A remote code execution vulnerability exists in the NetDDE services because of an unchecked buffer. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, the NetDDE services are not started by default and would have to be manually started for an attacker to attempt to remotely exploit this vulnerability. This vulnerability could also be used to attempt to perform a local elevation of privilege or remote denial of service.
This is a remote root exploit for Windows 2000 SP3/SP4. It works on probably every language version of Windows 2000.
This is a remote SQL injection exploit for bcoos version 1.0.13. The exploit takes advantage of the application's vulnerability to execute SQL queries remotely. The vulnerability is present when the 'magic_quotes_gpc' setting is turned off. The exploit requires certain modules to be installed. The exploit was discovered by CWH Underground on 1 December 2008. The application can be downloaded from the vendor's website at http://www.bcoos.net/modules/mydownloads/cache/files/bcoos1.0.13.zip.
The ASPPortal Free Version is vulnerable to remote database disclosure. An attacker can access the database by accessing the URL http://[Target]/[aspportal_path]/Data/ASPPortal.mdb.
Auth bypass -> Shell upload
This is a simple exploit for trillian 0.7*(d patch) that allows for a denial of service attack. After patch .74d, most exploits that use damage data do not work, but this exploit works at any patch. The IRC specification includes a rule that limits the command and its parameters to a maximum of 510 characters. However, the szBuf variable in this exploit has a length of 570.
Quicktime & itunes fails to handle long arguments on a .mov file. Quicktime is compiled with the /GS cookie on , so the bug get handled with an exit code : c0000409 but ... Itunes doesn't seems to be compiled with the /GS flag, so we get some code execution possible via Itunes. The PoC give's us full control over EAX & EDI Itunes call unsafely the Quicktime function to play the .mov, so we can trigger a possible code execution via this unsafe call to quicktime héhéhé :) The only problem, is the lengh of the buffer overflowed :( erf ... 49 bytes, less the 8 bytes controlling the EDI & EAX registers so 41. i've tryed to find a way to fill some buffer in the .mov to get some code exec working on this poc, but out of luck, i guess someone will maybe be able to do some magic tricks :)
This exploit targets a remote SQL injection vulnerability in the Lito Lite CMS application. It allows an attacker to execute arbitrary SQL queries on the database.
The vulnerability allows an attacker to disclose the database of the ASPThai.NET Forum 8.5 application. By accessing the URL 'http://[Target]/database/aspthaiForum.mdb', the attacker can retrieve the database file.
This exploit targets PHP version 4.3.x and specifically the openlog() function. It allows an attacker to pass long parameters to openlog(), potentially causing a buffer overflow. This can lead to disruption of PHP or even complete control of the system. The exploit has been tested on Apache 2.0.49 + PHP 4.3.5 on a Windows 2000 SP4 machine. The bug has been reported a long time ago and is still present in version 4.3.5. The changelog of versions up to 4.3.7 does not mention a bugfix for openlog(). The exploit involves sending a malicious request to the vulnerable server, which can result in a shell being obtained. However, it is noted that the impact of this vulnerability on a default production system is uncertain without confirmation from the vendor or original reporter.
Services By CQR