exploit the possibilities
Showing 1 - 25 of 993 RSS Feed

CGI Files

Cayin CMS NTP Server 11.0 Remote Code Execution
Posted Jun 18, 2020
Authored by LiquidWorm, h00die | Site metasploit.com

This Metasploit module exploits an authenticated remote code execution vulnerability in Cayin CMS versions 11.0 and below. The code execution is executed in the system_service.cgi file's ntpIp Parameter. The field is limited in size, so repeated requests are made to achieve a larger payload. Cayin CMS-SE is built for Ubuntu 16.04 (20.04 failed to install correctly), so the environment should be pretty set and not dynamic between targets. Results in root level access.

tags | exploit, remote, cgi, root, code execution
systems | linux, ubuntu
advisories | CVE-2020-7357
MD5 | 5b71abbf1e64c3cce0a48cc8d48f03b0
Cayin Content Management Server 11.0 Root Remote Command Injection
Posted Jun 4, 2020
Authored by LiquidWorm | Site zeroscience.mk

CAYIN CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the NTP_Server_IP HTTP POST parameter in system.cgi page.

tags | exploit, web, arbitrary, shell, cgi, root
MD5 | 2b40a82dbae2a46bd38664601734d373
Cayin Signage Media Player 3.0 Root Remote Command Injection
Posted Jun 4, 2020
Authored by LiquidWorm | Site zeroscience.mk

CAYIN SMP-xxxx suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the NTP_Server_IP HTTP GET parameter in system.cgi and wizard_system.cgi pages.

tags | exploit, web, arbitrary, shell, cgi, root
MD5 | 9a04cbad2c7bcc1e00789b91f73a0061
Secure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read / Write
Posted Jun 4, 2020
Authored by LiquidWorm | Site zeroscience.mk

Secure Computing SnapGear Management Console SG560 version 3.1.5 suffers from arbitrary file read and write vulnerabilities. The application allows the currently logged-in user to edit the configuration files in the system using the CGI executable edit_config_files in /cgi-bin/cgix/. The files that are allowed to be modified (read/write/delete) are located in the /etc/config/ directory. An attacker can manipulate the POST request parameters to escape from the restricted environment by using absolute path and start reading, writing and deleting arbitrary files on the system.

tags | exploit, arbitrary, cgi, vulnerability
MD5 | 71fd7f2810f3f64fb2be820cb487f7b5
Synology DiskStation Manager smart.cgi Remote Command Execution
Posted May 22, 2020
Authored by h00die, Nigusu Kassahu | Site metasploit.com

This Metasploit module exploits a vulnerability found in Synology DiskStation Manager (DSM) versions prior to 5.2-5967-5, which allows the execution of arbitrary commands under root privileges after website authentication. The vulnerability is located in webman/modules/StorageManager/smart.cgi, which allows appending of a command to the device to be scanned. However, the command with drive is limited to 30 characters. A somewhat valid drive name is required, thus /dev/sd is used, even though it does not exist. To circumvent the character restriction, a wget input file is staged in /a, and executed to download our payload to /b. From there the payload is executed. A wfsdelay is required to give time for the payload to download, and the execution of it to run.

tags | exploit, arbitrary, cgi, root
advisories | CVE-2017-15889
MD5 | 7f25ddec9b67ccf5376f21659f58915a
Ubuntu Security Notice USN-4356-1
Posted May 13, 2020
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4356-1 - Jeriko One discovered that Squid incorrectly handled certain Edge Side Includes responses. A malicious remote server could cause Squid to crash, possibly poison the cache, or possibly execute arbitrary code. It was discovered that Squid incorrectly handled the hostname parameter to cachemgr.cgi when certain browsers are used. A remote attacker could possibly use this issue to inject HTML or invalid characters in the hostname parameter. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. Various other issues were also addressed.

tags | advisory, remote, arbitrary, cgi
systems | linux, ubuntu
advisories | CVE-2019-12519, CVE-2019-18860, CVE-2020-11945
MD5 | 912e3785476f63f63c09c04aa1de6291
Zen Load Balancer 3.10.1 Directory Traversal
Posted Apr 23, 2020
Authored by Dhiraj Mishra, Basim Alabdullah | Site metasploit.com

This Metasploit module exploits an authenticated directory traversal vulnerability in Zen Load Balancer version 3.10.1. The flaw exists in index.cgi not properly handling the filelog= parameter which allows a malicious actor to load arbitrary file path.

tags | exploit, arbitrary, cgi, file inclusion
MD5 | 098e961d63357b612d0c1f8c93294ae0
D-Link DIR-859 Unauthenticated Remote Command Execution
Posted Jan 22, 2020
Authored by Miguel Mendez Z, Pablo Pollanco P | Site metasploit.com

D-Link DIR-859 Routers are vulnerable to OS command injection via the UPnP interface. The vulnerability exists in /gena.cgi (function genacgi_main() in /htdocs/cgibin), which is accessible without credentials.

tags | exploit, cgi
advisories | CVE-2019-17621
MD5 | f5cec50c246c0217d1a4e5586f49167e
Barco WePresent file_transfer.cgi Command Injection
Posted Jan 14, 2020
Authored by Jacob Baines | Site metasploit.com

This Metasploit module exploits an unauthenticated remote command injection vulnerability found in Barco WePresent and related OEM'ed products. The vulnerability is triggered via an HTTP POST request to the file_transfer.cgi endpoint.

tags | exploit, remote, web, cgi
advisories | CVE-2019-3929
MD5 | 9bf16d3b24df38008118d2a86f469b2e
Rifatron Intelligent Digital Security System (animate.cgi) Stream Disclosure
Posted Sep 9, 2019
Authored by LiquidWorm | Site zeroscience.mk

The Rifatron Intelligent Digital Security System DVR suffers from an unauthenticated and unauthorized live stream disclosure when animate.cgi script is called through Mobile Web Viewer module.

tags | exploit, web, cgi
MD5 | 3b87e27dbb257291ff6eeadfd9dc0201
Debian Security Advisory 4507-1
Posted Aug 26, 2019
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4507-1 - Several vulnerabilities were discovered in Squid, a fully featured web proxy cache. The flaws in the HTTP Digest Authentication processing, the HTTP Basic Authentication processing and in the cachemgr.cgi allowed remote attackers to perform denial of service and cross-site scripting attacks, and potentially the execution of arbitrary code.

tags | advisory, remote, web, denial of service, arbitrary, cgi, vulnerability, xss
systems | linux, debian
advisories | CVE-2019-12525, CVE-2019-12527, CVE-2019-12529, CVE-2019-12854, CVE-2019-13345
MD5 | 0b6d68d6e455fb14945370ed3a945be0
Ubuntu Security Notice USN-4059-1
Posted Jul 16, 2019
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4059-1 - It was discovered that Squid incorrectly handled certain SNMP packets. A remote attacker could possibly use this issue to cause memory consumption, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that Squid incorrectly handled the cachemgr.cgi web module. A remote attacker could possibly use this issue to conduct cross-site scripting attacks. Various other issues were also addressed.

tags | advisory, remote, web, denial of service, cgi, xss
systems | linux, ubuntu
advisories | CVE-2018-19132, CVE-2019-13345
MD5 | bf7b4c06d599e5f9a96a8cba60efc48b
ABB IDAL HTTP Server Authentication Bypass
Posted Jun 21, 2019
Authored by Eldar Marcussen

The IDAL HTTP server CGI interface contains a URL, which allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. In the IDAL CGI interface, there is a URL (/cgi/loginDefaultUser), which will create a session in an authenticated state and return the session ID along with the username and plaintext password of the user. An attacker can then login with the provided credentials or supply the string 'IDALToken=......' in a cookie which will allow them to perform privileged operations such as restarting the service with /cgi/restart.

tags | exploit, web, cgi
advisories | CVE-2019-7226
MD5 | 859c2710995c4452403cd17e5573e137
Telus Actiontec WEB6000Q Denial Of Service
Posted Jun 12, 2019
Authored by Andrew Klaus

Telus Actiontec WEB6000Q with firmware 1.1.02.22 suffers from a denial of service vulnerability. By querying CGI endpoints with empty (GET/POST/HEAD) requests causes a Segmentation Fault of the uhttpd webserver. Since there is no watchdog on this daemon, a device reboot is needed to restart the webserver to make any modification to the device.

tags | exploit, denial of service, cgi
MD5 | 61ad8f29ac935743a8389851c8f021d3
RICOH SP 4520DN Printer HTML Injection
Posted May 9, 2019
Authored by Ismail Tasdelen

An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter.

tags | exploit, web, cgi
advisories | CVE-2019-11844
MD5 | fd1ac650bd2e060a9b78273915e76b78
RICOH SP 4510DN Printer HTML Injection
Posted May 9, 2019
Authored by Ismail Tasdelen

An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.

tags | exploit, web, cgi
advisories | CVE-2019-11845
MD5 | 091565094b0990b421b40e6d6da3cf07
Sierra Wireless AirLink ES450 ACEManager template_load.cgi Information Disclosure
Posted Apr 27, 2019
Authored by Cisco Talos, Jared Rittle, Carl Hurd | Site talosintelligence.com

An exploitable information disclosure vulnerability exists in the ACEManager template_load.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a information leak, resulting in the disclosure of internal paths and files. An attacker can make an authenticated HTTP request to trigger this vulnerability.

tags | exploit, web, cgi, info disclosure
advisories | CVE-2018-4067
MD5 | 49c6b8453e708ea1875261fc0fb7e6b4
Sierra Wireless AirLink ES450 ACEManager Embedded_Ace_Set_Task.cgi Permission Assignment
Posted Apr 26, 2019
Authored by Cisco Talos, Carl Hurd

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a arbitrary setting writes, resulting in the unverified changes to any system setting. An attacker can make an authenticated HTTP request, or run the binary as any user, to trigger this vulnerability.

tags | exploit, web, arbitrary, cgi
MD5 | 0f3b585e275dc29efbe52de38fd0b8e8
Sierra Wireless AirLink ES450 ACEManager Embedded_Ace_Get_Task.cgi Information Disclosure
Posted Apr 26, 2019
Authored by Cisco Talos, Jared Rittle, Carl Hurd | Site talosintelligence.com

An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause an information disclosure, resulting in the exposure of confidential information, including, but not limited to, plaintext passwords and SNMP community strings. An attacker can make an authenticated HTTP request, or run the binary, to trigger this vulnerability.

tags | exploit, web, cgi, info disclosure
advisories | CVE-2018-4070, CVE-2018-4071
MD5 | 8ba2b4250c4d3b8dec008f0a0b5494f7
Sierra Wireless AirLink ES450 ACEManager upload.cgi Remote Code Execution
Posted Apr 26, 2019
Authored by Cisco Talos, Carl Hurd

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

tags | exploit, remote, web, cgi, code execution
advisories | CVE-2018-4063
MD5 | ac04df60e4e0507d11c443363e02ff57
Sierra Wireless AirLink ES450 ACEManager ping_result.cgi Cross Site Scripting
Posted Apr 26, 2019
Authored by Cisco Talos, Carl Hurd | Site talosintelligence.com

An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause reflected javascript code execution, resulting in the execution of javascript code running on the victim's browser. An attacker can get a victim to click a link, or embedded URL, that redirects to the reflected cross-site scripting vulnerability to trigger this vulnerability.

tags | exploit, web, cgi, javascript, code execution, xss
advisories | CVE-2018-4065
MD5 | 9c802870395109f5bce702b93c61851d
Sierra Wireless AirLink ES450 ACEManager upload.cgi Unverified Password Change
Posted Apr 26, 2019
Authored by Cisco Talos, Carl Hurd | Site talosintelligence.com

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the device. An attacker can make an authenticated HTTP request to trigger this vulnerability.

tags | exploit, web, cgi
advisories | CVE-2018-4064
MD5 | baf62120435fdb24226142fdf451c0e8
Sierra Wireless AirLink ES450 ACEManager iplogging.cgi Command Injection
Posted Apr 26, 2019
Authored by Cisco Talos, Jared Rittle, Carl Hurd | Site talosintelligence.com

An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can inject arbitrary commands, resulting in arbitrary command execution. An attacker can send an authenticated HTTP request to trigger this vulnerability.

tags | exploit, web, arbitrary, cgi
advisories | CVE-2018-4061
MD5 | 51ec79c16e9a99071ffbb6e2512b3932
Imperva SecureSphere 13.x PWS Command Injection
Posted Mar 6, 2019
Authored by rsp3ar | Site metasploit.com

This Metasploit module exploits a command injection vulnerability in Imperva SecureSphere version 13.x. The vulnerability exists in the PWS service, where Python CGIs did not properly sanitize user supplied command parameters and directly passes them to corresponding CLI utility, leading to command injection. Agent registration credential is required to exploit SecureSphere in gateway mode. This module was successfully tested on Imperva SecureSphere 13.0/13.1/13.2 in pre-ftl mode and unsealed gateway mode.

tags | exploit, cgi, python
MD5 | e604d6ec0f3e74e3aaaaa80c5c18a797
devolo dLAN 550 duo+ 3.1.0-1 Starter Kit Remote Code Execution
Posted Feb 5, 2019
Authored by Stefan Petrushevski | Site zeroscience.mk

devolo dLAN 550 duo+ version 3.1.0-1 suffers from a remote code execution vulnerability. The devolo firmware has what seems to be a 'hidden' services which can be enabled by authenticated attacker via the the htmlmgr CGI script. This allows the attacker to start services that are deprecated or discontinued and achieve remote arbitrary code execution with root privileges.

tags | exploit, remote, arbitrary, cgi, root, code execution
MD5 | d0d9a695ba647ee2e5787de552d0538e
Page 1 of 40
Back12345Next

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    13 Files
  • 2
    Jul 2nd
    0 Files
  • 3
    Jul 3rd
    0 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close