exploit the possibilities
Showing 1 - 12 of 12 RSS Feed

Files from Matthew Aberegg

First Active2020-02-20
Last Active2020-11-14
Pandora FMS 7.0 NG 749 SQL Injection
Posted Nov 14, 2020
Authored by Matthew Aberegg, Alex Prieto

Pandora FMS version 7.0 NG 749 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 0a96fd3db600fad511975ab2704c5f66
Nagios XI 5.7.3 Remote Command Injection
Posted Oct 28, 2020
Authored by Chris Lyne, Matthew Aberegg

Nagios XI version 5.7.3 mibs.php remote command injection exploit.

tags | exploit, remote, php
advisories | CVE-2020-5791
MD5 | 8e729d2d07e2d318addb68643737cde7
Nagios XI 5.7.3 SQL Injection
Posted Oct 19, 2020
Authored by Matthew Aberegg

Nagios XI version 5.7.3 suffers from multiple remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
MD5 | 01febd1da2bfd95f219977a57c5aea72
Nagios XI 5.7.3 Cross Site Scripting
Posted Oct 19, 2020
Authored by Matthew Aberegg

Nagios XI version 5.7.3 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 5518e0d87b6798af212ea4a744bb72ea
LimeSurvey 4.3.10 Cross Site Scripting
Posted Aug 24, 2020
Authored by Matthew Aberegg

LimeSurvey version 4.3.10 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 908382af298e4202aa5165d343b52edd
osTicket 1.14.1 Cross Site Scripting
Posted May 27, 2020
Authored by Matthew Aberegg

osTicket version 1.14.1 has been found to be susceptible to multiple additional persistent cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
MD5 | c6f294bb3f9f376aebb5f75ee6d92fa5
LimeSurvey 4.1.11 Cross Site Scripting
Posted May 27, 2020
Authored by Matthew Aberegg

LimeSurvey version 4.1.11 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 1a15187415c4aec92c406c616f07a180
LimeSurvey 4.1.11 Cross Site Scripting
Posted Apr 6, 2020
Authored by Matthew Aberegg, Michael Burkey

LimeSurvey version 4.1.11 suffers from a Survey Groups persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2020-11456
MD5 | efc8f7ad1f3caec2942720df5d64a2b0
pfSense 2.4.4-P3 User Manager Cross Site Scripting
Posted Apr 6, 2020
Authored by Matthew Aberegg

pfSense version 2.4.4-P3 suffers from a User Manager persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2020-11457
MD5 | ab5d42e3954169ff247559e91531a506
LimeSurvey 4.1.11 Path Traversal
Posted Apr 3, 2020
Authored by Matthew Aberegg, Michael Burkey

LimeSurvey version 4.1.11 suffers from a File Manager path traversal vulnerability.

tags | exploit, file inclusion
advisories | CVE-2020-11455
MD5 | 15a17460c92285cb9514da2991c14b64
rConfig 3.9.4 Remote Command Injection
Posted Mar 23, 2020
Authored by Matthew Aberegg, Michael Burkey

rConfig version 3.9.4 suffers from a search.crud.php remote command injection vulnerability.

tags | exploit, remote, php
MD5 | 825dfc3c3e408b5672224d857d18de7b
Apache James Server 2.3.2 Insecure User Creation / Arbitrary File Write
Posted Feb 20, 2020
Authored by Matthew Aberegg, Michael Burkey, Palaczynski Jakub | Site metasploit.com

This Metasploit module exploits a vulnerability that exists due to a lack of input validation when creating a user. Messages for a given user are stored in a directory partially defined by the username. By creating a user with a directory traversal payload as the username, commands can be written to a given directory. To use this module with the cron exploitation method, run the exploit using the given payload, host, and port. After running the exploit, the payload will be executed within 60 seconds. Due to differences in how cron may run in certain Linux operating systems such as Ubuntu, it may be preferable to set the target to Bash Completion as the cron method may not work. If the target is set to Bash completion, start a listener using the given payload, host, and port before running the exploit. After running the exploit, the payload will be executed when a user logs into the system. For this exploitation method, bash completion must be enabled to gain code execution. This exploitation method will leave an Apache James mail object artifact in the /etc/bash_completion.d directory and the malicious user account.

tags | exploit, code execution, bash
systems | linux, ubuntu
advisories | CVE-2015-7611
MD5 | 3d2e5a1c98fb29c02aab67ae9f098b24
Page 1 of 1
Back1Next

File Archive:

November 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    2 Files
  • 2
    Nov 2nd
    9 Files
  • 3
    Nov 3rd
    15 Files
  • 4
    Nov 4th
    90 Files
  • 5
    Nov 5th
    22 Files
  • 6
    Nov 6th
    16 Files
  • 7
    Nov 7th
    1 Files
  • 8
    Nov 8th
    1 Files
  • 9
    Nov 9th
    40 Files
  • 10
    Nov 10th
    27 Files
  • 11
    Nov 11th
    28 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    18 Files
  • 14
    Nov 14th
    2 Files
  • 15
    Nov 15th
    2 Files
  • 16
    Nov 16th
    29 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    15 Files
  • 19
    Nov 19th
    21 Files
  • 20
    Nov 20th
    16 Files
  • 21
    Nov 21st
    1 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    19 Files
  • 24
    Nov 24th
    32 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close