9cea53a35b
35 changes to exploits/shellcodes MikroTik RouterBoard 6.39.2 / 6.40.5 DNS - Denial of Service MikroTik 6.40.5 ICMP - Denial of Service iOS/macOS - Kernel Double Free due to IOSurfaceRootUserClient not Respecting MIG Ownership Rules macOS XNU Kernel - Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures macOS - 'getrusage' Stack Leak Through struct Padding macOS - 'necp_get_socket_attributes' so_pcb Type Confusion LibTIFF pal2rgb 4.0.9 - Heap Buffer Overflow Entrepreneur Dating Script 2.0.1 - 'marital' / 'gender' / 'country' / 'profileid' SQL Injection Secure E-commerce Script 2.0.1 - 'searchcat' / 'searchmain' SQL Injection Laundry Booking Script 1.0 - 'list?city' SQL Injection Lawyer Search Script 1.1 - 'lawyer-list?city' SQL Injection Multivendor Penny Auction Clone Script 1.0 - SQL Injection Online Exam Test Application Script 1.6 - 'exams.php?sort' SQL Injection Opensource Classified Ads Script 3.2 - SQL Injection PHP Multivendor Ecommerce 1.0 - 'sid' / 'searchcat' / 'chid1' SQL Injection Professional Service Script 1.0 - 'service-list?city' SQL Injection Readymade PHP Classified Script 3.3 - 'subctid' / 'mctid' SQL Injection Readymade Video Sharing Script 3.2 - SQL Injection Responsive Realestate Script 3.2 - 'property-list?tbud' SQL Injection Multireligion Responsive Matrimonial 4.7.2 - 'succid' SQL Injection Responsive Events & Movie Ticket Booking Script 3.2.1 - 'findcity.php?q' SQL Injection Multiplex Movie Theater Booking Script 3.1.5 - 'moid' / 'eid' SQL Injection Single Theater Booking Script 3.2.1 - 'findcity.php?q' SQL Injection Advanced Real Estate Script 4.0.7 - SQL Injection Entrepreneur Bus Booking Script 3.0.4 - 'sourcebus' SQL Injection MLM Forex Market Plan Script 2.0.4 - 'newid' / 'eventid' SQL Injection MLM Forced Matrix 2.0.9 - 'newid' SQL Injection Car Rental Script 2.0.4 - 'val' SQL Injection Groupon Clone Script 3.01 - 'state_id' / 'search' SQL Injection Muslim Matrimonial Script 3.02 - 'succid' SQL Injection Advanced World Database 2.0.5 - SQL Injection Resume Clone Script 2.0.5 - SQL Injection Basic Job Site Script 2.0.5 - SQL Injection Vanguard 1.4 - Arbitrary File Upload Vanguard 1.4 - SQL Injection
43 lines
No EOL
1.4 KiB
Text
43 lines
No EOL
1.4 KiB
Text
# # # # #
|
|
# Exploit Title: Vanguard - Marketplace Digital Products PHP 1.4 - Arbitrary File Upload
|
|
# Dork: N/A
|
|
# Date: 11.12.2017
|
|
# Vendor Homepage: https://www.codegrape.com/user/Vanguard/portfolio
|
|
# Software Link: https://www.codegrape.com/item/vanguard-marketplace-digital-products-php/15825
|
|
# Demo: http://vanguard-demo.esy.es/
|
|
# Version: 1.4
|
|
# Category: Webapps
|
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
|
# CVE: N/A
|
|
# # # # #
|
|
# Exploit Author: Ihsan Sencan
|
|
# Author Web: http://ihsan.net
|
|
# Author Social: @ihsansencan
|
|
# # # # #
|
|
# Description:
|
|
# The vulnerability allows an users upload arbitrary file....
|
|
#
|
|
# Vulnerable Source:
|
|
# .....................
|
|
# $row = $row->fetch(PDO::FETCH_ASSOC);
|
|
# $folder_name = $row['id'] * 2;
|
|
# $folder_name_2 = $folder_name * 5;
|
|
# $check_dir1 = 'uploads/'.$folder_name;
|
|
# $check_dir2 = $check_dir.'/'.$folder_name_2;
|
|
# if (!is_dir($check_dir1)) { mkdir($check_dir1); }
|
|
# if (!is_dir($check_dir2)) { mkdir($check_dir2); }
|
|
# $thumbnail_path = $check_dir1."/".basename($_FILES['thumbnail_file']['name']);
|
|
# $preview_path = $check_dir1."/".basename($_FILES['preview_file']['name']);
|
|
# $main_path = $check_dir2."/".basename($_FILES['main_file']['name']);
|
|
# $error = 0;
|
|
# $upload_path = './';
|
|
# .....................
|
|
#
|
|
# Proof of Concept:
|
|
#
|
|
# Users Add a new product/Add a product preview...
|
|
#
|
|
# http://localhost/[PATH]/
|
|
# http://localhost/[PATH]/uploads/[FOLDER_NAME]/[FILE].php
|
|
#
|
|
# # # # # |