TinyBB Version 1.2 is vulnerable to SQLi. The exploit can be performed by appending ' or 'a'='a to the profile ID parameter in the URL.
Exploit : http://localhost/user.php?id=1'[sqli] Error: Invalid query: SELECT `key`,`value` FROM `bd_user_data` WHERE `user_id`='1'' Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1
The router's web interface reveals the Administrator Password's MD5 Hash. Its even possbile to bypass the login completely.
K-Lite Mega Codec Pack based Local Windows Explorer DOS PoC is a proof-of-concept exploit that crashes Windows Explorer when a user tries to use, select, or highlight the attached Test7.flv file in Windows Explorer. This causes Windows Explorer to crash.
This particular php script,named as 'download.php' can be tricked into allowing a remote attacker to download all kinds of files such as .php,.txt etc etc.This can be achieved by adding a null byte followed by an allowed extension..for eg: http://www.site.com/download.php?f=/path/file.php%00.jpg
This web server when fed with 1006 bytes of chr(0x0d),with the html "GET" parameter,the Server's Gui's Thread gets corrupted.This means, though the web server works normally, (due to Multithreading),No more Logs are generated.Also "all" the web server configuration settings are unavailable.
The exploit works in 3 stages. 1. Authentication. 2. Setting up shellcode in the memory at a known location. 3. Triggering an RA register over-write to execute the shellcode. This particular model of router is based on 'embedded Configurable operating system' a.k.a (eCos) version 2.0. The shellcode used in the exploit is a dummy one that basically just triggers an exception & crashes the router, forcing it to reboot.
The last line in the code checks the file's extension to make sure its not a php file. This line of code is vulnerable though. The exploit is to use the URL http://www.a.com/snif.php?download=snif.php%00 to bypass all restrictions and let you download a php file.
In Sony Ericsson phones (tested on w800i, k750i, w810i), if you simply rename a File with a '.sest' extension, it achieves 'System' File status. This file can't be deleted, nor renamed or edited by any means By the Phone. The only way to remove or rename those files is to connect the phone to your Personal Computer & then rename them. Folders such as Images Folder, Videos Folder etc, if renamed in Foldername.sest format, then this folder attains System Folder status, & no matter how many files are present in it, they become totally invisible. When you try to open these folders in the phone, it says 'No Files in this folder' even when in reality files are present in it. Using this Vulnerability, you can totally disable all the Multimedia features of these phones. J2me applications are capable of causing this Filesystem DoS effect. A PoC of this DoS Function, is the 'VooDoo' function of the J2me File protection application 'The Messiah'.
Services By CQR