When the user enters a folder, VirtualDJ tries to retrieve all information from the ID3 tags of MP3 files inside such as ‘Title’, ‘Album’, and ‘Artist’ and stores it in a buffer. After that, a second buffer of length 4096 is allocated in the stack and only the characters A-Z from the first buffer will be copied to it. According to the ID3 v2.x standard, these tags can have length greater than 4096; therefore it is possible to produce a buffer overflow in this second buffer. At the time when the buffer overflow happens and the program reaches the RETN instruction, the EDI register points to the first buffer. We cannot assign the EIP the address of the first buffer directly since it contains characters which are not in range A-Z. However if we take into account the previous information, we can do this indirectly: We can set the bytes of the title 4100:4104 = 'FSFD'. After the buffer overflows occurs we get EIP = 'FSFD' = 0x44465346. At this address (inside urlmon.dll) we find a 'CALL EDI' instruction and so the bytes in the first buffer will be executed. Now we face another problem. VirtualDJ has inserted a 'C3' byte (RETN) before each non-printable ASCII character in the first buffer and we cannot execute the shellcode directly. We can solve this by pushing into the stack the bytes of the shellcode using only printable ASCII characters.
The vulnerability exists due to the ActiveX control including the insecure "Save()" method in "McHealthCheck.dll" DLL. This can be exploited to corrupt or create arbitrary files in the context of the current user.
The vulnerability exists due to insufficient filtration of 'what' HTTP GET parameter passed to '/importer.php' script before using it in PHP 'file()' function. A remote attacker can read contents of arbitrary files on the target system. The vulnerable script sets 'text/javascript' Content-Type for the output data, which makes exploitation of the vulnerability via a web browser inconvenient. Exploitation via telnet or wget utilities is easier.
This module exploits a lack of authentication in the shell developed by v0pCr3w and is widely reused in automated RFI payloads. This module takes advantage of the shell's various methods to execute commands.
This module exploits unauthenticated versions of the 'STUNSHELL' web shell. This module works when safe mode is disabled on the web server. This shell is widely used in automated RFI payloads.
This module exploits unauthenticated versions of the 'STUNSHELL' web shell. This module works when safe mode is enabled on the web server. This shell is widely used in automated RFI payloads.
The Vulnerability-Laboratory Research Team discovered multiple web vulnerabilities in MailOrderWorks v5.907, Mail order management application. The vulnerability allows an attacker to inject own malicious script code in the vulnerable modules on application side (persistent). The vulnerabilities mainly exist in the create document/print module. The module doesn’t validate the file context when processing to create. For example, if we are creating a products summary, the print module(vulnerable) doesn’t check the products titles, and creates the document with the injected malicious code inside.
Cyberoam Vulnerability Research Team discovered a SQL Injection Vulnerability on the SynConnect is a PMS software. There is an error-based SQL injection vulnerability in SysConnect's index.php which allows attacker to steal full database including Master admin credentials and Guest's personal confidential information. Further, login to admin portal gives attacker an overall control of guest accounts. Attacker can impersonate his identity by stealing guest's login credential.
KNet Web Server is vulnerable to a buffer overflow vulnerability when handling a specially crafted request. An attacker can exploit this vulnerability to execute arbitrary code in the context of the application. This vulnerability affects KNet version 1.04b.
The Konftel 300IP is a flexible SIP-based conference phone, perfect for companies that use IP voice services. This exploit allows an attacker to remotely reboot the device by sending a specially crafted HTTP request to the device. This can be used to disrupt the service of the device.
Services By CQR