A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
This module exploits a Java deserialization vulnerability in the getChartImage() method from the FileStorage class within ManageEngine Desktop Central versions < 10.0.474. Tested against 10.0.465 x64.
The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'link' parameter to the '/ush/gates/token.php' script. A remote attacker can execute arbitrary SQL commands in the application's database, cause denial of service, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL server software.
A vulnerability in Chadha PHPKB Standard Multi-Language 9 allows an authenticated attacker to download arbitrary files from the server. This is due to a lack of proper input validation in the 'file' parameter of the 'admin/download.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malicious 'file' parameter.
A Cross-Site Request Forgery (CSRF) vulnerability exists in Enhanced Multimedia Router 3.0.4.27 which allows an attacker to add an administrator user with a specified username and password. This is achieved by sending a POST request with the type, cmd, language, slotNo and setString parameters to the formEMR30 page. The setString parameter contains the username, administrator role and password of the user to be added. An attacker can exploit this vulnerability by tricking an authenticated user into clicking a malicious link.
Horde Groupware Webmail Edition 5.2.22 is vulnerable to command injection. An attacker can exploit this vulnerability by sending a maliciously crafted request to the vulnerable application. This can allow the attacker to execute arbitrary commands on the underlying operating system.
A proof-of-concept utility for (maliciously) interacting with the Drobo NASd service. This utility leverages the lack of any real authentication mechanism to perform arbitrary actions such as getting device status, installing applications, resetting admin credentials, popping root shells, and turning on party mode. This set of exploits is known to affect the Drobo 5N2, firmware version 4.1.1 and lower. As of 2020-03-12, newer firmware versions appear to be vulnerable as well, but this has not been verified. Most of the Drobo product line also appears to be vulnerable. These vulnerabilities were disclosed to the manufacturer on 2018-07-10.
Centos WebPanel (http://centos-webpanel.com/) is a free Linux web hosting control panel designed for quick and easy management of (Dedicated & VPS) servers without of need to use ssh console for every little thing. This vulnerability allows an attacker to inject malicious SQL queries into the 'term' parameter of the 'loader_ajax.php' script, which can be used to extract sensitive information from the database or to execute arbitrary code on the server. The payloads used for exploiting this vulnerability are an Error Based SQL Injection and a Time Based SQL Injection.
A buffer overflow vulnerability in AnyBurn 4.8 allows an attacker to execute arbitrary code by sending a specially crafted payload to the application. The vulnerability is due to improper bounds checking of user-supplied input, which can be exploited to cause a stack-based buffer overflow. This can be exploited to execute arbitrary code by overwriting the structured exception handler (SEH) with a custom handler.
This exploit is a proof-of-concept for a PHP Object Injection vulnerability. It uses a specially crafted PHAR file to exploit the Horde_Auth_Passwd class in order to rename a file and execute arbitrary PHP code. The exploit takes five arguments: the base URL of the web application, the username, the password, the filename, and the PHP code to be executed.
Services By CQR