what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 3 of 3

Files from q3rv0

LimeSurvey Deserialization Remote Code Execution

Posted Apr 2, 2019

Authored by q3rv0

LimeSurvey versions prior to 3.16 suffer from a deserialization remote code execution vulnerability.

tags | exploit, remote, code execution

advisories | CVE-2018-17057

SHA-256 | 5f22a64f3b0f495802f3ff1d9275d03518b89fed4059b298e7a3fd25f0eaff0b

Download | Favorite | View

elFinder PHP Connector exiftran Command Injection

Posted Mar 12, 2019

Authored by Brendan Coles, Thomas Chauchefoin, q3rv0 | Site metasploit.com

This Metasploit module exploits a command injection vulnerability in elFinder versions prior to 2.1.48. The PHP connector component allows unauthenticated users to upload files and perform file modification operations, such as resizing and rotation of an image. The file name of uploaded files is not validated, allowing shell metacharacters. When performing image operations on JPEG files, the filename is passed to the exiftran utility without appropriate sanitization, causing shell commands in the file name to be executed, resulting in remote command injection as the web server user. The PHP connector is not enabled by default. The system must have exiftran installed and in the PATH. This module has been tested successfully on elFinder versions 2.1.47, 2.1.20, and 2.1.16 on Ubuntu.

tags | exploit, remote, web, shell, php

systems | linux, ubuntu

SHA-256 | 5222268c0c1677f7e0637fd6b8a807ef9ea4bfb24107aadeb85ce45155354bc3

Download | Favorite | View

elFinder 2.1.47 Command Injection

Posted Mar 5, 2019

Authored by q3rv0

elFinder versions 2.1.47 and below suffer from a command injection vulnerability in the PHP connector.

tags | exploit, php

advisories | CVE-2019-9194

SHA-256 | c18a99273f5751aac3069a948d7904a72a24ff8573296cdae06be2c2d58ce090

Download | Favorite | View