exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 43 RSS Feed

Files from Mehmet Ince

Email addressmehmet at mehmetince.net
First Active2012-04-26
Last Active2023-08-03
OX App Suite SSRF / SQL Injection / Cross Site Scripting
Posted Aug 3, 2023
Authored by Mehmet Ince, Martin Heiland, Tim Coen, Eldar Zeynalli

OX App Suite suffers from remote SQL injection, server-side request forgery, cross site scripting, improper neutralization, command injection, and exposure of sensitive information vulnerabilities.

tags | advisory, remote, vulnerability, xss, sql injection
advisories | CVE-2023-26430, CVE-2023-26438, CVE-2023-26439, CVE-2023-26440, CVE-2023-26441, CVE-2023-26442, CVE-2023-26443, CVE-2023-26445, CVE-2023-26446, CVE-2023-26447, CVE-2023-26448, CVE-2023-26449, CVE-2023-26450, CVE-2023-26451
SHA-256 | 719567b07d01c758653bc54850b5ade966278aebda53de372168e4c5c9d605c8
OX App Suite SSRF / Resource Consumption / Command Injection
Posted Jun 22, 2023
Authored by Mehmet Ince, Martin Heiland, Tim Coen, Icare

OX App Suite suffers from server-side request forgery, command injection, uncontrolled resource consumption, code injection, authorization bypass, and insecure storage vulnerabilities. Various versions in the 7.10.x and 8.x branches are affected.

tags | advisory, vulnerability
advisories | CVE-2023-26427, CVE-2023-26428, CVE-2023-26429, CVE-2023-26431, CVE-2023-26432, CVE-2023-26433, CVE-2023-26434, CVE-2023-26435, CVE-2023-26436
SHA-256 | a27979ae3ae36aed54def31f404e98c49b579e2113420246b0b046bb9f32e18d
GravCMS 1.10.7 Arbitrary YAML Write / Update
Posted Jun 10, 2021
Authored by Mehmet Ince, legend

GravCMS version 1.10.7 unauthenticated arbitrary YAML write/update exploit. This is a variant exploit of the original discovery made by Mehmet Ince in April of 2021.

tags | exploit, arbitrary
SHA-256 | 49140ae899e7ff1751c131e4e4771cefd61241671559ec6115024c9f61838e8c
GravCMS 1.10.7 Remote Command Execution
Posted May 4, 2021
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits an arbitrary config write/update vulnerability to achieve remote code execution. Unauthenticated users can execute a terminal command under the context of the web server user. Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of the administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system commands under the context of the web-server user.

tags | exploit, remote, web, arbitrary, code execution
advisories | CVE-2021-21425
SHA-256 | 98b7fd4e5a9eac0e57bc304d77db3533d90d58846a9eac785a65d9954b59c324
GravCMS 1.10.7 Remote Command Execution
Posted Apr 21, 2021
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits an arbitrary configuration write/update vulnerability to achieve remote code execution. Unauthenticated users can execute a terminal command under the context of the web server user. Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user.

tags | exploit, remote, web, arbitrary, code execution
advisories | CVE-2021-21425
SHA-256 | abded99044d29ee61fd87425114e92d627cb24bfd4a08cbdc45f77650c84534d
Trend Micro Web Security Remote Code Execution
Posted Jul 14, 2020
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits multiple vulnerabilities together in order to achieve remote code execution in Trend Micro Web Security versions prior to 6.5 SP2 Patch 4 (Build 1901).

tags | exploit, remote, web, vulnerability, code execution
advisories | CVE-2020-8604, CVE-2020-8605, CVE-2020-8606
SHA-256 | 9664c9cbae3eb80a568d35406cf2acc152b6130f2cb92627857e239b45ba2249
Trend Micro Web Security (Virtual Appliance) Remote Code Execution
Posted Jun 22, 2020
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits multiple vulnerabilities together in order to achieve a remote code execution. Unauthenticated users can execute a terminal command under the context of the root user. The specific flaw exists within the LogSettingHandler class of administrator interface software. When parsing the mount_device parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. But authentication is required to exploit this vulnerability. Another specific flaw exist within the proxy service, which listens on port 8080 by default. Unauthenticated users can exploit this vulnerability in order to communicate with internal services in the product. Last but not least a flaw exists within the Apache Solr application, which is installed within the product. When parsing the file parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the IWSS user. Due to combination of these vulnerabilities, unauthenticated users can execute a terminal command under the context of the root user. Version prior to 6.5 SP2 Patch 4 (Build 1901) are affected.

tags | exploit, remote, root, vulnerability, code execution
advisories | CVE-2020-8604, CVE-2020-8605, CVE-2020-8606
SHA-256 | 4aee71179ce97ff14964220e5add145f6a56bc5f34e2d1ffa3729b6a8b812d7c
Vesta Control Panel Authenticated Remote Code Execution
Posted Apr 14, 2020
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits an authenticated command injection vulnerability in the v-list-user-backups bash script file in Vesta Control Panel to gain remote code execution as the root user.

tags | exploit, remote, root, code execution, bash
advisories | CVE-2020-10808
SHA-256 | a64694c4be6f8e142202272067ab8240d23b31e8f44348ffeb1c7d3cbe55c1cf
Vesta Control Panel Authenticated Remote Code Execution
Posted Apr 6, 2020
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits command injection vulnerability in v-list-user-backups bash script file. Low privileged authenticated users can execute arbitrary commands under the context of the root user. An authenticated attacker with a low privileges can inject a payload in the file name starts with dot. During the user backup process, this file name will be evaluated by the v-user-backup bash scripts. As result of that backup process, when an attacker try to list existing backups injected payload will be executed.

tags | exploit, arbitrary, root, bash
advisories | CVE-2020-10808
SHA-256 | c994018871aaf2d9fb2b0d77fe7087abdbe4671491c2b25721371a3f880b91c3
Mailcleaner Remote Code Execution
Posted Jan 8, 2019
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits the command injection vulnerability of MailCleaner Community Edition product. An authenticated user can execute an operating system command under the context of the web server user which is root. /admin/managetracing/search/search endpoint takes several user inputs and then pass them to the internal service which is responsible for executing operating system command. One of the user input is being passed to the service without proper validation. That cause a command injection vulnerability.

tags | exploit, web, root
advisories | CVE-2018-20323
SHA-256 | 9be39a4bc9f67632a6a5377d1cf086a107e68b119a124c2b425f517817903bb6
MicroFocus Secure Messaging Gateway Remote Code Execution
Posted Jul 31, 2018
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits a SQL injection and command injection vulnerability in MicroFocus Secure Messaging Gateway. An unauthenticated user can execute a terminal command under the context of the web user. One of the user supplied parameters of API endpoint is used by the application without input validation and/or parameter binding, which leads to SQL injection vulnerability. Successfully exploiting this vulnerability gives a ability to add new user onto system. manage_domains_dkim_keygen_request.php endpoint is responsible for executing an operation system command. It's not possible to access this endpoint without having a valid session. Combining these vulnerabilities gives the opportunity execute operation system commands under the context of the web user.

tags | exploit, web, php, vulnerability, sql injection
advisories | CVE-2018-12464, CVE-2018-12465
SHA-256 | e048b287fa9b1c563e4abbef41aa3bba7b08f57876871aa13df7a85cbfa88dc7
Liferay Portal Server-Side Request Forgery
Posted Jun 26, 2018
Authored by Mehmet Ince

Liferay Portal versions prior to 7.0.4 suffer from a server-side request forgery vulnerability.

tags | exploit
SHA-256 | 9cd4a09a6913c2e09ea065cb580a2524d7a76aafcb6212597452862aa04d2d5b
ManageEngine Application Manager Remote Code Execution
Posted Mar 29, 2018
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits a command injection vulnerability in the ManageEngine Application Manager product. An unauthenticated user can execute an operating system command under the context of privileged user. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing the given system. This endpoint calls several internal classes and then executes powershell script without validating user supplied parameter when the given system is OfficeSharePointServer.

tags | exploit
advisories | CVE-2018-7890
SHA-256 | a9eac798117fa04eab31bed74f5ad242fd765118d1e7c673979dc44d64574e70
ManageEngine Applications Manage 13.5 Remote Code Execution
Posted Mar 14, 2018
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits command injection vulnerability in the ManageEngine Application Manager product. An unauthenticated user can execute a operating system command under the context of privileged user. Publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing given system. This endpoint calls a several internal classes and then executes powershell script without validating user supplied parameter when the given system is OfficeSharePointServer.

tags | exploit
advisories | CVE-2018-7890
SHA-256 | d4f871c5887f7ee0122aef5bca04d405628413f3c4bf84245c1d860683f61f1f
Kaltura Remote PHP Code Execution
Posted Jan 24, 2018
Authored by Robin Verton, Mehmet Ince | Site metasploit.com

This Metasploit module exploits an Object Injection vulnerability in Kaltura. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the context of the web server user. Kaltura makes use of a hard-coded cookie secret which allows to sign arbitrary cookie data. After passing this signature check, the base64- decoded data is passed to PHPs unserialize() function which allows for code execution. The constructed object is again based on the SektionEins Zend code execution POP chain PoC. Kaltura versions prior to 13.1.0 are affected by this issue. A valid entry_id (which is required for this exploit) can be obtained from any media resource published on the kaltura installation. This Metasploit module was tested against Kaltura 13.1.0-2 installed on Ubuntu 14.04.

tags | exploit, web, arbitrary, php, code execution
systems | linux, ubuntu
advisories | CVE-2017-14143
SHA-256 | da00d7666ebcac087d98220e64d9b76abb02af42dcd0af40a1090b15bf80f97d
Xplico Remote Code Execution
Posted Jan 4, 2018
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits a command injection vulnerability in Xplico. Unauthenticated users can register a new account and then execute a terminal command under the context of the root user.

tags | exploit, root
advisories | CVE-2017-16666
SHA-256 | 651a38434d2ab0908b45d4a1f3933f9debbdefd5170e43cc8c63abccb34a9de0
Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution
Posted Oct 12, 2017
Authored by mr_me, Mehmet Ince | Site metasploit.com

This Metasploit module exploits the authentication bypass and command injection vulnerability together. Unauthenticated users can execute a terminal command under the context of the web server user. The specific flaw exists within the management interface, which listens on TCP port 443 by default. Trend Micro IMSVA product have widget feature which is implemented with PHP. Insecurely configured web server exposes diagnostic.log file, which leads to an extraction of JSESSIONID value from administrator session. Proxy.php files under the mod TMCSS folder takes multiple parameter but the process does not properly validate a user-supplied string before using it to execute a system call. Due to combination of these vulnerabilities, unauthenticated users can execute a terminal command under the context of the web server user.

tags | exploit, web, php, tcp, vulnerability
SHA-256 | a28a0e405c43d1d9d228e28261a5e904e2adcd99280b5dee750ba1116cc84e02
Trend Micro OfficeScan Remote Code Execution
Posted Oct 10, 2017
Authored by mr_me, Mehmet Ince | Site metasploit.com

This Metasploit module exploits the authentication bypass and command injection vulnerability together. Unauthenticated users can execute a terminal command under the context of the web server user. The specific flaw exists within the management interface, which listens on TCP port 443 by default. The Trend Micro Officescan product has a widget feature which is implemented with PHP. Talker.php takes ack and hash parameters but doesn't validate these values, which leads to an authentication bypass for the widget. Proxy.php files under the mod TMCSS folder take multiple parameters but the process does not properly validate a user-supplied string before using it to execute a system call. Due to combination of these vulnerabilities, unauthenticated users can execute a terminal command under the context of the web server user.

tags | exploit, web, php, tcp, vulnerability
SHA-256 | 533339b2e9cfb58d88fe79c7a17a4f87348ca31165bf2459d2e7dc2caa154258
Lansweeper 6.0.100.29 XXE Injection
Posted Oct 6, 2017
Authored by Mehmet Ince, Barkin Kilic

Lansweeper version 6.0.100.29 suffers from an XML external entity injection vulnerability.

tags | exploit, xxe
advisories | CVE-2017-13706
SHA-256 | ca71842cb4e74173030f211999d389dfe2a9a3c19eef8bf22a35b124a45d5cc4
DenyAll Web Application Firewall Remote Code Execution
Posted Sep 23, 2017
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits the command injection vulnerability of DenyAll Web Application Firewall. Unauthenticated users can execute a terminal command under the context of the web server user.

tags | exploit, web
SHA-256 | e5643fffa4297f5d5b48f257e93c3396e073c9df8c778d9d0abdbed89abcab11
osTicket 1.10 SQL Injection
Posted Sep 12, 2017
Authored by Mehmet Ince

osTicket version 1.10 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | 3feeef525bb7271c84565e167ff0e5ee54f65bbf1cde45d747e30cb4cf1c6b40
Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution
Posted Aug 18, 2017
Authored by Mehmet Ince, Cody Sixteen | Site metasploit.com

This Metasploit module exploits a command injection vulnerability in the Trend Micro IMSVA product. An authenticated user can execute a terminal command under the context of the web server user which is root. Besides, default installation of IMSVA comes with a default administrator credentials. WizardSetting_sys.imss endpoint takes several user inputs and performs LAN settings. After that it use them as argument of predefined operating system command without proper sanitation. It's possible to inject arbitrary commands into it. InterScan Messaging Security prior to 9.1.-1600 affected by this issue.

tags | exploit, web, arbitrary, root
SHA-256 | 50f31837beea28b6c9830ae6763884d12cce54426a4afac257f09c46574b30b4
Symantec Messaging Gateway Remote Code Execution
Posted Jun 24, 2017
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits the command injection vulnerability of Symantec Messaging Gateway product. An authenticated user can execute a terminal command under the context of the web server user which is root. backupNow.do endpoint takes several user inputs and then pass them to the internal service which is responsible for executing operating system command. One of the user input is being passed to the service without proper validation. That cause an command injection vulnerability. But given parameters, such a SSH ip address, port and credentials are validated before executing terminal command. Thus, you need to configure your own SSH service and set the required parameter during module usage. This Metasploit module was tested against Symantec Messaging Gateway 10.6.2-7.

tags | exploit, web, root
advisories | CVE-2017-6326
SHA-256 | 65388a1ffa6f7c2c3a870b20d908b020bed384530b6eb97b4dccaaf421a58506
Crypttech CryptoLog Remote Code Execution
Posted May 6, 2017
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits the sql injection and command injection vulnerability of CryptoLog. An un-authenticated user can execute a terminal command under the context of the web user. login.php endpoint is responsible for login process. One of the user supplied parameter is used by the application without input validation and parameter binding. Which cause a sql injection vulnerability. Successfully exploitation of this vulnerability gives us the valid session. logshares_ajax.php endpoint is responsible for executing an operation system command. It's not possible to access this endpoint without having a valid session. One user parameter is used by the application while executing operating system command which cause a command injection issue. Combining these vulnerabilities gives us opportunity execute operation system command under the context of the web user.

tags | exploit, web, php, vulnerability, sql injection
SHA-256 | 97d1903b1ed69d9b0833b9db096b292f5c03ed4da142e52b87fb8a7d606f1f98
SolarWind LEM Default SSH Password Remote Code Execution
Posted Apr 4, 2017
Authored by Mehmet Ince | Site metasploit.com

This Metasploit module exploits the default credentials of SolarWind LEM. A menu system is encountered when the SSH service is accessed with the default username and password which is "cmc" and "password". By exploiting a vulnerability that exist on the menuing script, an attacker can escape from restricted shell. This Metasploit module was tested against SolarWinds LEM v6.3.1.

tags | exploit, shell
SHA-256 | 38c9a347de106f708a89c8ce2d154e8a0699cc4ed9c612954b9310a28b9b7379
Page 1 of 2
Back12Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close