A vulnerability in Joomla Component com_jfuploader version 2.12 and below allows an attacker to upload a malicious file to the server. The attacker can register on the website, download a gif image, open it in Notepad++, copy and paste a PHP code after the last line, save it, rename it to logo.php.gif and upload it from com_jfuploader. The attacker can then access the uploaded file by going to http://127.0.0.1/files/YourUsername/logo.php.gif.
This exploit code is from the wild and is used at the user's own risk. It contains a series of unicode characters and hexadecimal values that are used to exploit a vulnerability.
This exploit allows an attacker to inject malicious SQL code into the vulnerable application. The exploit is triggered when the application uses user-supplied input without proper validation. The malicious code is then executed by the backend database, allowing the attacker to gain access to sensitive information such as usernames and passwords.
All Pub-Me based websites are vulnerable, any more/less trained monkey can reach admin panel by using a Blind SQL Injection with a Login and Password of ' or 0=0 #.
XBMC is vulnerable to a buffer overflow when handling a maliciously crafted SOAP_ACTION_NAME post request. This vulnerability can be exploited by an unauthenticated attacker to execute arbitrary code on the vulnerable system.
First of all while i was testing the upnp in the xbmc application i noticed after finding the vulnerable function in the source code it was because of the Platinum UPnP SDK which was used for upnp protocol. There are more applications vulnerable to this exploit than i had first thought im not writing an exploit for them all as it would be pointless i've passed the information to the developers of platinum sdk and when they have updated so will the rest of the vendors hope fully. Any thing which uses this sdk is exploitable if you do decide to write an exploit for any of the vulnerable applications please give credits to n00b for finding the bug.!! The vendor has released a fix for this vulnerability http://kent.dl.sourceforge.net/project/platinum/platinum/0.6.1/CHANGELOG.txt I would like to thank the vendor of the sdk for taking swift action and fixing this vulnerability swiftly 10/10 for communications and working to get this issue resolved.
TFTgallery is a PHP script available on SourceForge. It is vulnerable to a Local File Inclusion (LFI) vulnerability due to the use of the register_globals=On setting. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server, such as http://www.IM-G0ING-T0-G3T-HACK3D.COM/TFTP-GALLERY-PATH/admin/thumbnailformpost.inc.php?adminlangfile=[LFI], which can allow the attacker to read arbitrary files from the server.
Vyakarana is a Linux kernel vulnerability that allows an attacker to write arbitrary data to kernel memory via the v4l1 compat ioctl. This vulnerability was discovered by Kees Cook and affects Linux kernels prior to 2.6.36.
This PoC was written for educational purpose. Use it at your own risk. Author will be not responsible for any damage. Input parameter passed through $_GET['s'] isn't properly sanitised before being used in a call to "create_function()" at line 675. This can be exploited to inject and execute arbitrary PHP code.
This proof of concept exploits a buffer overflow vulnerability in the way Internet Explorer handles certain HTML elements. The vulnerability is triggered when a maliciously crafted HTML page is opened in Internet Explorer. The proof of concept code creates a series of HTML elements, which when rendered by Internet Explorer, causes a buffer overflow and results in a crash.
Services By CQR