This exploit allows an attacker to inject arbitrary code into a vulnerable web application. The exploit is triggered when a malicious user sends a specially crafted HTTP POST request to the vulnerable web application. The malicious code is then executed on the server, allowing the attacker to gain access to the server and potentially execute arbitrary code.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
This module exploits a SQL injection found in Solarwinds Storage Manager login interface. It will send a malicious SQL query to create a JSP file under the web root directory, and then let it download and execute our malicious executable under the context of SYSTEM.
Symantec Web Gateway is susceptible to cross site scripting when scanning downloaded files due to lack of proper sanitizing of the file length. The affected value is the (l=) parameter that identifies the length of the file been scanned and it fails to validate whenever the values are string or integer taking both of them.
Input passed via the 'default_lang' POST parameter to /update/index.php is not properly verified before being used in include_once() function and can be exploited to include arbitrary local files. This can be exploited to include local files via directory traversal sequences and URL-encoded NULL bytes.
Baby Gekko CMS suffers from multiple stored (post-auth) XSS vulnerabilities and path disclosure issues when parsing user input to several parameters via GET and POST method. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session or disclose the full installation path of the affected CMS.
This module exploits a buffer overflow in VLC media player VLC media player prior to 2.0.0. The vulnerability is due to a dangerous use of sprintf which can result in a stack buffer overflow when handling a malicious MMS URI. This module uses the browser as attack vector. A specially crafted MMS URI is used to trigger the overflow and get flow control through SEH overwrite. Control is transferred to code located in the heap through a standard heap spray. The module only targets IE6 and IE7 because no DEP/ASLR bypass has been provided.
Websense Triton is prone to a remote command-execution vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary commands with SYSTEM-level privileges. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.
Decoda is a lightweight class that extracts and parses a custom markup language; based on the concept of BB code. Decoda supports all the basic HTML tags and manages special features for making links and emails auto-clickable, using shorthand emails and links, and finally allowing the user to add their own code tags. Decoda supports a directive for videos. For example the Decoda markup [video="youtube" size="small"]test[/video] creates the following corresponding HTML code (whitespace adjusted): <iframe src="http://www.youtube.com/embed/test"; width="560" height="315" frameborder="0"></iframe>. The code to generate the iframe tag can be found in the following file: decoda/templates/video.php. There, the HTML tag is generated as follows: <?php if ($player == 'embed') { ?> <embed src="<?php echo $url; ?>" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="<?php echo $width; ?>" height="<?php echo $height; ?>"> <?php } else { ?> <iframe src="<?php echo $url; ?>" width="<?php echo $width; ?>" height="<?php echo $height; ?>" frameborder="0"></iframe> <?php } ?>. The problem is that the attributes of the iframe tag are not properly escaped. This allows attackers to specify a JavaScript event handler for the iframe tag.
User input passed through $_POST['pid'] seems correctly sanitised by the safeSQLstr() function, but in the query at line 105, single quotes aren't used before concatenate the user input into the query string. This can be exploited to conduct a Blind SQL Injection attack. Successful exploitation of this vulnerability requires at least a record into the 'paper' table, and 'Edit Submission' to be enabled.
Services By CQR