Page 5 - Exploit Title News Today

Exploit Title: Webutler v3.2 - Remote Code Execution (RCE)Application: webutler CmsVersion: v3.2Bugs: RCETechnology: PHPVendor URL: https://webutler.de/enSoftware Link: http://webutler.de/download/webutler_v3.2.zipDate of found: 03.08.2023Author: Mirabbas AğalarovTested on: Linux 2. Technical Details & POC========================================steps: 1. login to account as admin2. go to visit media 3.upload phar file4. upload poc.phar filepoc.phar file contents :5. Visit to poc.phar filepo...

# Exploit Title: ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE)# Google Dork: None# Date: July 31, 2023# Exploit Author: Riyan Firmansyah of Seclab# Vendor Homepage: https://ruijienetworks.com# Software Link: https://www.ruijienetworks.com/support/documents/slide_EW1200G-PRO-Firmware-B11P204# Version: ReyeeOS 1.204.1614; EW_3.0(1)B11P204, Release(10161400)# Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO# CVE : None"""Summary=======The Ruijie Reyee Cloud Web Controller a...

# Exploit Title: JLex GuestBook 1.6.4 - Reflected XSS# Exploit Author: CraCkEr# Date: 01/08/2023# Vendor: JLexArt# Vendor Homepage: https://jlexart.com/# Software Link: https://extensions.joomla.org/extension/contacts-and-feedback/guest-book/jlex-guestbook/# Demo: https://jlexguestbook.jlexart.com/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter.com/0x...

# Exploit Title:# Date: 07/2023# Exploit Author: Andrey Stoykov# Version: 3.2# Tested on: Windows Server 2022# Blog: http://msecureltd.blogspot.comXSS #1:File: roles.edit.post.phpLine #57:[...][...]Steps to Reproduce:1. Login to application2. Go to Roles3. Select Title4. Enter payload TEST">// HTTP POST requestPOST /perch/perch/core/users/roles/edit/?id=1 HTTP/1.1Host: 192.168.1.11User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)Gecko/20100101 Firefox/114.0[...]roleTitle=TE...

# Exploit Title: PHPJabbers Bus Reservation System 1.1 - Reflected XSS# Exploit Author: CraCkEr# Date: 20/07/2023# Vendor: PHPJabbers# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/bus-reservation-system/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4111## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant

# Exploit Title: PHPJabbers Availability Booking Calendar 5.0 - Reflected XSS# Exploit Author: CraCkEr# Date: 20/07/2023# Vendor: PHPJabbers# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/availability-booking-calendar/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4110## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter.com/0x0CryptoJob## Descrip...

# Exploit Title: PHPJabbers Service Booking Script 1.0 - Reflected XSS# Exploit Author: CraCkEr# Date: 21/07/2023# Vendor: PHPJabbers# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/service-booking-script/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4113## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionThe attack...

# Exploit Title: Joomla JLex Review 6.0.1 - Reflected XSS# Exploit Author: CraCkEr# Date: 01/08/2023# Vendor: JLexArt# Vendor Homepage: https://jlexart.com/# Software Link: https://extensions.joomla.org/extension/jlex-review/# Demo: https://jlexreview.jlexart.com/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionThe attacke...

# Exploit Title: Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)# Date: 28/07/2023# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security # Vendor Homepage: https://www.uvdesk.com# Software Link: https://github.com/uvdesk/community-skeleton# Version: 1.1.3# Example: python3 CVE-2023-39147.py -u "http://$ip:8000/" -c "whoami"# CVE : CVE-2023-39147# Tested on: Ubuntu 20.04.6import requestsimport argparsedef get_args():parser = argparse.Arg...

# Exploit Title: General Device Manager 2.5.2.2 - Buffer Overflow (SEH)# Date: 30.07.2023# Software Link: https://download.xm030.cn/d/MDAwMDA2NTQ=# Software Link 2:https://www.maxiguvenlik.com/uploads/importfiles/General_DeviceManager.zip# Exploit Author: Ahmet Ümit BAYRAM# Tested Version: 2.5.2.2# Tested on: Windows 10 64bit# 1.- Run python code : exploit.py# 2.- Open pwned.txt and copy all content to clipboard# 3.- Open Device Manage and press Add Device#