what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 2 of 2

Files from Hussein Daher

SolarWinds Serv-U Unauthenticated Arbitrary File Read

Posted Aug 31, 2024

Authored by Hussein Daher, sfewer-r7 | Site metasploit.com

This Metasploit module exploits an unauthenticated file read vulnerability, due to directory traversal, affecting SolarWinds Serv-U FTP Server 15.4, Serv-U Gateway 15.4, and Serv-U MFT Server 15.4. All versions prior to the vendor supplied hotfix "15.4.2 Hotfix 2" (version 15.4.2.157) are affected.

tags | exploit

advisories | CVE-2024-28995

SHA-256 | 74b78e70cb2d063327b1549833deab32b97002de13e655b19208d98b76d276d4

Download | Favorite | View

dotCMS Shell Upload

Posted Jun 2, 2022

Authored by jheysel-r7, Hussein Daher, Shubham Shah | Site metasploit.com

When files are uploaded into dotCMS via the content API, but before they become content, dotCMS writes the file down in a temporary directory. In the case of this vulnerability, dotCMS does not sanitize the filename passed in via the multipart request header and thus does not sanitize the temporary file's name. This allows an attacker to use a specially crafted request to POST files to dotCMS via the ContentResource API that gets written outside of the dotCMS temporary directory. In the case of this exploit, an attacker can upload a specially crafted .jsp file to the webapp/ROOT directory of dotCMS which can allow for remote code execution.

tags | exploit, remote, root, code execution

advisories | CVE-2022-26352

SHA-256 | 6278f9faf70f24f5e2ce7692ddce577df263982c2d46d57858bd869409412d14

Download | Favorite | View