The router has the TFTP service enabled by default and it can be accessed without any prior authentication (since TFTP does not support authentication). The whole filesystem is exposed to any person that is connected to the network. If you upload a file to the router, it will crash. You will have to reset it (physically) and reconfigure it. After the file is uploaded, accessing the router's IP will give you a blank page and then it will crash. By changing the value of the login_who variable to 'admin' in the JavaScript code, we can bypass the authentication and perform the actions.
Dictionary based URL scanning of a site where the plugin is installed revealed numerous $_GET parameters that triggered special functionality that rarely seemed properly checked for permissions. The specific vulnerabilities include: setting the parameter 'i4w_dbinfo' to any value prior to version 3.9.001 would trigger the full database credentials to be printed, including database name, user, password, and encoding; setting the parameter 'i4w_action' to any value prior to version 3.9.001 would trigger an XSS vulnerability; setting the parameter 'i4w_action=delete_user&user_id' to any value prior to version 3.9.001 would trigger the deletion of the specified user; setting the parameter 'i4w_action=execute_code&code' to any value prior to version 3.9.001 would trigger the execution of the specified code.
GeoCore is the new name for all Geodesic Solutions software packages beginning with version 7.0.0. It allows much greater flexibility for customers, many features previously available only in the Enterprise-level software packages have been opened up to everyone. Time-Based Blind Injection is a type of SQL injection technique that relies on sending an SQL query to the database which forces the database to wait for a specified amount of time (in seconds) before responding. This makes it possible to determine whether the query is true or false by measuring the response time.
This tool registers a rogue agent on the ePo server and then takes advantage of the following vulnerabilities to perform multiple actions: CVE-2013-0140 (Pre-auth SQL Injection) and CVE-2013-0141 (Pre-auth Directory Path Traversal). The tool manages the following actions, called 'mode': Register a new agent on the ePo server, Check the SQL Injection vulnerability, Add a new web admin account into the DB, Retrieve various information from the database, Retrieve the installation path of ePo software, Retrieve and decrypt cached domain credentials from ePo database, Wipe our traces from the database and file system, Perform remote command execution on the ePo server, Upload files on the ePo server, and Deploy commands or softwares on clients.
This module triggers a stack buffer overflow in Wireshark <= 1.8.12/1.10.5 by generating an malicious file.
This POC code overwrites EIP with 'CCCCCCCC'. The KCS key is used to obfuscate traffic between client and server and is generated during SEPM installation. It can be found in the SyLink.xml file on the client station or in the ersecreg.log file on the server side.
The vulnerability exists due to insufficient sanitization of user-supplied input in the 'index.php' script. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary PHP code on the target system. Also, an attacker can include a local file on the vulnerable system by using directory traversal sequences (e.g. '../') in the 'page' and 'admin' parameters.
jruby-sandbox aims to allow safe execution of user given Ruby code within a JRuby runtime. However via import of Java classes it is possible to circumvent those protections and execute arbitrary code outside the sandboxed environment.
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path commands to compromise the mobile web-application. The persistent input validation web vulnerability allows remote attackers to inject malicious script codes to the application-side of the vulnerable service. The persistent cross site scripting web vulnerability allows remote attackers to inject malicious script codes to the application-side of the vulnerable service.
miSecureMessages lacks any sort of session management. Among other things, this allows any user to modify the xml requests to retrieve other users messages. The contactID parameter can be modified to retrieve messages from other users.
Services By CQR