This Metasploit module exploits a directory traversal flaw found in ManageEngine SecurityManager Plus 5.5 or less. When handling a file download request, the DownloadServlet class fails to properly check the f parameter, which can be abused to read any file outside the virtual directory.
98b90060e56e53ae955e5807e913d453feb2e176f2c8a1d9bd2e96baeda6e4c2This Metasploit module exploits a directory traversal flaw found in Clansphere 2011.3. The application fails to handle the cs_lang parameter properly, which can be used to read any file outside the virtual directory.
8c388b0595a2b36d16445e43deb2333fed77b9a4cda530522fc89615a19444edphp_rshell is a ruby script which converts a binary backdoor to hex and creates a windows php reverse backdoor that will be executed on the server.
0fecd8cff34a4c706edcda435ad534f566cb1869bf12bb112959c918e6d7771cThis archive includes the source and a binary for a small Windows reverse shell.
90b4698c98d0968c39961359e2ce541617ee746a3f9d1e360bbc5deb166b3938ClanSphere version 2011.3 suffers from a local file inclusion vulnerability in the cs_lang cookie parameter. This advisory has two exploits included and one of them uses /proc/self/environ to launch a connect-back shell.
50280bcb8c3b2e6ce87a096338f3c12375645758f8f387468802187432e5f378Xoops version 2.5.4 suffers from a remote blind SQL injection vulnerability.
2b179a5b592970daa6c84cd35f7b2c76a1fa845165abf65d270f5d19cbea058e
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed