what you don't know can hurt you
Showing 1 - 25 of 886 RSS Feed

File Upload Files

Ubuntu Security Notice USN-4590-1
Posted Oct 20, 2020
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4590-1 - It was discovered that Collabtive did not properly validate avatar image file uploads. An authenticated user could exploit this with a crafted file to cause Collabtive to execute arbitrary code.

tags | advisory, arbitrary, file upload
systems | linux, ubuntu
advisories | CVE-2015-0258
MD5 | 179fd7eba43ef7a3691ef8f62753e5e7
ReQuest Serious Play F3 Media Server 7.0.3 Unauthenticated Remote Code Execution
Posted Oct 19, 2020
Authored by LiquidWorm | Site zeroscience.mk

ReQuest Serious Play F3 Media Server version 7.0.3 suffers from an unauthenticated remote code execution vulnerability. Abusing the hidden ReQuest Internal Utilities page (/tools) from the services provided, an attacker can exploit the Quick File Uploader (/tools/upload.html) page and upload PHP executable files that results in remote code execution as the web server user.

tags | exploit, remote, web, php, code execution, file upload
MD5 | 27df19dca8c37dc3db671041baa681bf
Sage DPW 2020_06_000 / 2020_06_001 XSS / File Upload
Posted Oct 12, 2020
Authored by Gerhard Hechenberger, Stefan Michlits | Site sec-consult.com

Sage DPW versions 2020_06_000 and 2020_06_001 suffer from cross site scripting and unauthenticated malicious file upload vulnerabilities.

tags | exploit, vulnerability, xss, file upload
advisories | CVE-2020-26583, CVE-2020-26584
MD5 | 524445f4adeb021b41c82c7d3a160f5b
openMAINT 1.1-2.4.2 Arbitrary File Upload
Posted Oct 12, 2020
Authored by mrb3n

openMAINT version 1.1-2.4.2 suffers from an arbitrary file upload vulnerability.

tags | exploit, arbitrary, file upload
MD5 | 1e4843b975a1cb67fdef303a4b35c16f
MaraCMS 7.5 Remote Code Execution
Posted Sep 28, 2020
Authored by Erik Wynter, Michele Cisternino | Site metasploit.com

This Metasploit module exploits an arbitrary file upload vulnerability in MaraCMS versions 7.5 and below in order to execute arbitrary commands. The module first attempts to authenticate to MaraCMS. It then tries to upload a malicious PHP file to the web root via an HTTP POST request to codebase/handler.php. If the php target is selected, the payload is embedded in the uploaded file and the module attempts to execute the payload via an HTTP GET request to this file. For the linux and windows targets, the module uploads a simple PHP web shell. Subsequently, it leverages the CmdStager mixin to deliver the final payload via a series of HTTP GET requests to the PHP web shell. Valid credentials for a MaraCMS admin or manager account are required. This module has been successfully tested against MaraCMS 7.5 running on Windows Server 2012 (XAMPP server).

tags | exploit, web, arbitrary, shell, root, php, file upload
systems | linux, windows
advisories | CVE-2020-25042
MD5 | f3fcdcf0924156e882b29740d16480f8
Seat Reservation System 1.0 Shell Upload
Posted Sep 21, 2020
Authored by Rahul Ramkumar

Seat Reservation System version 1.0 suffers from an unauthenticated file upload vulnerability that allows for remote code execution.

tags | exploit, remote, code execution, file upload
advisories | CVE-2020-25763
MD5 | f3302d01404a38c2cf0a759d35184237
Hyland OnBase Arbitrary File Upload
Posted Sep 11, 2020
Authored by Adaptive Security Consulting

All versions up to and prior to Hyland OnBase Foundation EP1 (tested: 19.8.9.1000) and OnBase 18 (tested: 18.0.0.32) suffer from an arbitrary file upload vulnerability.

tags | advisory, arbitrary, file upload
MD5 | c009d2120232537634c05881dd75c693
Joomla GMapFP J3.5 / J3.5F Arbitrary File Upload
Posted Sep 7, 2020
Authored by thelastvvv

Joomla GMapFP component versions J3.5 and J3.5F suffer from an unauthenticated arbitrary file upload vulnerability.

tags | exploit, arbitrary, file upload
advisories | CVE-2020-23972
MD5 | 9c9258b91b93df640a00425477cf2e15
flatCore CMS 1.5.5 Cross Site Scripting / Arbitrary File Upload
Posted Aug 8, 2020
Authored by Farhan Rahman, Azrul Ikhwan Zulkifli | Site sec-consult.com

flatCore CMS versions 1.5.5 and below suffer from cross site scripting and arbitrary file upload vulnerabilities.

tags | exploit, arbitrary, vulnerability, xss, file upload
MD5 | b4c0b5682efb708e59bbe189e31c8dc7
Online Shopping Alphaware 1.0 Arbitrary File Upload
Posted Aug 6, 2020
Authored by Edo Maland

Online Shopping Alphaware version 1.0 suffers from an arbitrary file upload vulnerability.

tags | exploit, arbitrary, file upload
MD5 | ac99c740e91732de1ca528611dc05ba5
October CMS Build 465 XSS / File Read / File Deletion / CSV Injection
Posted Aug 3, 2020
Authored by Sivanesh Ashok

October CMS builds 465 and below suffer from arbitrary file read, arbitrary file deletion, file uploading to arbitrary locations, persistent and reflective cross site scripting, and CSV injection vulnerabilities.

tags | exploit, arbitrary, vulnerability, xss, file upload
advisories | CVE-2020-11083, CVE-2020-5295, CVE-2020-5296, CVE-2020-5297, CVE-2020-5298, CVE-2020-5299
MD5 | a79e40ac7fff8141301027b2d8a73d91
Baldr Botnet Panel Shell Upload
Posted Jul 29, 2020
Authored by Ege Balci | Site metasploit.com

This Metasploit module exploits a arbitrary file upload vulnerability within the Baldr stealer malware control panel. Attackers can turn this vulnerability into remote code execution by adding malicious PHP code inside the victim logs ZIP file and registering a new bot to the panel by uploading the ZIP file under the logs directory. On versions 3.0 and 3.1 victim logs are ciphered by a random 4 byte XOR key. This exploit module retrieves the IP specific XOR key from panel gate and registers a new victim to the panel with adding the selected payload inside the victim logs.

tags | exploit, remote, arbitrary, php, code execution, file upload
MD5 | 3aee05fb3bfa3e3eb0452ce7bbf7bdfb
Socket.io-file 2.0.31 Arbitrary File Upload
Posted Jul 27, 2020
Authored by Cr0wTom

Socket.io-file versions 2.0.31 and below suffer from an arbitrary file upload vulnerability.

tags | exploit, arbitrary, file upload
MD5 | 036513b2828cb0405115bfde1a5912ee
LibreHealth 2.0.0 Remote Code Execution
Posted Jul 20, 2020
Authored by Bobby Cooke

LibreHealth version 2.0.0 authentication remote code execution exploit that leverages file upload.

tags | exploit, remote, code execution, file upload
MD5 | fdb429c0607ceadf1536570f0e8ac8d9
WonderCMS 3.1.0 XSS / Directory Traversal / File Upload
Posted Jul 17, 2020
Authored by Calvin Phang | Site sec-consult.com

WonderCMS versions 3.1.0 and below suffer from directory traversal, persistent cross site scripting, and file upload vulnerabilities.

tags | advisory, vulnerability, xss, file upload
MD5 | c87a3407d183c31bf41f5245e885cf76
Webtareas 2.1 / 2.1p File Upload / Information Disclosure
Posted Jul 9, 2020
Authored by AppleBois

Webtareas versions 2.1 and 2.1p suffer from unauthenticated file uploads that allow for remote code execution and expose directory listings.

tags | exploit, remote, code execution, info disclosure, file upload
MD5 | 411b5ebef9a23a0632621a466851bcb3
ATutor 2.2.4 Directory Traversal / Remote Code Execution
Posted Jun 30, 2020
Authored by liquidsky, Erik Wynter | Site metasploit.com

This Metasploit module exploits an arbitrary file upload vulnerability together with a directory traversal flaw in ATutor versions 2.2.4, 2.2.2 and 2.2.1 in order to execute arbitrary commands.

tags | exploit, arbitrary, file upload
advisories | CVE-2019-12169
MD5 | 09ec42ff94266d8b91d8385b7c530d7b
Online Student Enrollment System 1.0 Arbitrary File Upload
Posted Jun 22, 2020
Authored by BKpatron

Online Student Enrollment System version 1.0 suffers from an unauthenticated arbitrary file vulnerability.

tags | exploit, arbitrary, file upload
MD5 | 82d4e855a4f70039fa7c52673309699c
SmarterMail 16 Arbitrary File Upload
Posted Jun 13, 2020
Authored by vvhack.org

SmarterMail 16 suffers from an arbitrary file upload vulnerability.

tags | exploit, arbitrary, file upload
MD5 | 72450c5aaab572c56de94f8bfdb91744
Exploiting Unrestricted File Upload Via Plugin Uploader In WordPress
Posted Jun 9, 2020
Authored by Isha Gupta

Whitepaper called Exploiting Unrestricted File Upload via Plugin Uploader in WordPress.

tags | paper, file upload
MD5 | 82ef663315bfdc3aa371270f39bd15b1
WordPress Drag And Drop Multi File Uploader Remote Code Execution
Posted Jun 4, 2020
Authored by h00die, Austin Martin | Site metasploit.com

This Metasploit module exploits a file upload feature of Drag and Drop Multi File Upload - Contact Form 7 for versions prior to 1.3.4. The allowed file extension list can be bypassed by appending a %, allowing for php shells to be uploaded. No authentication is required for exploitation.

tags | exploit, shell, php, file upload
advisories | CVE-2020-12800
MD5 | 8741d1320b67d5240a0da5c63f0f5065
WordPress Drag And Drop File Upload Contact Form 1.3.3.2 Shell Upload
Posted May 27, 2020
Authored by Austin Martin

WordPress Drag and Drop File Upload Contact Form plugin version 1.3.3.2 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell, file upload
MD5 | 415c8b9b89531c519f109fc5a2a6d49f
qdPM 9.1 Arbitrary File Upload
Posted May 12, 2020
Authored by Besim Altinok, Ismail Bozkurt

qdPM version 9.1 suffers from an arbitrary file upload vulnerability.

tags | exploit, arbitrary, file upload
MD5 | c0684c8ac1441ffc8176dc2bad26f3b4
CuteNews 2.1.2 Authenticated Shell Upload
Posted May 12, 2020
Authored by Vigov5

CuteNews version 2.1.2 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell, file upload
MD5 | 854221f3da517dea5c1d414090b7e5df
Kartris 1.6 Arbitrary File Upload
Posted May 9, 2020
Authored by Nhat Ha

Kartris version 1.6 suffers from an arbitrary file upload vulnerability.

tags | exploit, arbitrary, file upload
MD5 | 3fb1d8c04e9f6ea8b0c57bde2a354ab3
Page 1 of 36
Back12345Next

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    18 Files
  • 22
    Oct 22nd
    16 Files
  • 23
    Oct 23rd
    2 Files
  • 24
    Oct 24th
    1 Files
  • 25
    Oct 25th
    1 Files
  • 26
    Oct 26th
    17 Files
  • 27
    Oct 27th
    19 Files
  • 28
    Oct 28th
    29 Files
  • 29
    Oct 29th
    13 Files
  • 30
    Oct 30th
    8 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close