The management console of Imperva WAF allows an authenticated user having the only privilege to view lookup dataset, to perform a privilege escalation, and extract through a blind sql injection, the MD5 hash of Administrator's account on the console. If you inject this query: stringindatasetchoosen%%' and 1 = any (select 1 from SECURE.CONF_SECURE_MEMBERS where FULL_NAME like '%%dministrator' and rownum<=1 and PASSWORD like '0%') and '1%%'='1 into the search box under the Main Menu->Setup->Global Object->Scope Selection (Data Lookup)->Lookup Data Set, it is possible (depending on whether the query returns true or false) to extract the MD5 hash of the password of the Administrator's account on the console so: If the query return true then I see the searched string (stringindatasetchoosen), this means that the Administrator MD5 hashed password start with 0 character, by doing this, I can enumerate entire MD5, by injecting query like: and PASSWORD like '0% -> to find the first character, once you find the first character, I inject: and PASSWORD like '0a% -> to find second character and so on until you discover all 32 characters of hash.
A buffer overflow vulnerability exists in InduSoft Thin Client v7.1 due to improper bounds checking of user-supplied input. An attacker can exploit this vulnerability by supplying a specially crafted argument to the Initialize2 function of the novapi7.dll library. This can result in arbitrary code execution in the context of the application.
Hitron Technologies CDE-30364 is a famous ONO Router. The Hitron Technologies CDE-30364's web interface (listening on tcp/ip port 80), have a problem to insufficient bounds checking of data supplied in HTTP GET requests. An attacker can send a malicious HTTP GET request with a large number of A characters to the router, causing the router to crash and become unavailable.
An integer overflow vulnerability has been identified in Apple Motion. The issue has been verified for Motion 5.0.7 (current release). Prior versions may also be affected. An attacker has the possibility to provide a crafted .motn file containing a viewer element with a subview attribute. If the subview attribute is set to a very low or high integer value, the application crashes due an access violation.
This module exploits a command injection flaw to create a shell script on the filesystem and execute it. If GestioIP is configured to use no authentication, no password is required to exploit the vulnerability. Otherwise, an authenticated user is required to exploit.
Quick Contact Form suffers from a persistent Cross-Site Scripting vulnerability due to a lack of input validation and output sanitization of the qcfname4 paramater. Other input fields are also effective to reflective cross site scripting.
This exploit allows an attacker to inject malicious SQL code into the WHMCS 5.2.7 web application. The attacker can use this vulnerability to gain access to sensitive information such as user credentials, as well as to modify or delete data. The vulnerability is caused by insufficient input validation in the application's code.
An unprivileged, local authenticated user can set the 'MODPROBE_OPTIONS' environment variable to pass a user controlled path, allowing the load of an arbitrary kernel module. The provided PoC contains a kernel module code which transfers back the execution to a '/tmp/rootprog' that can contain user-mode code of choice which will run with root privileges. The exploit has been tested on an Ubuntu-based x86_64 system but should work on other distributions, too.
This module exploits the SEListCtrlX ActiveX installed with the SIEMENS Solid Edge product. The vulnerability exists on several APIs provided by the control, where user supplied input is handled as a memory pointer without proper validation, allowing an attacker to read and corrupt memory from the target process. This module abuses the methods NumChildren() and DeleteItem() in order to achieve memory info leak and remote code execution respectively. This module has been tested successfully on IE6-IE9 on Windows XP SP3 and Windows 7 SP1, using Solid Edge 10.4.
Aanval 7.1 build 70151 is prone to multiple vulnerabilities. The 'id' and 'query' parameters are vulnerable to blind SQL injection. The proof of concept below does a sha1 benchmark on the value '1'. This will take a couple of seconds to process in most situations and thus shows that the injection works. The requests are also vulnerable to 'Cross Site Scripting' and will show a pop-up with the word 'XSS'.
Services By CQR