Displaying items by tag: php

VICIdial Multiple Authenticated SQL Injection

PHP Files ≈ Packet Storm Sep 1, 2024 | 17:22 pm

This Metasploit module exploits several authenticated SQL Inject vulnerabilities in VICIdial 2.14b0.5 prior to svn/trunk revision 3555 (VICIBox 10.0.0, prior to January 20 is vulnerable). Injection point 1 is on vicidial/admin.php when adding a user, in the modify_email_accounts parameter. Injection[…]

Icingaweb Directory Traversal In Static Library File Requests

PHP Files ≈ Packet Storm Sep 1, 2024 | 17:21 pm

Icingaweb versions from 2.9.0 to 2.9.5 inclusive, and 2.8.0 to 2.8.5 inclusive suffer from an unauthenticated directory traversal vulnerability. The vulnerability is triggered through the icinga-php-thirdparty library, which allows unauthenticated users to retrieve arbitrary files from the targets filesystem via[…]

Bitweaver Overlay_type Directory Traversal

PHP Files ≈ Packet Storm Sep 1, 2024 | 17:17 pm

This Metasploit module exploits a directory traversal vulnerability found in Bitweaver. When handling the overlay_type parameter, view_overlay.php fails to do any path checking/filtering, which can be abused to read any file outside the virtual directory.

WordPress WPS Hide Login Login Page Revealer

PHP Files ≈ Packet Storm Sep 1, 2024 | 17:13 pm

This Metasploit module exploits a bypass issue with WPS Hide Login versions less than or equal to 1.9. WPS Hide Login is used to make a new secret path to the login page, however a GET request to /wp-admin/options.php with[…]

Chinese Caidao Backdoor Bruteforce

PHP Files ≈ Packet Storm Sep 1, 2024 | 16:46 pm

This Metasploit module attempts to bruteforce the chinese caidao asp/php/aspx backdoor.

WordPress ChopSlider3 Id SQL Injection Scanner

PHP Files ≈ Packet Storm Sep 1, 2024 | 16:45 pm

The iDangero.us Chop Slider 3 WordPress plugin version 3.4 and prior contains a blind SQL injection in the id parameter of the get_script/index.php page. The injection is passed through GET parameters, and thus must be encoded, and magic_quotes is applied[…]

Wordpress LearnPress Current_items Authenticated SQL Injection

PHP Files ≈ Packet Storm Sep 1, 2024 | 16:21 pm

LearnPress, a learning management plugin for WordPress, prior to 3.2.6.8 is affected by an authenticated SQL injection via the current_items parameter of the post-new.php page.

WebPageTest Directory Traversal

PHP Files ≈ Packet Storm Sep 1, 2024 | 16:05 pm

This Metasploit module exploits a directory traversal vulnerability found in WebPageTest. Due to the way the gettext.php script handles the file parameter, it is possible to read a file outside the www directory.

WordPress Total Upkeep Unauthenticated Backup Downloader

PHP Files ≈ Packet Storm Sep 1, 2024 | 15:58 pm

This Metasploit module exploits an unauthenticated database backup vulnerability in WordPress plugin Boldgrid-Backup also known as Total Upkeep version < 1.14.10. First, env-info.php is read to get server information. Next, restore-info.json is read to retrieve the last backup file. That[…]

TYPO3 News Module SQL Injection

PHP Files ≈ Packet Storm Aug 31, 2024 | 22:04 pm

This Metasploit module exploits a SQL Injection vulnerability In TYPO3 NewsController.php in the news module 5.3.2 and earlier. It allows an unauthenticated user to execute arbitrary SQL commands via vectors involving overwriteDemand and OrderByAllowed. The SQL injection can be used[…]

Share This

Follow Us