An authenticated admin account is required to successfully exploit the vulnerability, but it can be combined with other attack vectors like XSS / CSRF to achieve more dangerous successful remote attack. An example of this is to steal the administrator username & password and send it to a php logger at 'http://evilsite.com/logger.php?log=[ADMIN USER:HASH]'. A hybrid attack technique (SQL Injection + XSS) can also be used.
Publish-It is prone to a (client side) security vulnerability when processing .PUI files. This vulnerability could be exploited by a remote attacker to execute arbitrary code on the target machine, by enticing the user of Publish-It to open a specially crafted .PUI file.
FX Client is an offline application for e-banking that is intended only for legal entities. The application is vulnerable to an elevation of privileges vulnerability which can be used by a simple user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the 'F' flag (full) for the 'Everyone' and 'Users' group, for the 'RichClient.exe' and 'fxclient.exe' binary files making them world-writable. After you replace the binary with your rootkit, on reboot you get SYSTEM privileges.
A SQL injection vulnerability exists in Joomla 3.2.1 due to improper sanitization of user-supplied input. An attacker can exploit this vulnerability to execute arbitrary SQL commands in the application's database, allowing them to access or modify sensitive data. The vulnerability is present in the 'weblinks-categories' parameter of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable application.
The vulnerability exists due to insufficient sanitization of user-supplied input in 's' parameter of 'rtmp_login.php' script and 'message' parameter of 'vc_logout.php' script. A remote attacker can send a specially crafted request to the vulnerable script and execute arbitrary code on the vulnerable system. Also, an attacker can inject arbitrary HTML and script code, which will be executed in user's browser session in context of affected site.
Pandora FMS versions 5.0RC1 and below are vulnerable to a command injection vulnerability in the "p" POST parameter of the Anytermd daemon used for the SSH/Telnet gateway on TCP port 8022/8023. This allows an unauthenticated attacker to execute arbitrary commands with the rights of the "pandora" user. Additionally, versions 4.1 and 5.0 RC1 fail to set a password for the "artica" user during installation to the harddrive, allowing an attacker to use the command injection vulnerability to "su" to the "artica" user and from there "sudo" to the "root" user as "sudo" won't ask for a password either.
This exploit allows the execution of PHP code without any prior authentication on the Joomla! JomSocial component. Note that in order to be able to execute PHP code, both the "eval" and "assert" functions must be enabled. It is also possible to execute arbitrary PHP functions, without using them. Therefore, it is possible to execute shell commands using "system", "passthru", etc, as long as they are enabled.
This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component.
This module exploits an arbitrary command execution vulnerability in SkyBlueCanvas CMS version 1.1 r248-03 and below.
The vulnerability is an arbitrary file deletion and two cross site scripting issues. The arbitrary file deletion vulnerability is present in the /impresscms/htdocs/libraries/image-editor/image-edit.php file at line 62. The two XSS vulnerabilities are present in the /imprescms/htdocs/modules/profile/userinfo.php file at lines 50 and 53.
Services By CQR