From SAGEM F@st 2604 U can change the default 'Admin' password Or Any User Password which is listening on tcp/ip port 80. An exploit is provided which uses a malicious HTML page to change the password to '123123'.
The web interface of this router is prone to CSRF vulnerabilities which allows to change router parameters and - among other things - to change default administrator ("admin") password.
This exploit is a buffer overflow vulnerability in Blade API Monitor. It allows an attacker to execute arbitrary code by sending a specially crafted serial number to the application. The exploit uses Unicode encoding to bypass the application's input validation.
The D-Link DSL-2640B's web interface (listening on tcp/ip port 80) is prone to CSRF vulnerabilities which allows to change router parameters and -among other things- to change default administrator('admin') password.
An attacker can exploit this vulnerability by sending malicious SQL queries to the vulnerable application. By exploiting this vulnerability, an attacker can gain access to the database and can view, modify, or delete the data stored in the database.
Pandora FMS version 4.0.1 is vulnerable to a Local File Include vulnerability. This vulnerability allows an attacker to include a local file on the server, such as /etc/passwd. This vulnerability is due to the lack of sanitization of user-supplied input in the 'pandora_console.php' script. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable script. This will allow the attacker to include a local file on the server, such as /etc/passwd. This vulnerability is related to CVE-2012-0753.
The following code will crash the awhost32 service. It'll be respawned so if you want to be a real pain you'll need to loop this.. my inital impressions are that controlling execuction will be a pain.
This module exploits an arbitrary PHP code execution vulnerability introduced as a backdoor into Horde 3.3.12 and Horde Groupware 1.2.10.
nmma.exe is a service running on port 8300. The NM_A_PARM1 tag of the 'login' command is the base64 of the 'username::password' string encrypted with blowfish. This tag has the value 10 which is relative to the strings, but exists another type defined as 12 which instead is used for particular data ('nested arrays') and when used for login->NM_A_PARM1 allows to corrupt the heap memory. Through additional packets before and after the malformed one (the service is multi-thread) may be possible to control the memory and execute arbitrary code.
This module exploits a flaw within the handling of MixerSequencer objects in Java 6u18 and before. Exploitation is done by supplying a specially crafted MIDI file within an RMF File. When the MixerSequencer objects is used to play the file, the GM_Song structure is populated with a function pointer provided by a SONG block in the RMF. A Midi block that contains a MIDI with a specially crafted controller event is used to trigger the vulnerability. When triggering the vulnerability 'ebx' points to a fake event in the MIDI file which stores the shellcode. A 'jmp ebx' from msvcr71.dll is used to make the exploit reliable over java updates.
Services By CQR