880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
77 lines
No EOL
3 KiB
Text
77 lines
No EOL
3 KiB
Text
source: https://www.securityfocus.com/bid/54456/info
|
|
|
|
Simple Machines is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
|
|
|
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
|
|
|
|
Simple Machines Forum 2.0.2 is vulnerable; other versions may also be affected.
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The persistent input validation vulnerability can be exploited by remote attacker with local low privileged user account & low required
|
|
user inter action. For demonstration or reproduce ...
|
|
|
|
Review: Package Manager > Download New Packages > FTP Information Required (Listing)
|
|
|
|
<dd>
|
|
<input size="30" name="ftp_server" id="ftp_server" type="text"><[PERSISTENT SCRIPT CODE]' <"="" class="input_text">
|
|
<label for="ftp_port">Port: </label>
|
|
<input type="text" size="3" name="ftp_port" id="ftp_port" value="21"
|
|
class="input_text" />
|
|
|
|
... or
|
|
|
|
|
|
<dd>
|
|
<input size="50" name="ftp_path" id="ftp_path" value="public_html/demo/smf "
|
|
type="text"><[PERSISTENT SCRIPT CODE])' <"="" style="width: 99%;" class="input_text">
|
|
</dd>
|
|
</dl>
|
|
<div class="righttext">
|
|
|
|
|
|
URL: http://www.example.com/smf/index.php?action=admin;area=packages;sa=packageget;get;f5073d7837d8=5a2bdd540a245be265f26c102fff9626
|
|
|
|
|
|
|
|
Review: Smiley Sets > Add
|
|
|
|
<tr class="windowbg" id="list_smiley_set_list_0">
|
|
<td style="text-align: center;"></td>
|
|
<td class="windowbg">Akyhne's Set</td>
|
|
<td class="windowbg">"><[PERSISTENT SCRIPT CODE]' <="" <strong="">
|
|
akyhne</strong>/...</td>
|
|
|
|
|
|
URL: http://www.example.com/smf/index.php?action=admin;area=smileys;sa=modifyset;set=2
|
|
|
|
|
|
Review: Newsletter > Add
|
|
|
|
<input name="email_force" value="0" type="hidden">
|
|
<input name="total_emails" value="1" type="hidden">
|
|
<input name="max_id_member" value="13" type="hidden">
|
|
<input name="groups" value="0,1,2,3" type="hidden">
|
|
<input name="exclude_groups" value="0,1,2,3" type="hidden">
|
|
<input name="members" value="" type="hidden">
|
|
<input name="exclude_members" value="" type="hidden">
|
|
<input name="emails" value="" type="hidden"><[PERSISTENT SCRIPT CODE])' <"="">
|
|
</form>
|
|
</div>
|
|
<br class="clear" />
|
|
</div>
|
|
|
|
URL: http://www.example.com/smf/index.php?action=admin;area=news;sa=mailingmembers;b74f235ec=2b30f2b9aad6e26815e1c18594922b37
|
|
|
|
|
|
Review: Edit Membergroups & User/Groups Listing
|
|
|
|
<h3 class="catbg">Edit Membergroup - "><[PERSISTENT SCRIPT CODE])' <"=""><[PERSISTENT SCRIPT CODE]) <"
|
|
><ifram
|
|
</h3>
|
|
</div>
|
|
<div class="windowbg2">
|
|
<span class="topslice"><span></span></span>
|
|
|
|
URL: http://www.example.com/smf/index.php?action=admin;area=membergroups;sa=index;b74f235ec=2b30f2b9aad6e26815e1c18594922b37
|
|
URL: http://www.example.com/smf/index.php?action=admin;area=membergroups;sa=add;b74f235ec=2b30f2b9aad6e26815e1c18594922b37 |