bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2099 commits 1 branch 0 tags 258 MiB
Commit graph

2099 commits

This branch
This branch
All branches
Author SHA1 Message Date
g0tmi1k
a2a942ae0a Improved bash, more help, less bugs, and cleaner output 2020-04-30 17:10:35 +01:00
g0tmi1k
830465d5a9 Update README for v4.1 2020-04-27 20:25:00 +01:00
g0tmi1k
23e40674cb Merge branch 'upstream-master' into misc 
* upstream-master:
  DB: 2020-04-25
  DB: 2020-04-24
  DB: 2020-04-23
  DB: 2020-04-22
  DB: 2020-04-21
  DB: 2020-04-18
  DB: 2020-04-17
  DB: 2020-04-16
  DB: 2020-04-15
  DB: 2020-04-14
  Fix bash script
  DB: 2020-04-11
  Remove debug command
  Fix a few grammar mistakes
  DB: 2020-04-09
  DB: 2020-04-08
  DB: 2020-04-07
  Fix apt install of exploitdb-{bin-sploits/papers}

# Conflicts:
#	searchsploit
 2020-04-27 20:20:04 +01:00
g0tmi1k
4dd344c2a8 Set "fuzzy" as default behaviour (to revert, need to use new "--strict" option) 2020-04-27 19:56:53 +01:00
g0tmi1k
9d47cfa837 Bash improvements 2020-04-27 19:55:34 +01:00
Offensive Security
7b87f30fbc DB: 2020-04-25 
5 changes to exploits/shellcodes

Popcorn Time 6.2 - 'Update service' Unquoted Service Path
EspoCRM 5.8.5 - Privilege Escalation
Edimax EW-7438RPn 1.13 - Remote Code Execution
Furukawa Electric ConsciusMAP 2.8.1 - Remote Code Execution

Linux/x64 - Password Protected Bindshell + Null-free Shellcode (272 Bytes)
 2020-04-25 05:01:51 +00:00
Offensive Security
cae82bb178 DB: 2020-04-24 
8 changes to exploits/shellcodes

User Management System 2.0 - Persistent Cross-Site Scripting
User Management System 2.0 - Authentication Bypass
Complaint Management System 4.2 - Persistent Cross-Site Scripting
Complaint Management System 4.2 - Authentication Bypass
Complaint Management System 4.2 - Cross-Site Request Forgery (Delete User)
Zen Load Balancer 3.10.1 - Directory Traversal (Metasploit)
Sky File 2.1.0 iOS - Directory Traversal
 2020-04-24 05:01:50 +00:00
Offensive Security
7b676133d3 DB: 2020-04-23 
5 changes to exploits/shellcodes

Vesta Control Panel 0.9.8-16 - Local Privilege Escalation

RM Downloader 3.1.3.2.2010.06.13 - 'Load' Buffer Overflow (SEH)
Edimax EW-7438RPn - Information Disclosure (WiFi Password)
Edimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering)
Mahara 19.10.2 CMS - Persistent Cross-Site Scripting
 2020-04-23 05:01:50 +00:00
Offensive Security
1c5c38825d DB: 2020-04-22 
10 changes to exploits/shellcodes

Oracle Solaris Common Desktop Environment 1.6 - Local Privilege Escalation

WordPress 2.0.2 - 'cache' Remote Shell Injection
Neowise CarbonFTP 1.4 - Insecure Proprietary Password Encryption
WordPress Core 2.0.2 - 'cache' Remote Shell Injection
CSZ CMS 1.2.7 - Persistent Cross-Site Scripting
PMB 5.6 - 'logid' SQL Injection
CSZ CMS 1.2.7 - 'title' HTML Injection
IQrouter 3.3.1 Firmware - Remote Code Execution
NSClient++ 0.5.2.35 - Authenticated Remote Code Execution
jizhi CMS 1.6.7 - Arbitrary File Download
P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)

Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)
 2020-04-22 05:01:47 +00:00
Offensive Security
01900f216d DB: 2020-04-21 
7 changes to exploits/shellcodes

Atomic Alarm Clock 6.3 - Stack Overflow (Unicode+SEH)
Nsauditor 3.2.1.0 - Buffer Overflow (SEH+ASLR bypass (3 bytes overwrite))
Rubo DICOM Viewer 2.0 - Buffer Overflow (SEH)
Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path

Unraid 6.8.0 - Auth Bypass PHP Code Execution (Metasploit)
Centreon 19.10.5 - 'id' SQL Injection
Fork CMS 5.8.0 - Persistent Cross-Site Scripting
 2020-04-21 05:01:47 +00:00
Offensive Security
189c8b52c9 DB: 2020-04-18 
6 changes to exploits/shellcodes

Easy MPEG to DVD Burner 1.7.11 - Buffer Overflow (SEH + DEP)
Code Blocks 16.01 - Buffer Overflow (SEH) UNICODE

Nexus Repository Manager - Java EL Injection RCE (Metasploit)
Playable 9.18 iOS - Persistent Cross-Site Scripting
TAO Open Source Assessment Platform 3.3.0 RC02 - HTML Injection
Cisco IP Phone 11.7 - Denial of service (PoC)
 2020-04-18 05:01:49 +00:00
Offensive Security
c3e827f657 DB: 2020-04-17 
8 changes to exploits/shellcodes

VMware Fusion - USB Arbitrator Setuid Privilege Escalation (Metasploit)
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)
ThinkPHP - Multiple PHP Injection RCEs (Metasploit)
Pandora FMS - Ping Authenticated Remote Code Execution (Metasploit)
PlaySMS - index.php Unauthenticated Template Injection Code Execution (Metasploit)
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
Apache Solr - Remote Code Execution via Velocity Template (Metasploit)
 2020-04-17 05:01:48 +00:00
Offensive Security
decb2a46ee DB: 2020-04-16 
9 changes to exploits/shellcodes

BlazeDVD 7.0.2 - Buffer Overflow (SEH)
AirDisk Pro 5.5.3 for iOS - Persistent Cross-Site Scripting
SuperBackup 2.0.5 for iOS - Persistent Cross-Site Scripting
Pinger 1.0 - Remote Code Execution
SeedDMS 5.1.18 - Persistent Cross-Site Scripting
Macs Framework 1.14f CMS - Persistent Cross-Site Scripting
DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting
File Transfer iFamily 2.1 - Directory Traversal
Xeroneit Library Management System 3.0 - 'category' SQL Injection
 2020-04-16 05:01:47 +00:00
Offensive Security
0137126a8e DB: 2020-04-15 
4 changes to exploits/shellcodes

B64dec 1.1.2 - Buffer Overflow (SEH Overflow + Egg Hunter)
Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution
WSO2 3.1.0 - Persistent Cross-Site Scripting
Oracle WebLogic Server 12.2.1.4.0  -  Remote Code Execution
 2020-04-15 05:01:49 +00:00
Offensive Security
be2aa5d840 DB: 2020-04-14 
7 changes to exploits/shellcodes

Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)
Huawei HG630 2 Router - Authentication Bypass
TVT NVMS 1000 - Directory Traversal
Webtateas 2.0 - Arbitrary File Read
WSO2 3.1.0 - Arbitrary File Delete
Wordpress Plugin Media Library Assistant 2.81 - Local File Inclusion
MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection
 2020-04-14 05:01:51 +00:00
g0tmi1k
3ac506590d
Merge pull request #164 from chenrui333/patch-1 
Fix bash script
 2020-04-11 21:32:44 +01:00
chenrui
a2581bc29f
Fix bash script 2020-04-11 14:13:10 -04:00
Offensive Security
4ee0ce31e7 DB: 2020-04-11 
3 changes to exploits/shellcodes

AbsoluteTelnet 11.12 - 'SSH1/username' Denial of Service (PoC)

Windscribe 1.83 - 'WindscribeService' Unquoted Service Path

Zen Load Balancer 3.10.1 - 'index.cgi' Directory Traversal
 2020-04-11 05:01:50 +00:00
g0tmi1k
0f8df71e72
Remove debug command 
Remove debug command
 2020-04-09 12:22:20 +01:00
g0tmi1k
7335ea6fc3
Merge pull request #163 from g0tmi1k/misc 
Fix a few grammar mistakes
 2020-04-09 12:17:04 +01:00
g0tmi1k
aa3b464e6c
Merge branch 'master' into misc 2020-04-09 12:16:56 +01:00
g0tmi1k
37ed20a3b9 Fix a few grammar mistakes 2020-04-09 12:10:00 +01:00
Offensive Security
6d55b45cdf DB: 2020-04-09 
2 changes to exploits/shellcodes

Django 3.0 - Cross-Site Request Forgery Token Bypass
Amcrest Dahua NVR Camera IP2M-841 - Denial of Service (PoC)
 2020-04-09 05:01:51 +00:00
Offensive Security
36c65f8dd4 DB: 2020-04-08 
2 changes to exploits/shellcodes

dnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Service (PoC)
ZOC Terminal 7.25.5 - 'Script' Denial of Service (PoC)
 2020-04-08 05:01:50 +00:00
Offensive Security
85bef6929f DB: 2020-04-07 
17 changes to exploits/shellcodes

Product Key Explorer 4.2.2.0 - 'Key' Denial of Service (PoC)
SpotAuditor 5.3.4 - 'Name' Denial of Service (PoC)
Nsauditor 3.2.0.0 - 'Name' Denial of Service (PoC)
Frigate 3.36 - Denial of Service (PoC)
UltraVNC Launcher 1.2.4.0 - 'RepeaterHost' Denial of Service (PoC)
UltraVNC Launcher 1.2.4.0 - 'Password' Denial of Service (PoC)
UltraVNC Viewer 1.2.4.0 - 'VNCServer' Denial of Service (PoC)
ZOC Terminal v7.25.5 - 'Private key file' Denial of Service (PoC)
Memu Play 7.1.3 - Insecure Folder Permissions
Triologic Media Player 8 - '.m3l' Buffer Overflow (Unicode) (SEH)
Microsoft NET USE win10 - Insufficient Authentication Logic
LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting
Vesta Control Panel 0.9.8-26 - Authenticated Remote Code Execution (Metasploit)
WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting
Bolt CMS 3.7.0 - Authenticated Remote Code Execution
LimeSurvey 4.1.11 - 'File Manager' Path Traversal
pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting
 2020-04-07 05:02:01 +00:00
g0tmi1k
5a8a1df508
Merge pull request #161 from g0tmi1k/misc 
Fix apt install of exploitdb-{bin-sploits/papers}
 2020-04-06 13:36:30 +01:00
g0tmi1k
a5f8a059f5
Merge branch 'master' into misc 2020-04-06 13:36:23 +01:00
g0tmi1k
87fab8631b Fix apt install of exploitdb-{bin-sploits/papers} 2020-04-06 13:34:23 +01:00
g0tmi1k
f377f48e17
Merge pull request #159 from srikwit/patch-1 
Bug fix for searchsploit unable to DB information for products
 2020-04-06 12:53:23 +01:00
Offensive Security
9cbe99271d DB: 2020-04-04 
2 changes to exploits/shellcodes

AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow (SEH)

Pandora FMS 7.0NG - 'net_tools.php' Remote Code Execution
 2020-04-04 05:01:48 +00:00
Offensive Security
6f90e88040 DB: 2020-04-03 
1 changes to exploits/shellcodes

DiskBoss 7.7.14 - 'Input Directory' Local Buffer Overflow (PoC)
 2020-04-03 05:01:50 +00:00
Offensive Security
c4e0c06fd9 DB: 2020-04-02 
2 changes to exploits/shellcodes

DiskBoss 7.7.14 - Denial of Service (PoC)

10Strike LANState 9.32 - 'Force Check' Buffer Overflow (SEH)
 2020-04-02 05:01:49 +00:00
Offensive Security
19615ff704 DB: 2020-04-01 
7 changes to exploits/shellcodes

FlashFXP 4.2.0 Build 1730 - Denial of Service (PoC)
Redis - Replication Code Execution (Metasploit)
IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)
DLINK DWL-2600 - Authenticated Remote Command Injection (Metasploit)
SharePoint Workflows - XOML Injection (Metasploit)
Grandstream UCM6200 Series CTI Interface - 'user_password' SQL Injection
Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'user_password' SQL Injection
 2020-04-01 05:01:47 +00:00
Srikanth Suresh
d04661607c
Bug fix for searchsploit unable to DB information for products 
Issue: https://github.com/offensive-security/exploitdb/issues/158

While debugging nmapxml, I found that only those softwares are passed to searchsploitout which are echoed to stdout.
In this case, nostromo was classified as a product but there was no echo command for it in the case block "[PRODUCT]".

The fix adds a single line of echo to handle this scenario
 2020-03-31 18:56:19 +03:00
Offensive Security
169b528eaa DB: 2020-03-31 
6 changes to exploits/shellcodes

Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of Service (PoC)
10-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH)(ROP)
Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation

Multiple DrayTek Products - Pre-authentication Remote Root Code Execution

ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)
Joomla! com_fabrik 3.9.11 - Directory Traversal
Zen Load Balancer 3.10.1 - Remote Code Execution
 2020-03-31 05:01:48 +00:00
Offensive Security
a55e8fc33d DB: 2020-03-29 
1 changes to exploits/shellcodes
 2020-03-29 05:01:46 +00:00
Offensive Security
284325fbf5 DB: 2020-03-28 
5 changes to exploits/shellcodes

Everest 5.50.2100 - 'Open File' Denial of Service (PoC)

Easy RM to MP3 Converter 2.7.3.700 - 'Input' Local Buffer Overflow (SEH)
ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)
Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal
rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution
 2020-03-28 05:01:48 +00:00
Offensive Security
4b289033f4 DB: 2020-03-27 
3 changes to exploits/shellcodes

TP-Link Archer C50 3 - Denial of Service (PoC)
Centreo 19.10.8 - 'DisplayServiceStatus' Remote Code Execution
 2020-03-27 05:01:46 +00:00
Offensive Security
606ad946d3 DB: 2020-03-26 
7 changes to exploits/shellcodes

AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path
10-Strike Network Inventory Explorer - 'srvInventoryWebServer' Unquoted Service Path
10-Strike Network Inventory Explorer 8.54 - 'Add' Local Buffer Overflow (SEH)

Wordpress Plugin WPForms 1.5.9 - Persistent Cross-Site Scripting
Wordpress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting
Joomla! Component GMapFP 3.30 - Arbitrary File Upload
LeptonCMS 4.5.0 - Persistent Cross-Site Scripting

Windows/x64 - WinExec Add-Admin Dynamic Null-Free Shellcode (210 Bytes)
 2020-03-26 05:01:48 +00:00
Offensive Security
52df09d89e DB: 2020-03-25 
4 changes to exploits/shellcodes

Veyon 4.3.4 - 'VeyonService' Unquoted Service Path
UliCMS 2020.1 - Persistent Cross-Site Scripting
Wordpress Plugin WPForms 1.5.9 - Persistent Cross-Site Scripting
UCM6202 1.0.18.13 - Remote Command Injection
 2020-03-25 05:01:47 +00:00
Offensive Security
b84d953124 DB: 2020-03-24 
10 changes to exploits/shellcodes

ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service (PoC)
Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC)

CyberArk PSMP 10.9.1 - Policy Restriction Bypass

PHPMailer < 5.2.18 - Remote Code Execution (Bash)
FIBARO System Home Center 5.021 - Remote File Include
rConfig 3.9.4 - 'search.crud.php' Remote Command Injection
Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection

Windows\x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes)
Windows\x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Windows/x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes)
Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Linux\x86 - 'reboot' polymorphic Shellcode (26 bytes)
 2020-03-24 05:01:50 +00:00
Offensive Security
d3992973f1 DB: 2020-03-21 
2 changes to exploits/shellcodes

VMware Fusion 11.5.2 - Privilege Escalation

Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)
 2020-03-21 05:01:49 +00:00
Offensive Security
26b38131c0 DB: 2020-03-20 
1 changes to exploits/shellcodes

Broadcom Wi-Fi Devices - 'KR00K Information Disclosure
 2020-03-20 05:01:50 +00:00
Offensive Security
85cdf30cea DB: 2020-03-19 
7 changes to exploits/shellcodes

NetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service Path
Microsoft VSCode Python Extension - Code Execution
VMWare Fusion - Local Privilege Escalation

Microtik SSH Daemon 6.44.3 - Denial of Service (PoC)

Netlink GPON Router 1.0.11 - Remote Code Execution

Windows\x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
 2020-03-19 05:01:49 +00:00
Offensive Security
20e5ee2e94 DB: 2020-03-18 
2 changes to exploits/shellcodes

Rconfig 3.x - Chained Remote Code Execution (Metasploit)
ManageEngine Desktop Central - Java Deserialization (Metasploit)
 2020-03-18 05:01:50 +00:00
Offensive Security
72f1d24f1a DB: 2020-03-17 
5 changes to exploits/shellcodes

Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery (Add Admin)
MiladWorkShop VIP System 1.0 - 'lang' SQL Injection
PHPKB Multi-Language 9 - Authenticated Remote Code Execution
PHPKB Multi-Language 9 - Authenticated Directory Traversal
PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution
 2020-03-17 05:01:49 +00:00
Offensive Security
9bacc6784a DB: 2020-03-15 
2 changes to exploits/shellcodes

Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Buffer Overflow (PoC)

Horde Groupware Webmail Edition 5.2.22 - Remote Code Execution
 2020-03-15 05:01:47 +00:00
Offensive Security
79fee2e601 DB: 2020-03-14 
4 changes to exploits/shellcodes

AnyBurn 4.8 - Buffer Overflow (SEH)

Drobo 5N2 4.1.1 - Remote Command Injection

Centos WebPanel 7 - 'term' SQL Injection
 2020-03-14 05:01:46 +00:00
Offensive Security
153c392dd9 DB: 2020-03-13 
9 changes to exploits/shellcodes

ASUS AAHM 1.00.22 - 'asHmComSvc' Unquoted Service Path
Joomla! Component com_newsfeeds 1.0 - 'feedid' SQL Injection
WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure
Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection
HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)
rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
rConfig 3.9 - 'searchColumn' SQL Injection
Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion
Horde Groupware Webmail Edition 5.2.22 - PHAR Loading
 2020-03-13 05:01:50 +00:00
Offensive Security
3c74040d79 DB: 2020-03-12 
2 changes to exploits/shellcodes

ASUS AXSP 1.02.00 - 'asComSvc' Unquoted Service Path

Wordpress Plugin Search Meter 2.13.2 - CSV injection
 2020-03-12 05:01:49 +00:00