Parameter SQL Injection
Joomla! Component 5starhotels - SQL Injection

W2B phpEmployment - 'conf.inc' File Disclosure
phpEmployment - 'conf.inc' File Disclosure

phpGreetCards - 'conf.inc' Config File Disclosure
phpGreetCards - Config File Disclosure

Joomla! Component 'com_bca-rss-syndicator' - Local File Inclusion
Joomla! Component com_bca-rss-syndicator - Local File Inclusion

Joomla! Component 'com_appointment' 1.5 - Local File Inclusion
Joomla! Component Appointment 1.5 - Local File Inclusion

Joomla! Component 'com_awiki' - Local File Inclusion
Joomla! Component aWiki - Local File Inclusion

Joomla! Component 'com_articles' - SQL Injection
Joomla! Component com_articles - SQL Injection

Joomla! Component 'com_allvideos' - Blind SQL Injection
Joomla! Component allvideos - Blind SQL Injection

Joomla! Component 'Card View JX' - Cross-Site Scripting
Joomla! Component Card View JX - Cross-Site Scripting

Joomla! Component 'com_articleman' - Arbitrary File Upload
Joomla! Component Article Factory Manager - Arbitrary File Upload

Joomla! Component 'com_aardvertiser' 2.0 - Local File Inclusion
Joomla! Component aardvertiser 2.0 - Local File Inclusion

Joomla! Component 'com_annonces' - Arbitrary File Upload
Joomla! Component com_annonces - Arbitrary File Upload

Joomla! Component 'com_answers' 2.3beta - Multiple Vulnerabilities
Joomla! Component Answers 2.3beta - Multiple Vulnerabilities

Joomla! Component 'com_beamospetition' - SQL Injection
Joomla! Component com_beamospetition - SQL Injection

Joomla! Component 'com_biblioteca' 1.0 Beta - Multiple SQL Injections
Joomla! Component Biblioteca 1.0 Beta - Multiple SQL Injections

Joomla! Component 'btg_oglas' - HTML / Cross-Site Scripting Injection
Joomla! Component btg_oglas - HTML / Cross-Site Scripting Injection

Joomla! Component 'com_alfurqan15x' - SQL Injection
Joomla! Component com_alfurqan15x - SQL Injection

Joomla! Component 'com_adsmanager' - Remote File Inclusion
Joomla! Component com_adsmanager - Remote File Inclusion

Joomla! Component 'com_acooldebate' 1.0.3 - Local File Inclusion
Joomla! Component A Cool Debate 1.0.3 - Local File Inclusion

Joomla! Component 'com_a3000' - 'id' Parameter SQL Injection
Joomla! Component AutoArticles 3000 - SQL Injection

Joomla! Component 'com_annuaire' - 'id' Parameter SQL Injection
Joomla! Component Annuaire - Parameter SQL Injection

Joomla! Component 'com_alfcontact' 1.9.3 - Multiple Cross-Site Scripting Vulnerabilities
Joomla! Component com_alfcontact 1.9.3 - Multiple Cross-Site Scripting Vulnerabilities

Joomla! Component 'com_bbs' - Multiple SQL Injections
Joomla! Component com_bbs - Multiple SQL Injections

Joomla! Component 'com_aclassfb' - Arbitrary File Upload
Joomla! Component Almond Classifieds - Arbitrary File Upload

Atlassian Confluence 5.9.12 - Persistent Cross-Site Scripting
Atlassian Confluence < 5.10.6 - Persistent Cross-Site Scripting
This commit is contained in:
Offensive Security 2017-01-07 05:01:17 +00:00
parent 127a1da37b
commit 7ef2cb97bd
3 changed files with 98 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

71
files.csv
View file

@ -4097,6 +4097,7 @@ id,file,description,date,author,platform,type,port
32596,platforms/multiple/dos/32596.txt,"GeSHi 1.0.x - XML Parsing Remote Denial of Service",2008-11-20,"Christian Hoffmann",multiple,dos,0
32657,platforms/windows/dos/32657.py,"Nokia N70 and N73 - Malformed OBEX Name Header Remote Denial of Service",2008-12-12,NCNIPC,windows,dos,0
32763,platforms/windows/dos/32763.html,"Microsoft Internet Explorer 7 - HTML Form Value Denial of Service",2009-01-28,"Juan Pablo Lopez Yacubian",windows,dos,0
40993,platforms/android/dos/40993.txt,"Google Android max86902 Driver - 'sysfs' Interfaces Race Condition",2017-01-06,"Google Security Research",android,dos,0
32675,platforms/linux/dos/32675.py,"QEMU 0.9 / KVM 36/79 - VNC Server Remote Denial of Service",2008-12-22,"Alfredo Ortega",linux,dos,0
32682,platforms/linux/dos/32682.c,"Linux Kernel 2.6.x - 'qdisc_run()' Local Denial of Service",2008-12-23,"Herbert Xu",linux,dos,0
32688,platforms/windows/dos/32688.py,"Winace 2.2 - Malformed Filename Remote Denial of Service",2008-12-29,cN4phux,windows,dos,0
@ -15199,7 +15200,7 @@ id,file,description,date,author,platform,type,port
40949,platforms/cgi/remote/40949.rb,"NETGEAR WNR2000v5 - Remote Code Execution",2016-12-21,"Pedro Ribeiro",cgi,remote,80
40963,platforms/linux/remote/40963.txt,"OpenSSH < 7.4 - agent Protocol Arbitrary Library Loading",2016-12-23,"Google Security Research",linux,remote,22
40984,platforms/windows/remote/40984.py,"Internet Download Accelerator 6.10.1.1527 - FTP Buffer Overflow (SEH)",2017-01-02,"Fady Mohammed Osman",windows,remote,0
40990,platforms/windows/remote/40990.txt,"Microsoft Windows 10 Edge - 'chakra.dll' Info Leak / Type Confusion Remote Code Execution",2017-01-05,"Brian Pak",windows,remote,0
40990,platforms/windows/remote/40990.txt,"Microsoft Edge (Windows 10) - 'chakra.dll' Info Leak / Type Confusion Remote Code Execution",2017-01-05,"Brian Pak",windows,remote,0
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
@ -18015,7 +18016,7 @@ id,file,description,date,author,platform,type,port
4527,platforms/php/webapps/4527.txt,"Softbiz Recipes Portal Script - SQL Injection",2007-10-13,"Khashayar Fereidani",php,webapps,0
4528,platforms/php/webapps/4528.txt,"KwsPHP 1.0 mg2 Module - SQL Injection",2007-10-13,"Mehmet Ince",php,webapps,0
4529,platforms/cgi/webapps/4529.txt,"WWWISIS 7.1 - (IsisScript) Local File Disclosure / Cross-Site Scripting",2007-10-13,JosS,cgi,webapps,0
4536,platforms/php/webapps/4536.txt,"doop CMS 1.3.7 - (page) Local File Inclusion",2007-10-15,vladii,php,webapps,0
4536,platforms/php/webapps/4536.txt,"doop CMS 1.3.7 - Local File Inclusion",2007-10-15,vladii,php,webapps,0
4538,platforms/php/webapps/4538.txt,"Artmedic CMS 3.4 - 'index.php' Local File Inclusion",2007-10-16,iNs,php,webapps,0
4539,platforms/php/webapps/4539.txt,"Okul Otomasyon Portal 2.0 - SQL Injection",2007-10-16,dumenci,php,webapps,0
4543,platforms/php/webapps/4543.txt,"PHPDJ 0.5 - 'djpage.php' Remote File Inclusion",2007-10-17,GoLd_M,php,webapps,0
@ -20091,7 +20092,7 @@ id,file,description,date,author,platform,type,port
7256,platforms/php/webapps/7256.txt,"Turnkey Arcade Script - SQL Injection (1)",2008-11-27,The_5p3ctrum,php,webapps,0
7258,platforms/php/webapps/7258.txt,"Ocean12 FAQ Manager Pro - Database Disclosure",2008-11-27,Stack,php,webapps,0
7259,platforms/asp/webapps/7259.txt,"Comersus ASP Shopping Cart - File Disclosure / Cross-Site Scripting",2008-11-27,Bl@ckbe@rD,asp,webapps,0
7260,platforms/php/webapps/7260.txt,"Basic-CMS - 'acm2000.mdb' Remote Database Disclosure",2008-11-28,Stack,php,webapps,0
7260,platforms/php/webapps/7260.txt,"Basic-CMS - Remote Database Disclosure",2008-11-28,Stack,php,webapps,0
7261,platforms/php/webapps/7261.txt,"Basic-CMS - Blind SQL Injection",2008-11-28,"CWH Underground",php,webapps,0
7263,platforms/php/webapps/7263.txt,"Booking Centre 2.01 - Authentication Bypass",2008-11-28,MrDoug,php,webapps,0
7265,platforms/php/webapps/7265.txt,"Web Calendar System 3.40 - Cross-Site Scripting / SQL Injection",2008-11-28,Bl@ckbe@rD,php,webapps,0
@ -20337,20 +20338,20 @@ id,file,description,date,author,platform,type,port
7553,platforms/php/webapps/7553.sh,"Roundcube Webmail 0.2b - Remote Code Execution",2008-12-22,Hunger,php,webapps,0
7557,platforms/php/webapps/7557.txt,"PHPmotion 2.1 - Cross-Site Request Forgery",2008-12-23,Ausome1,php,webapps,0
7558,platforms/php/webapps/7558.txt,"PHPLD 3.3 - Blind SQL Injection",2008-12-23,fuzion,php,webapps,0
7559,platforms/php/webapps/7559.php,"CMS NetCat 3.12 - (password_recovery.php) Blind SQL Injection",2008-12-23,s4avrd0w,php,webapps,0
7559,platforms/php/webapps/7559.php,"CMS NetCat 3.12 - 'password_recovery.php' Blind SQL Injection",2008-12-23,s4avrd0w,php,webapps,0
7560,platforms/php/webapps/7560.txt,"CMS NetCat 3.12 - Multiple Vulnerabilities",2008-12-23,s4avrd0w,php,webapps,0
7561,platforms/php/webapps/7561.txt,"phpGreetCards - Cross-Site Scripting / Arbitrary File Upload",2008-12-23,ahmadbady,php,webapps,0
7562,platforms/php/webapps/7562.txt,"PHPAdBoard - (PHP uploads) Arbitrary File Upload",2008-12-23,ahmadbady,php,webapps,0
7563,platforms/php/webapps/7563.txt,"phpEmployment - (PHP upload) Arbitrary File Upload",2008-12-23,ahmadbady,php,webapps,0
7565,platforms/php/webapps/7565.txt,"StormBoard 1.0.1 - (thread.php id) SQL Injection",2008-12-23,Samir-M,php,webapps,0
7567,platforms/php/webapps/7567.txt,"Joomla! Component com_lowcosthotels - 'id' Blind SQL Injection",2008-12-23,"Hussin X",php,webapps,0
7568,platforms/php/webapps/7568.txt,"Joomla! Component com_allhotels - 'id' Blind SQL Injection",2008-12-23,"Hussin X",php,webapps,0
7565,platforms/php/webapps/7565.txt,"StormBoard 1.0.1 - SQL Injection",2008-12-23,Samir-M,php,webapps,0
7567,platforms/php/webapps/7567.txt,"Joomla! Component com_lowcosthotels - Blind SQL Injection",2008-12-23,"Hussin X",php,webapps,0
7568,platforms/php/webapps/7568.txt,"Joomla! Component com_allhotels - Blind SQL Injection",2008-12-23,"Hussin X",php,webapps,0
7569,platforms/php/webapps/7569.txt,"doop CMS 1.4.0b - Cross-Site Request Forgery / Arbitrary File Upload",2008-12-24,x0r,php,webapps,0
7570,platforms/php/webapps/7570.txt,"ILIAS 3.7.4 - (ref_id) Blind SQL Injection",2008-12-24,Lidloses_Auge,php,webapps,0
7570,platforms/php/webapps/7570.txt,"ILIAS 3.7.4 - 'ref_id' Parameter Blind SQL Injection",2008-12-24,Lidloses_Auge,php,webapps,0
7572,platforms/php/webapps/7572.txt,"Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection",2008-12-24,boom3rang,php,webapps,0
7573,platforms/php/webapps/7573.txt,"Joomla! Component Live Ticker 1.0 - (tid) Blind SQL Injection",2008-12-24,boom3rang,php,webapps,0
7574,platforms/php/webapps/7574.txt,"Joomla! Component mdigg 2.2.8 - (category) SQL Injection",2008-12-24,boom3rang,php,webapps,0
7575,platforms/php/webapps/7575.pl,"Joomla! Component 5starhotels - 'id' SQL Injection",2008-12-24,EcHoLL,php,webapps,0
7573,platforms/php/webapps/7573.txt,"Joomla! Component Live Ticker 1.0 - Blind SQL Injection",2008-12-24,boom3rang,php,webapps,0
7574,platforms/php/webapps/7574.txt,"Joomla! Component mDigg 2.2.8 - 'category' Parameter SQL Injection",2008-12-24,boom3rang,php,webapps,0
7575,platforms/php/webapps/7575.pl,"Joomla! Component 5starhotels - SQL Injection",2008-12-24,EcHoLL,php,webapps,0
7576,platforms/php/webapps/7576.pl,"PHP-Fusion 7.0.2 - Blind SQL Injection",2008-12-24,StAkeR,php,webapps,0
7579,platforms/php/webapps/7579.txt,"ClaSS 0.8.60 - (export.php ftype) Local File Inclusion",2008-12-24,fuzion,php,webapps,0
7580,platforms/php/webapps/7580.txt,"BloofoxCMS 0.3.4 - 'lang' Local File Inclusion",2008-12-24,fuzion,php,webapps,0
@ -20849,10 +20850,10 @@ id,file,description,date,author,platform,type,port
8431,platforms/php/webapps/8431.txt,"GuestCal 2.1 - (index.php lang) Local File Inclusion",2009-04-14,SirGod,php,webapps,0
8432,platforms/php/webapps/8432.txt,"Aqua CMS - 'Username' SQL Injection",2009-04-14,halkfild,php,webapps,0
8433,platforms/php/webapps/8433.txt,"RQms (Rash) 1.2.2 - Multiple SQL Injections",2009-04-14,Dimi4,php,webapps,0
8435,platforms/php/webapps/8435.txt,"W2B phpEmployment - 'conf.inc' File Disclosure",2009-04-14,InjEctOr5,php,webapps,0
8435,platforms/php/webapps/8435.txt,"phpEmployment - 'conf.inc' File Disclosure",2009-04-14,InjEctOr5,php,webapps,0
8436,platforms/php/webapps/8436.txt,"Job2C 4.2 - (profile) Arbitrary File Upload",2009-04-15,InjEctOr5,php,webapps,0
8437,platforms/php/webapps/8437.txt,"phpAdBoard - 'conf.inc' Remote Config File Disclosure",2009-04-15,InjEctOr5,php,webapps,0
8438,platforms/php/webapps/8438.txt,"phpGreetCards - 'conf.inc' Config File Disclosure",2009-04-15,InjEctOr5,php,webapps,0
8438,platforms/php/webapps/8438.txt,"phpGreetCards - Config File Disclosure",2009-04-15,InjEctOr5,php,webapps,0
8439,platforms/php/webapps/8439.txt,"W2B Restaurant 1.2 - (conf.inc) Config File Disclosure",2009-04-15,InjEctOr5,php,webapps,0
8440,platforms/php/webapps/8440.txt,"phpAdBoardPro - 'config.inc' Config File Disclosure",2009-04-15,InjEctOr5,php,webapps,0
8441,platforms/php/webapps/8441.txt,"phpDatingClub - 'conf.inc' File Disclosure",2009-04-15,InjEctOr5,php,webapps,0
@ -22818,7 +22819,7 @@ id,file,description,date,author,platform,type,port
12066,platforms/php/webapps/12066.txt,"Joomla! Component SVMap 1.1.1 - Local File Inclusion",2010-04-05,Vrs-hCk,php,webapps,0
12067,platforms/php/webapps/12067.txt,"Joomla! Component Shoutbox Pro - Local File Inclusion",2010-04-05,Vrs-hCk,php,webapps,0
12068,platforms/php/webapps/12068.txt,"Joomla! Component LoginBox - Local File Inclusion",2010-04-05,Vrs-hCk,php,webapps,0
12069,platforms/php/webapps/12069.txt,"Joomla! Component 'com_bca-rss-syndicator' - Local File Inclusion",2010-04-05,Vrs-hCk,php,webapps,0
12069,platforms/php/webapps/12069.txt,"Joomla! Component com_bca-rss-syndicator - Local File Inclusion",2010-04-05,Vrs-hCk,php,webapps,0
12070,platforms/php/webapps/12070.txt,"Joomla! Component Magic Updater - Local File Inclusion",2010-04-05,Vrs-hCk,php,webapps,0
12071,platforms/php/webapps/12071.txt,"jevoncms - Local File Inclusion / Remote File Inclusion",2010-04-05,eidelweiss,php,webapps,0
12075,platforms/php/webapps/12075.txt,"LionWiki 3.x - 'index.php' Arbitrary File Upload",2010-04-05,ayastar,php,webapps,0
@ -22832,18 +22833,18 @@ id,file,description,date,author,platform,type,port
12086,platforms/php/webapps/12086.txt,"Joomla! Component Highslide 1.5 - Local File Inclusion",2010-04-06,AntiSecurity,php,webapps,0
12087,platforms/php/webapps/12087.txt,"Joomla! Component Fabrik 2.0 - Local File Inclusion",2010-04-06,AntiSecurity,php,webapps,0
12088,platforms/php/webapps/12088.txt,"Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion",2010-04-06,AntiSecurity,php,webapps,0
12089,platforms/php/webapps/12089.txt,"Joomla! Component 'com_appointment' 1.5 - Local File Inclusion",2010-04-06,AntiSecurity,php,webapps,0
12089,platforms/php/webapps/12089.txt,"Joomla! Component Appointment 1.5 - Local File Inclusion",2010-04-06,AntiSecurity,php,webapps,0
12092,platforms/hardware/webapps/12092.txt,"McAfee Email Gateway (formerly IronMail) - Cross-Site Scripting",2010-04-06,"Nahuel Grisolia",hardware,webapps,0
12094,platforms/php/webapps/12094.txt,"ShopSystem - SQL Injection",2010-04-06,Valentin,php,webapps,0
12097,platforms/php/webapps/12097.txt,"Joomla! Component XOBBIX 1.0 - 'prodid' Parameter SQL Injection",2010-04-06,AntiSecurity,php,webapps,0
12098,platforms/php/webapps/12098.txt,"WordPress Plugin NextGEN Gallery 1.5.1 - Cross-Site Scripting",2010-04-06,"Alejandro Rodriguez",php,webapps,0
12100,platforms/asp/webapps/12100.txt,"Espinas CMS - SQL Injection",2010-04-07,"Pouya Daneshmand",asp,webapps,0
12101,platforms/php/webapps/12101.txt,"Joomla! Component 'com_awiki' - Local File Inclusion",2010-04-07,"Angela Zhang",php,webapps,0
12101,platforms/php/webapps/12101.txt,"Joomla! Component aWiki - Local File Inclusion",2010-04-07,"Angela Zhang",php,webapps,0
12102,platforms/php/webapps/12102.txt,"Joomla! Component VJDEO 1.0 - Local File Inclusion",2010-04-07,"Angela Zhang",php,webapps,0
12105,platforms/php/webapps/12105.txt,"Free Image & File Hosting - Arbitrary File Upload",2010-04-07,indoushka,php,webapps,0
12106,platforms/php/webapps/12106.txt,"Istgah for Centerhost - Multiple Vulnerabilities",2010-04-07,indoushka,php,webapps,0
12107,platforms/php/webapps/12107.txt,"Plume CMS 1.2.4 - Multiple Local File Inclusion",2010-04-07,eidelweiss,php,webapps,0
12108,platforms/php/webapps/12108.txt,"Joomla! Component 'com_articles' - SQL Injection",2010-04-08,"pratul agrawal",php,webapps,0
12108,platforms/php/webapps/12108.txt,"Joomla! Component com_articles - SQL Injection",2010-04-08,"pratul agrawal",php,webapps,0
12111,platforms/php/webapps/12111.txt,"Joomla! Component 'com_webeecomment' 2.0 - Local File Inclusion",2010-04-08,AntiSecurity,php,webapps,0
12112,platforms/php/webapps/12112.txt,"Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion",2010-04-08,AntiSecurity,php,webapps,0
12113,platforms/php/webapps/12113.txt,"Joomla! Component com_awdwall 1.5.4 - Local File Inclusion / SQL Injection",2010-04-08,AntiSecurity,php,webapps,0
@ -22859,7 +22860,7 @@ id,file,description,date,author,platform,type,port
12134,platforms/php/webapps/12134.txt,"MMHAQ CMS - SQL Injection",2010-04-10,s1ayer,php,webapps,0
12135,platforms/php/webapps/12135.txt,"mygamingladder MGL Combo System 7.5 - SQL Injection",2010-04-10,"Easy Laster",php,webapps,0
12136,platforms/php/webapps/12136.txt,"Joomla! Component Real Estate Property 3.1.22-03 - 'aid' Parameter SQL Injection",2010-04-10,c4uR,php,webapps,0
12137,platforms/php/webapps/12137.txt,"Joomla! Component 'com_allvideos' - Blind SQL Injection",2010-04-10,bumble_be,php,webapps,0
12137,platforms/php/webapps/12137.txt,"Joomla! Component allvideos - Blind SQL Injection",2010-04-10,bumble_be,php,webapps,0
12138,platforms/php/webapps/12138.txt,"Joomla! Component 'com_ca' - SQL Injection",2010-04-10,DigitALL,php,webapps,0
12139,platforms/php/webapps/12139.txt,"Kiasabz Article News CMS Magazine - SQL Injection",2010-04-10,indoushka,php,webapps,0
12140,platforms/php/webapps/12140.php,"xBtiTracker - SQL Injection",2010-04-11,InATeam,php,webapps,0
@ -23080,7 +23081,7 @@ id,file,description,date,author,platform,type,port
12471,platforms/asp/webapps/12471.txt,"Comersus 8 Shopping Cart - SQL Injection / Cross-Site Request Forgery",2010-05-01,Sid3^effects,asp,webapps,0
12472,platforms/php/webapps/12472.txt,"CF Image Host 1.1 - Remote File Inclusion",2010-05-01,The.Morpheus,php,webapps,0
12473,platforms/php/webapps/12473.txt,"Joomla! Component 'Table JX' - Cross-Site Scripting",2010-05-01,Valentin,php,webapps,0
12474,platforms/php/webapps/12474.txt,"Joomla! Component 'Card View JX' - Cross-Site Scripting",2010-05-01,Valentin,php,webapps,0
12474,platforms/php/webapps/12474.txt,"Joomla! Component Card View JX - Cross-Site Scripting",2010-05-01,Valentin,php,webapps,0
12475,platforms/php/webapps/12475.txt,"Opencatalogue 1.024 - Local File Inclusion",2010-05-01,cr4wl3r,php,webapps,0
12476,platforms/php/webapps/12476.txt,"Opencimetiere 2.01 - Multiple Remote File Inclusion",2010-05-01,cr4wl3r,php,webapps,0
12478,platforms/asp/webapps/12478.txt,"Mesut Manþet Haber 1.0 - Authentication Bypass",2010-05-02,LionTurk,asp,webapps,0
@ -23113,7 +23114,7 @@ id,file,description,date,author,platform,type,port
12533,platforms/php/webapps/12533.txt,"big.asp - SQL Injection",2010-05-08,Ra3cH,php,webapps,0
12534,platforms/php/webapps/12534.txt,"PHP Link Manager 1.7 - URL Redirection",2010-05-08,ITSecTeam,php,webapps,0
12535,platforms/php/webapps/12535.txt,"phpscripte24 Countdown Standart Rückwärts Auktions System - SQL Injection",2010-05-08,"Easy Laster",php,webapps,0
12539,platforms/php/webapps/12539.txt,"Joomla! Component 'com_articleman' - Arbitrary File Upload",2010-05-08,Sid3^effects,php,webapps,0
12539,platforms/php/webapps/12539.txt,"Joomla! Component Article Factory Manager - Arbitrary File Upload",2010-05-08,Sid3^effects,php,webapps,0
12542,platforms/php/webapps/12542.rb,"phpscripte24 Shop System - SQL Injection",2010-05-09,"Easy Laster",php,webapps,0
12543,platforms/php/webapps/12543.rb,"Alibaba Clone 3.0 (Special) - SQL Injection",2010-05-09,"Easy Laster",php,webapps,0
12544,platforms/php/webapps/12544.rb,"Alibaba Clone Diamond Version - SQL Injection",2010-05-09,"Easy Laster",php,webapps,0
@ -23149,7 +23150,7 @@ id,file,description,date,author,platform,type,port
12586,platforms/php/webapps/12586.php,"IPB 3.0.1 - SQL Injection",2010-05-13,Cryptovirus,php,webapps,0
12590,platforms/php/webapps/12590.txt,"Joomla! Component Komento 1.0.0 - 'sid' Parameter SQL Injection",2010-05-13,c4uR,php,webapps,0
12591,platforms/php/webapps/12591.txt,"BlaB! Lite 0.5 - Remote File Inclusion",2010-05-13,"Sn!pEr.S!Te Hacker",php,webapps,0
12592,platforms/php/webapps/12592.txt,"Joomla! Component 'com_aardvertiser' 2.0 - Local File Inclusion",2010-05-13,eidelweiss,php,webapps,0
12592,platforms/php/webapps/12592.txt,"Joomla! Component aardvertiser 2.0 - Local File Inclusion",2010-05-13,eidelweiss,php,webapps,0
12593,platforms/php/webapps/12593.txt,"damianov.net Shoutbox - Cross-Site Scripting",2010-05-13,"Valentin Hoebel",php,webapps,0
12594,platforms/php/webapps/12594.txt,"Joomla! Component 'com_sebercart' - 'getPic.php' Local File Disclosure",2010-05-13,AntiSecurity,php,webapps,0
12595,platforms/php/webapps/12595.txt,"Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion",2010-05-13,"Chip d3 bi0s",php,webapps,0
@ -23349,7 +23350,7 @@ id,file,description,date,author,platform,type,port
13745,platforms/php/webapps/13745.txt,"Sphider Script - Remote Code Execution",2010-06-06,XroGuE,php,webapps,0
13746,platforms/php/webapps/13746.txt,"Joomla! Component Search Log 3.1.0 - SQL Injection",2010-06-06,d0lc3,php,webapps,0
13747,platforms/php/webapps/13747.txt,"PHP Car Rental Complete System 1.2 - SQL Injection",2010-06-06,Sid3^effects,php,webapps,0
13748,platforms/php/webapps/13748.txt,"Joomla! Component 'com_annonces' - Arbitrary File Upload",2010-06-06,Sid3^effects,php,webapps,0
13748,platforms/php/webapps/13748.txt,"Joomla! Component com_annonces - Arbitrary File Upload",2010-06-06,Sid3^effects,php,webapps,0
13749,platforms/php/webapps/13749.txt,"idevspot Text ads 2.08 - SQL Injection",2010-06-06,Sid3^effects,php,webapps,0
13750,platforms/php/webapps/13750.txt,"WebBiblio Subject Gateway System - Local File Inclusion",2010-06-06,AntiSecurity,php,webapps,0
13751,platforms/php/webapps/13751.txt,"greeting card - Arbitrary File Upload",2010-06-06,Mr.Benladen,php,webapps,0
@ -23459,7 +23460,7 @@ id,file,description,date,author,platform,type,port
13916,platforms/php/webapps/13916.txt,"PHP-Nuke Module print 6.0 - (print&sid) SQL Injection",2010-06-17,Gamoscu,php,webapps,0
13918,platforms/multiple/webapps/13918.txt,"Spring Framework - Arbitrary code Execution",2010-06-18,"Meder Kydyraliev",multiple,webapps,0
13922,platforms/php/webapps/13922.txt,"Joomla! Component 'com_joomdocs' - Cross-Site Scripting",2010-06-18,Sid3^effects,php,webapps,0
13923,platforms/php/webapps/13923.txt,"Joomla! Component 'com_answers' 2.3beta - Multiple Vulnerabilities",2010-06-18,jdc,php,webapps,0
13923,platforms/php/webapps/13923.txt,"Joomla! Component Answers 2.3beta - Multiple Vulnerabilities",2010-06-18,jdc,php,webapps,0
13925,platforms/php/webapps/13925.txt,"Joomla! Component Ozio Gallery 2 - Multiple Vulnerabilities",2010-06-18,jdc,php,webapps,0
13926,platforms/php/webapps/13926.txt,"Joomla! Component 'com_listbingo' 1.3 - Multiple Vulnerabilities",2010-06-18,jdc,php,webapps,0
13927,platforms/php/webapps/13927.txt,"MarketSaz - Arbitrary File Upload",2010-06-18,NetQurd,php,webapps,0
@ -23790,7 +23791,7 @@ id,file,description,date,author,platform,type,port
14499,platforms/php/webapps/14499.txt,"Joomla! Component 'com_pbbooking' 1.0.4_3 - Multiple Blind SQL Injection",2010-07-29,"Salvatore Fresta",php,webapps,0
14500,platforms/php/webapps/14500.txt,"Whizzy CMS 10.02 - Local File Inclusion",2010-07-29,"Anarchy Angel",php,webapps,0
14501,platforms/php/webapps/14501.txt,"Joomla! Component 'com_SimpleShop' - SQL Injection",2010-07-29,"UnD3rGr0unD W4rri0rZ",php,webapps,0
14502,platforms/php/webapps/14502.txt,"Joomla! Component 'com_beamospetition' - SQL Injection",2010-07-29,Forza-Dz,php,webapps,0
14502,platforms/php/webapps/14502.txt,"Joomla! Component com_beamospetition - SQL Injection",2010-07-29,Forza-Dz,php,webapps,0
14518,platforms/php/webapps/14518.txt,"Joomla! Component 'com_spielothek' 1.6.9 - Multiple Blind SQL Injection",2010-07-31,"Salvatore Fresta",php,webapps,0
14521,platforms/hardware/webapps/14521.txt,"Intellinet IP Camera MNC-L10 - Authentication Bypass",2010-08-01,Magnefikko,hardware,webapps,0
14523,platforms/php/webapps/14523.txt,"SnoGrafx - 'cat.php?cat' SQL Injection",2010-08-02,CoBRa_21,php,webapps,0
@ -23846,7 +23847,7 @@ id,file,description,date,author,platform,type,port
14707,platforms/php/webapps/14707.txt,"Joomla! Component 'com_Fabrik' - SQL Injection",2010-08-21,Mkr0x,php,webapps,0
14694,platforms/php/webapps/14694.txt,"Joomla! Component 'com_extcalendar' - Blind SQL Injection",2010-08-20,Lagripe-Dz,php,webapps,0
14702,platforms/php/webapps/14702.txt,"Joomla! Component 'com_zina' - SQL Injection",2010-08-21,"Th3 RDX",php,webapps,0
14703,platforms/php/webapps/14703.txt,"Joomla! Component 'com_biblioteca' 1.0 Beta - Multiple SQL Injections",2010-08-21,"Salvatore Fresta",php,webapps,0
14703,platforms/php/webapps/14703.txt,"Joomla! Component Biblioteca 1.0 Beta - Multiple SQL Injections",2010-08-21,"Salvatore Fresta",php,webapps,0
14704,platforms/asp/webapps/14704.txt,"T-dreams Announcement Script - SQL Injection",2010-08-21,"Br0wn Sug4r",asp,webapps,0
14709,platforms/asp/webapps/14709.txt,"netStartEnterprise 4.0 - SQL Injection",2010-08-22,L1nK,asp,webapps,0
14712,platforms/php/webapps/14712.txt,"4Images 1.7.8 - Remote File Inclusion",2010-08-23,LoSt.HaCkEr,php,webapps,0
@ -24146,7 +24147,7 @@ id,file,description,date,author,platform,type,port
15460,platforms/php/webapps/15460.txt,"Joomla! Component ProDesk 1.5 - Local File Inclusion",2010-11-08,d3v1l,php,webapps,0
15466,platforms/php/webapps/15466.txt,"Joomla! Component JQuarks4s 1.0.0 - Blind SQL Injection",2010-11-09,"Salvatore Fresta",php,webapps,0
15465,platforms/php/webapps/15465.rb,"Woltlab Burning Board Userlocator 2.5 - SQL Injection",2010-11-09,"Easy Laster",php,webapps,0
15468,platforms/php/webapps/15468.txt,"Joomla! Component 'btg_oglas' - HTML / Cross-Site Scripting Injection",2010-11-09,CoBRa_21,php,webapps,0
15468,platforms/php/webapps/15468.txt,"Joomla! Component btg_oglas - HTML / Cross-Site Scripting Injection",2010-11-09,CoBRa_21,php,webapps,0
15469,platforms/php/webapps/15469.txt,"Joomla! Component 'com_markt' - SQL Injection",2010-11-09,CoBRa_21,php,webapps,0
15470,platforms/php/webapps/15470.txt,"Joomla! Component 'com_img' - Local File Inclusion",2010-11-09,CoBRa_21,php,webapps,0
15484,platforms/php/webapps/15484.txt,"FCKEditor Core 2.x 2.4.3 - (FileManager upload.php) Arbitrary File Upload",2010-11-10,grabz,php,webapps,0
@ -24180,7 +24181,7 @@ id,file,description,date,author,platform,type,port
15543,platforms/php/webapps/15543.txt,"Chameleon Social Networking Software - Persistent Cross-Site Scripting",2010-11-15,Dr-mosta,php,webapps,0
15544,platforms/asp/webapps/15544.txt,"Web Wiz NewsPad Express Edition 1.03 - Database File Disclosure",2010-11-15,keracker,asp,webapps,0
15545,platforms/php/webapps/15545.txt,"Nuked-klaN Module Boutique - Blind SQL Injection",2010-11-15,[AR51]Kevinos,php,webapps,0
15549,platforms/php/webapps/15549.txt,"Joomla! Component 'com_alfurqan15x' - SQL Injection",2010-11-15,kaMtiEz,php,webapps,0
15549,platforms/php/webapps/15549.txt,"Joomla! Component com_alfurqan15x - SQL Injection",2010-11-15,kaMtiEz,php,webapps,0
15553,platforms/asp/webapps/15553.txt,"BPConferenceReporting Web Reporting - Authentication Bypass",2010-11-16,v3n0m,asp,webapps,0
15554,platforms/asp/webapps/15554.txt,"BPRealestate Real Estate - Authentication Bypass",2010-11-16,v3n0m,asp,webapps,0
15555,platforms/php/webapps/15555.txt,"Joomla! Component 'com_maianmedia' - SQL Injection",2010-11-16,v3n0m,php,webapps,0
@ -24313,7 +24314,7 @@ id,file,description,date,author,platform,type,port
15812,platforms/php/webapps/15812.txt,"Ypninc Realty Classifieds - SQL Injection",2010-12-23,Br0ly,php,webapps,0
15813,platforms/php/webapps/15813.txt,"IPN Development Handler 2.0 - Multiple Vulnerabilities",2010-12-23,AtT4CKxT3rR0r1ST,php,webapps,0
15814,platforms/php/webapps/15814.txt,"Joomla! Component 'com_ponygallery' - Remote File Inclusion",2010-12-23,AtT4CKxT3rR0r1ST,php,webapps,0
15815,platforms/php/webapps/15815.txt,"Joomla! Component 'com_adsmanager' - Remote File Inclusion",2010-12-23,AtT4CKxT3rR0r1ST,php,webapps,0
15815,platforms/php/webapps/15815.txt,"Joomla! Component com_adsmanager - Remote File Inclusion",2010-12-23,AtT4CKxT3rR0r1ST,php,webapps,0
15816,platforms/php/webapps/15816.txt,"CubeCart 3.0.4 - SQL Injection",2010-12-23,Dr.NeT,php,webapps,0
15818,platforms/php/webapps/15818.txt,"iDevSpot iDevCart 1.10 - Multiple Local File Inclusion",2010-12-24,v3n0m,php,webapps,0
15819,platforms/php/webapps/15819.txt,"Joomla! Component 'com_xmovie' 1.0 - Local File Inclusion",2010-12-24,KelvinX,php,webapps,0
@ -24753,7 +24754,7 @@ id,file,description,date,author,platform,type,port
17406,platforms/php/webapps/17406.txt,"Catalog Builder - eCommerce Software - Blind SQL Injection",2011-06-16,takeshix,php,webapps,0
17408,platforms/php/webapps/17408.txt,"WeBid 1.0.2 - Persistent Cross-Site Scripting (via SQL Injection)",2011-06-17,Saif,php,webapps,0
17410,platforms/php/webapps/17410.txt,"AiCart 2.0 - Multiple Vulnerabilities",2011-06-18,takeshix,php,webapps,0
17411,platforms/php/webapps/17411.txt,"Joomla! Component 'com_acooldebate' 1.0.3 - Local File Inclusion",2011-06-18,"Chip d3 bi0s",php,webapps,0
17411,platforms/php/webapps/17411.txt,"Joomla! Component A Cool Debate 1.0.3 - Local File Inclusion",2011-06-18,"Chip d3 bi0s",php,webapps,0
17412,platforms/php/webapps/17412.txt,"Joomla! Component 'com_team' - SQL Injection",2011-06-19,CoBRa_21,php,webapps,0
17413,platforms/php/webapps/17413.txt,"Burning Board 3.1.5 - Full Path Disclosure",2011-06-19,linc0ln.dll,php,webapps,0
17414,platforms/php/webapps/17414.txt,"Joomla! Component 'com_calcbuilder' - 'id' Parameter Blind SQL Injection",2011-06-19,"Chip d3 bi0s",php,webapps,0
@ -33820,7 +33821,7 @@ id,file,description,date,author,platform,type,port
34969,platforms/hardware/webapps/34969.html,"Tenda A32 Router - Cross-Site Request Forgery",2014-10-14,zixian,hardware,webapps,0
34970,platforms/php/webapps/34970.py,"SEO Control Panel 3.6.0 - Authenticated SQL Injection",2014-10-14,"Tiago Carvalho",php,webapps,0
34971,platforms/asp/webapps/34971.txt,"Angel Learning Management System 7.3 - 'pdaview.asp' Cross-Site Scripting",2010-11-05,"Wesley Kerfoot",asp,webapps,0
34972,platforms/php/webapps/34972.txt,"Joomla! Component 'com_a3000' - 'id' Parameter SQL Injection",2010-11-05,jos_ali_joe,php,webapps,0
34972,platforms/php/webapps/34972.txt,"Joomla! Component AutoArticles 3000 - SQL Injection",2010-11-05,jos_ali_joe,php,webapps,0
34973,platforms/php/webapps/34973.txt,"WordPress Plugin FeedList 2.61.01 - 'handler_image.php' Cross-Site Scripting",2010-11-08,"John Leitch",php,webapps,0
34974,platforms/php/webapps/34974.txt,"WordPress Plugin WP Survey And Quiz Tool 1.2.1 - Cross-Site Scripting",2010-11-08,"John Leitch",php,webapps,0
34994,platforms/cgi/webapps/34994.txt,"OpenWrt 10.03 - Multiple Cross-Site Scripting Vulnerabilities",2010-11-13,"dave b",cgi,webapps,0
@ -33844,7 +33845,7 @@ id,file,description,date,author,platform,type,port
35028,platforms/php/webapps/35028.txt,"SmartBox - 'page_id' Parameter SQL Injection",2010-11-26,KnocKout,php,webapps,0
35031,platforms/asp/webapps/35031.txt,"BugTracker.NET 3.4.4 - SQL Injection / Cross-Site Scripting",2010-11-30,BugTracker.NET,asp,webapps,0
35035,platforms/cgi/webapps/35035.txt,"AWStats 6.x - Apache Tomcat Configuration File Arbitrary Command Execution",2010-11-30,StenoPlasma,cgi,webapps,0
35036,platforms/php/webapps/35036.txt,"Joomla! Component 'com_annuaire' - 'id' Parameter SQL Injection",2010-12-02,"Ashiyane Digital Security Team",php,webapps,0
35036,platforms/php/webapps/35036.txt,"Joomla! Component Annuaire - Parameter SQL Injection",2010-12-02,"Ashiyane Digital Security Team",php,webapps,0
35037,platforms/ios/webapps/35037.txt,"iFunBox Free 1.1 iOS - File Inclusion",2014-10-22,Vulnerability-Lab,ios,webapps,8000
35038,platforms/ios/webapps/35038.txt,"File Manager 4.2.10 iOS - Code Execution",2014-10-22,Vulnerability-Lab,ios,webapps,80
35039,platforms/windows/webapps/35039.rb,"DotNetNuke DNNspot Store 3.0.0 - Arbitrary File Upload (Metasploit)",2014-10-22,"Glafkos Charalambous",windows,webapps,0
@ -34623,7 +34624,7 @@ id,file,description,date,author,platform,type,port
36293,platforms/php/webapps/36293.txt,"Centreon 2.3.1 - 'command_name' Parameter Remote Command Execution",2011-11-04,"Christophe de la Fuente",php,webapps,0
36295,platforms/php/webapps/36295.txt,"PBCS Technology - 'articlenav.php' SQL Injection",2011-11-08,Kalashinkov3,php,webapps,0
36297,platforms/php/webapps/36297.txt,"AShop - Open-redirection / Cross-Site Scripting",2011-11-09,"Infoserve Security Team",php,webapps,0
36298,platforms/php/webapps/36298.txt,"Joomla! Component 'com_alfcontact' 1.9.3 - Multiple Cross-Site Scripting Vulnerabilities",2011-11-10,"Jose Carlos de Arriba",php,webapps,0
36298,platforms/php/webapps/36298.txt,"Joomla! Component com_alfcontact 1.9.3 - Multiple Cross-Site Scripting Vulnerabilities",2011-11-10,"Jose Carlos de Arriba",php,webapps,0
36299,platforms/java/webapps/36299.txt,"Infoblox NetMRI 6.2.1 - Admin Login Page Multiple Cross-Site Scripting Vulnerabilities",2011-11-11,"Jose Carlos de Arriba",java,webapps,0
36301,platforms/php/webapps/36301.txt,"WordPress Plugin Download Manager 2.7.2 - Privilege Escalation",2014-11-24,"Kacper Szurek",php,webapps,0
36302,platforms/php/webapps/36302.txt,"Joomla! Component Content - 'year' Parameter SQL Injection",2011-11-14,E.Shahmohamadi,php,webapps,0
@ -34856,7 +34857,7 @@ id,file,description,date,author,platform,type,port
36639,platforms/php/webapps/36639.txt,"Joomla! Component 'com_propertylab' - 'id' Parameter SQL Injection",2012-01-30,the_cyber_nuxbie,php,webapps,0
36640,platforms/php/webapps/36640.txt,"WordPress Plugin Work The Flow File Upload 2.5.2 - Arbitrary File Upload",2015-04-05,"Claudio Viviani",php,webapps,0
36641,platforms/php/webapps/36641.txt,"u-Auctions - Multiple Vulnerabilities",2015-04-05,*Don*,php,webapps,0
36642,platforms/php/webapps/36642.txt,"Joomla! Component 'com_bbs' - Multiple SQL Injections",2012-01-30,the_cyber_nuxbie,php,webapps,0
36642,platforms/php/webapps/36642.txt,"Joomla! Component com_bbs - Multiple SQL Injections",2012-01-30,the_cyber_nuxbie,php,webapps,0
36643,platforms/php/webapps/36643.txt,"4Images 1.7.10 - admin/categories.php cat_parent_id Parameter SQL Injection",2012-01-31,RandomStorm,php,webapps,0
36644,platforms/php/webapps/36644.txt,"4Images 1.7.10 - admin/categories.php cat_parent_id Parameter Cross-Site Scripting",2012-01-31,RandomStorm,php,webapps,0
36645,platforms/php/webapps/36645.txt,"4Images 1.7.10 - admin/index.php redirect Parameter Arbitrary Site Redirect",2012-01-31,RandomStorm,php,webapps,0
@ -36232,7 +36233,7 @@ id,file,description,date,author,platform,type,port
39013,platforms/php/webapps/39013.html,"Built2Go PHP Shopping - Cross-Site Request Forgery (Admin Password)",2014-01-08,AtT4CKxT3rR0r1ST,php,webapps,0
39014,platforms/php/webapps/39014.txt,"EZGenerator - Local File Disclosure / Cross-Site Request Forgery",2014-01-08,AtT4CKxT3rR0r1ST,php,webapps,0
39015,platforms/php/webapps/39015.txt,"Atmail Webmail Server - Email Body HTML Injection",2014-01-14,"Zhao Liang",php,webapps,0
39016,platforms/php/webapps/39016.txt,"Joomla! Component 'com_aclassfb' - Arbitrary File Upload",2014-01-10,DevilScreaM,php,webapps,0
39016,platforms/php/webapps/39016.txt,"Joomla! Component Almond Classifieds - Arbitrary File Upload",2014-01-10,DevilScreaM,php,webapps,0
39017,platforms/php/webapps/39017.txt,"Zen Cart 1.5.4 - Local File Inclusion",2015-12-17,"High-Tech Bridge SA",php,webapps,80
39028,platforms/php/webapps/39028.txt,"Joomla! Component Sexy polling 1.0.8 - 'answer_id' Parameter SQL Injection",2014-01-16,"High-Tech Bridge",php,webapps,0
39029,platforms/php/webapps/39029.txt,"BloofoxCMS - /bloofox/index.php 'Username' Parameter SQL Injection",2014-01-17,AtT4CKxT3rR0r1ST,php,webapps,0
@ -36934,4 +36935,4 @@ id,file,description,date,author,platform,type,port
40979,platforms/php/webapps/40979.php,"Zend Framework / zend-mail < 2.4.11 - Remote Code Execution",2016-12-30,"Dawid Golunski",php,webapps,0
40982,platforms/hardware/webapps/40982.html,"Xfinity Gateway (Technicolor DPC3941T) - Cross-Site Request Forgery",2016-08-09,"Ayushman Dutta",hardware,webapps,0
40986,platforms/php/webapps/40986.py,"PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - (AIO) 'PwnScriptum' Remote Code Execution",2017-01-02,"Dawid Golunski",php,webapps,0
40989,platforms/jsp/webapps/40989.txt,"Atlassian Confluence 5.9.12 - Persistent Cross-Site Scripting",2017-01-04,"Jodson Santos",jsp,webapps,0
40989,platforms/jsp/webapps/40989.txt,"Atlassian Confluence < 5.10.6 - Persistent Cross-Site Scripting",2017-01-04,"Jodson Santos",jsp,webapps,0

Can't render this file because it is too large.

61
platforms/android/dos/40993.txt Executable file
View file

@ -0,0 +1,61 @@
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=963
The MAX86902 sensor has a driver that exposes several interfaces through which the device may be configured. In addition to exposing a character device, it also exposes several entries under sysfs.
Some of these entries are writable, allowing different values to be configured. Three such files are exposed under the paths:
/sys/devices/virtual/sensors/hrm_sensor/eol_test_result
/sys/devices/virtual/sensors/hrm_sensor/lib_ver
/sys/devices/virtual/sensors/uv_sensor/uv_lib_ver
The sysfs write handlers for these files all share approximately the same logic. Below is one such handler, for the "uv_lib_ver" sysfs entry:
1. static ssize_t max86900_uv_lib_ver_store(struct device *dev,
2. struct device_attribute *attr, const char *buf, size_t size)
3. {
4. struct max86900_device_data *data = dev_get_drvdata(dev);
5. unsigned int buf_len;
6. buf_len = (unsigned int)strlen(buf) + 1;
7. if (buf_len > MAX_LIB_VER)
8. buf_len = MAX_LIB_VER;
9.
10. if (data->uv_lib_ver != NULL)
11. kfree(data->uv_lib_ver);
12.
13. data->uv_lib_ver = kzalloc(sizeof(char) * buf_len, GFP_KERNEL);
14. if (data->uv_lib_ver == NULL) {
15. pr_err("%s - couldn't allocate memory\n", __func__);
16. return -ENOMEM;
17. }
18. strncpy(data->uv_lib_ver, buf, buf_len);
19. pr_info("%s - uv_lib_ver = %s\n", __func__, data->uv_lib_ver);
20. return size;
21. }
Since the code above does not use any mechanism to prevent concurrent access, it contains race conditions which allow corruption of kernel memory.
For example, one such race condition could occur when two attempts to call "write" are executed at the same time, where the underlying buffers have different lengths. More concretely, denote the two accessing tasks "task1" and "task2", correspondingly. Consider the following sequence of events:
-"task1" attempts to write to the entry, and provides a buffer of length 20.
-"task1" manages to execute lines 1-17 (inclusive)
-"task2" now attempts to write to the entry, and provides a buffer of length 2.
-"task2" manages to execute lines 1-13 (inclusive)
-"task1" now executes line 18, resulting in an overflow when writing to data->uv_lib_ver (since its actual length is now 2)
This issue can be addressed by adequate locking when accessing the sysfs entries.
I've statically and dynamically verified this issue on an SM-G935F device. The open-source kernel package I analysed was "SM-G935F_MM_Opensource", the device's build is "XXS1APG3".
The sysfs entries mentioned above have UID "system" and GID "radio". The SELinux context for these entries is: "u:object_r:sysfs_sensor_writable:s0".
According to the default SELinux rules as present on the SM-G935F (version XXS1APG3), the following contexts may access these files:
allow radio sysfs_sensor_writable : file { ioctl read write getattr lock append open } ;
allow factory_adsp sysfs_sensor_writable : file { ioctl read write getattr lock append open } ;
allow sensorhubservice sysfs_sensor_writable : file { write append open } ;
allow sysfs_sensor_writable sysfs_sensor_writable : filesystem associate ;
allow system_app sysfs_sensor_writable : file { ioctl read write getattr lock append open } ;
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40993.zip

2
platforms/php/webapps/15370.txt
View file

@ -44,7 +44,7 @@ showcode.php:
echo "<h2>".$TEXT['global-sourcecode']."</h2>";
echo "<textarea cols='100' rows='10'>";
echo htmlspecialchars($file);
echo "&lt;/textarea&gt;";
echo "</textarea>";
}
?>