Exploits

Microsoft Windows – DSSVC CheckFilePermission Arbitrary File Deletion

Windows: DSSVC CheckFilePermission Arbitrary File Delete EoP

polkit – Temporary auth Hijacking via PID Reuse and Non-atomic Fork

When a (non-root) user attempts to e.g. control systemd units in the system

BlogEngine 3.3 – XML External Entity Injection

XML External Entity Injection Vulnerability in BlogEngine 3.3

CF Image Hosting Script 1.6.5 – (Delete all Pictures) Privilege Escalation

#!/usr/bin/env python

Dolibarr ERP-CRM 8.0.4 – ‘rowid’ SQL Injection

# Title: Dolibarr ERP-CRM 8.0.4 - 'rowid' SQL Injection

Wireshark – ‘get_t61_string’ Heap Out-of-Bounds Read

The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of Wireshark, by f...

Mailcleaner – (Authenticated) Remote Code Execution (Metasploit)

##

Embed Video Scripts – Persistent Cross-Site Scripting

# Exploit Title: Embed Video Scripts - Cross-site Script (stored)

All in One Video Downloader 1.2 – (Authenticated) SQL Injection

# Exploit Title: All in One Video Downloader 1.2 - SQL Injection

Microsoft Edge 44.17763.1.0 – NULL Pointer Dereference

LayerBB 1.1.1 – Persistent Cross-Site Scripting

# Exploit Title: LayerBB 1.1.1 - Cross-Site Scripting

MyBB OUGC Awards Plugin 1.8.3 – Persistent Cross-Site Scripting

# Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting

PLC Wireless Router GPN2.4P21-C-CN – Cross-Site Scripting

# Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Reflected XSS

phpMoAdmin MongoDB GUI 1.1.5 – Cross-Site Request Forgery / Cross-Site Scripting

#####################################################################################################################...

WordPress Plugin UserPro < 4.9.21 - User Registration Privilege Escalation

# Exploit Title: Wordpress Plugin UserPro < 4.9.21 User Registration With Administrator Role

MyT Project Management 1.5.1 – ‘Charge[group_total]’ SQL Injection

# Exploit Title: MyT-PM 1.5.1 - 'Charge[group_total]' SQL Injection

Roxy Fileman 1.4.5 – Unrestricted File Upload / Directory Traversal

======================================================================

Ajera Timesheets 9.10.16 – Deserialization of Untrusted Data

# Exploit Title: Ajera Timesheets

BlueAuditor 1.7.2.0 – ‘Key’ Denial of Service (PoC)

# Exploit Title: BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC)

SpotFTP Password Recover 2.4.2 – ‘Name’ Denial of Service (PoC)

# Exploit Title: SpotFTP Password Recover 2.4.2 - 'Name' Denial of Service (PoC)

Foscam Video Management System 1.1.4.9 – ‘Username’ Denial of Service (PoC)

# Exploit Title: Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC)

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 – Cross-Site Request Forgery

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 – JS/HTML Code Injection

Huawei E5330 21.210.09.00.158 – Cross-Site Request Forgery (Send SMS)

# Exploit Title: Huawei E5330 Cross-Site Request Forgery (Send SMS)

KioWare Server Version 4.9.6 – Weak Folder Permissions Privilege Escalation

# Exploit Title : KioWare Server Version 4.9.6 - Weak Folder Permissions Privilege Escalation

Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method)

#!/bin/sh

Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method)

#!/bin/sh

NBMonitor Network Bandwidth Monitor 1.6.5.0 – ‘Name’ Denial of Service (PoC)

# Exploit Title: NBMonitor Network Bandwidth Monitor 1.6.5.0 - 'Name' Denial of Service (PoC)

Vtiger CRM 7.1.0 – Remote Code Execution

# Exploit Title: Vtiger CRM 7.1.0 - Remote Code Execution

WordPress Plugin Adicon Server 1.2 – ‘selectedPlace’ SQL Injection

# Exploit Title: WordPress Plugin Adicon Server 1.2 - 'selectedPlace' SQL Injection

Frog CMS 0.9.5 – Cross-Site Scripting

# Exploit Title: Frog CMS 0.9.5 - Cross-Site Scripting

EZ CD Audio Converter 8.0.7 – Denial of Service (PoC)

# Exploit Title: EZ CD Audio Converter 8.0.7 - Denial of Service (PoC)

NetworkSleuth 3.0.0.0 – ‘Key’ Denial of Service (PoC)

# Exploit Title: NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)

Ayukov NFTP FTP Client 2.0 – Buffer Overflow

# Exploit Title: Ayukov NFTP FTP Client 2.0 - Buffer Overflow

WebKit JSC – ‘AbstractValue::set’ Use-After-Free

// ./jsc --useConcurrentJIT=false ~/test.js

WebKit JSC – ‘JSArray::shiftCountWithArrayStorage’ Out-of-Bounds Read/Write

bool JSArray::shiftCountWithArrayStorage(VM& vm, unsigned startIndex, unsigned count, ArrayStorage* storage)

Hashicorp Consul – Remote Command Execution via Rexec (Metasploit)

##

Hashicorp Consul – Remote Command Execution via Services API (Metasploit)

##

Microsoft Windows – Windows Error Reporting Local Privilege Escalation

Make sure to copy the file report.wer found in the folder PoC-Files in the same folder as the executable before runni...

VMware Workstation/Player < 12.5.5 - Local Privilege Escalation

#!/bin/bash

Deepin Linux 15 – ‘lastore-daemon’ Local Privilege Escalation

#!/bin/bash

Linux Kernel 4.8.0-34 < 4.8.0-45 (Ubuntu / Linux Mint) - Packet Socket Local Privilege Escalation

// A proof-of-concept local root exploit for CVE-2017-7308.

Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP)

// A proof-of-concept local root exploit for CVE-2017-1000112.

Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Escalation

chocobo_root.c

Craft CMS 3.0.25 – Cross-Site Scripting

# Exploit Title: Craft CMS 3.0.25 - Cross-Site Scripting

WordPress Plugin Audio Record 1.0 – Arbitrary File Upload

# Exploit Title: WordPress Plugin Audio Record 1.0 - Arbitrary File Upload

MAGIX Music Editor 3.1 – Buffer Overflow (SEH)

# Exploit Title: MAGIX Music Editor 3.1 - Buffer Overflow (SEH)

Product Key Explorer 4.0.9 – Denial of Service (PoC)

# Exploit Title: Product Key Explorer 4.0.9 - Denial of Service (PoC)

Terminal Services Manager 3.1 – Local Buffer Overflow (SEH)

# Exploit Title: Terminal Services Manager 3.1 - Buffer Overflow (SEH)

Iperius Backup 5.8.1 – Buffer Overflow (SEH)

# Exploit Title: Iperius Backup 5.8.1 - Buffer Overflow (SEH)