This exploit allows an attacker to dump the content of the table named fusionX...X_users. It is done by generating a payload using a generator script and sending it to the server. The payload is then used to extract the table name and the columns of the table. The columns are then printed out.
e-learning Php Script 0.1.0 is vulnerable to SQL Injection. An attacker can inject malicious SQL queries via the 'search' parameter in the 'search.php' script. This can be exploited to bypass authentication and gain access to the application.
RM Downloader 2.50.60 2006.06.23 is vulnerable to a local buffer overflow vulnerability when a maliciously crafted file is loaded into the 'Load' parameter. This can be exploited to execute arbitrary code by running a python script to create a new file 'RM_LCE.txt' containing the malicious code, copying the content of the new file to the clipboard, turning off DEP for RMDownloader.exe, opening RMDownloader.exe, pasting the clipboard in the 'Load' parameter, clicking on the 'OK' button, and then clicking on the two messageboxes that pop up. This will result in the execution of calc.exe.
RESIDE Property Management 3.0 is vulnerable to SQL Injection in the 'profile' parameter of the 'profile.php' file. An attacker can inject malicious payloads in the 'profile' parameter to execute arbitrary SQL queries and gain access to sensitive information stored in the database.
The form parameter 'user_firstname' and 'user_lastname' is vulnerable to stored cross site scripting. Payload for 'user_firstname' : <script>alert(1)</script> Payload for 'user_lastname' : <script>alert(2)</script>
To exploit vulnerability, someone could use 'http://[HOST]/controller.php?document&upload&patient_id=00&parent_id=4&' post request to upload malicious php codes.
To exploit vulnerability, someone could use 'http://[HOST]/fhem/FileLog_logWrapper?dev=Logfile&file=%2fetc%2fpasswd&type=text' request to get some informations from the target by changing 'file' parameter.
mySCADA myPRO v7 contains hardcoded FTP credentials which can be used to gain access to the system. The credentials are 'myscada' for the username and 'Vikuk63' for the password.
This exploit allows an attacker to gain SYSTEM level privileges by exploiting the unquoted service path vulnerability in Windscribe 1.83. The attacker can use a reverse shell payload to gain access to the system. The exploit code starts by configuring the WindscribeService binPath to the reverse shell payload, then stopping and starting the service. The exploit is successful when the reverse shell is triggered.
The 'Firstname' and 'Lastname' parameters in Global RADAR BSA Radar 1.6.7234.X are vulnerable to a stored Cross-Site Scripting (XSS) via the Update User Profile feature (in the top-right of the application). Using the 'update user profile' feature in the top-right of the application while logged in, a malicious user can inject malicious, unencoded scripts, such as '<script>alert(1)</script>', into the Firstname and Lastname parameters of a user account. This stored XSS will execute on nearly every application page as these parameters are always present while logged in. This attack can be further leveraged by utilizing an existing authorization bypass exploit (CVE-2020-14944) to inject stored XSS payloads into these parameters for arbitrary existing user accounts.
Services By CQR