Expoit Files ≈ Packet Storm

Packet Storm – Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers

BMD BMDWeb 2.0 versions prior to 24.01.21 suffer from persistent cross site scripting vulnerabilities.
Packed.Win32.Black.d malware has an unauthenticated open proxy vulnerability.
OTRS version 6.0.1 remote command execution exploit.
Backdoor.Win32.DarkKomet.artr malware suffers from an insecure permissions vulnerability.
Trojan-Dropper.Win32.Agent.xtp malware suffers from an insecure permissions vulnerability.
RemoteClinic version 2.0 suffers from multiple persistent cross site scripting vulnerabilities.
IM-Worm.Win32.Bropia.aa malware suffers from an insecure permissions vulnerability.
HEUR.Trojan.Win32.Generic malware suffers from an insecure permissions vulnerability.
CMS Made Simple version 2.2.15 suffers from a reflective cross site scripting vulnerability.
This Metasploit module exploits an arbitrary configuration write/update vulnerability to achieve remote code execution. Unauthenticated users can execute a terminal command under the context of the web server user. Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user.
This Metasploit module exploits an OS command injection vulnerability in includes/components/nxti/index.php that enables an authenticated user with admin privileges to achieve remote code execution as the apache user. Valid credentials for a Nagios XI admin user are required. This module has been successfully tested against Nagios XI 5.7.3 running on CentOS 7.
This Metasploit module exploits two NoSQL injection vulnerabilities to retrieve the user list and password reset tokens from the system. Next, the USER is targeted to reset their password. Then, a command injection vulnerability is used to execute the payload. While it is possible to upload a payload and execute it, the command injection provides a no disk write method which is more stealthy. Cockpit CMS versions 0.10.0 through 0.11.1, inclusive, contain all the necessary vulnerabilities for exploitation.
Adtran Personal Phone Manager version 10.8.1 suffers from a DNS exfiltration vulnerability.
Hasura GraphQL version 1.3.3 suffers from a denial of service vulnerability.
OpenEMR version 5.0.2.1 remote code execution exploit that drops in a reverse shell.
Tenda versions D151 and D301 configuration downloading exploit.
Adtran Personal Phone Manager version 10.8.1 suffers from multiple reflective cross site scripting vulnerabilities.
Adtran Personal Phone Manager version 10.8.1 suffers from a persistent cross site scripting vulnerability.
Hasura GraphQL version 1.3.3 suffers from a server-side request forgery vulnerability.
Hasura GraphQL version 1.3.3 suffers from an arbitrary file read vulnerability.

rconfig 3.9.6 Shell Upload

21 April 2021, 2:49 pm

rconfig versions 3.9.6 and below shell upload exploit. This is a variant of the flaw discovered in the same version by Murat Seker in March of 2021.
RemoteClinic 2 suffers from multiple cross site scripting vulnerabilities.
WordPress RSS for Yandex Turbo plugin version 1.29 suffers from a persistent cross site scripting vulnerability.
Multilaser Router RE018 AC1200 suffers from a cross site request forgery vulnerability.

Fast PHP Chat 1.3 SQL Injection

21 April 2021, 2:33 pm

Fast PHP Chat version 1.3 suffers from a remote SQL injection vulnerability.