Menu

Search for hundreds of thousands of exploits

"Ajaxmint Gallery 1.0 - Local File Inclusion"

Author

Exploit author

AkaStep

Platform

Exploit platform

php

Release date

Exploit published date

2012-05-23

Download file

1
2
3
4
5
6
7
8
9
source: https://www.securityfocus.com/bid/53659/info

Ajaxmint Gallery is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and to execute local scripts in the context of the webserver process. This may aid in further attacks.

Ajaxmint Gallery 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/ajaxmint/ajaxmint-gallery/admin/index.php?c=..\..\..\..\ajaxmint-gallery/pictures/5_me.jpg%00 [aka shell]
Release Date Title Type Platform Author
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2013-04-03 "SmallFTPd - Denial of Service" dos windows AkaStep
2013-03-15 "ClipShare 4.1.4 - Multiple Vulnerabilities" webapps php AkaStep
2013-02-20 "CKEditor 4.0.1 - Multiple Vulnerabilities" webapps php AkaStep
2013-02-19 "CKEditor - 'posteddata.php' Cross-Site Scripting" webapps php AkaStep
2013-02-05 "Glossword 1.8.3 - SQL Injection" webapps php AkaStep
2013-02-05 "glossword 1.8.12 - Multiple Vulnerabilities" webapps php AkaStep
2013-01-28 "PHP weby directory software 1.2 - Multiple Vulnerabilities" webapps php AkaStep
2013-01-25 "PHPWeby Free Directory Script - 'contact.php' Multiple SQL Injections" webapps php AkaStep
2013-01-18 "PHP-Charts - Arbitrary PHP Code Execution" webapps php AkaStep
2013-01-08 "MotoCMS - admin/data/users.xml Access Restriction Weakness Information Disclosure" webapps php AkaStep
2013-01-02 "osTicket - 'l.php?url' Arbitrary Site Redirect" webapps php AkaStep
2013-01-02 "osTicket - 'tickets.php?status' Cross-Site Scripting" webapps php AkaStep
2012-12-04 "Sourcefabric Newscoop - 'f_email' SQL Injection" webapps php AkaStep
2012-11-23 "Greenstone - Multiple Vulnerabilities" remote multiple AkaStep
2012-09-22 "WordPress 3.4.2 - Cross-Site Request Forgery" webapps php AkaStep
2012-09-18 "WordPress 3.4.2 - Multiple Path Disclosure Vulnerabilities" webapps php AkaStep
2012-09-04 "Sciretech (Multiple Products) - Multiple SQL Injections" webapps php AkaStep
2012-09-03 "Sitemax Maestro - SQL Injection / Local File Inclusion" webapps php AkaStep
2012-06-22 "Cotonti - 'admin.php' SQL Injection" webapps php AkaStep
2012-06-21 "traq 2.3.5 - Multiple Vulnerabilities" webapps php AkaStep
2012-05-27 "AzDGDatingMedium 1.9.3 - Multiple Remote Vulnerabilities" webapps php AkaStep
2012-05-23 "Ajaxmint Gallery 1.0 - Local File Inclusion" webapps php AkaStep
2012-05-23 "Ruubikcms 1.1.x - Cross-Site Scripting / Information Disclosure / Directory Traversal" webapps php AkaStep
2012-05-20 "Concrete5 FlashUploader - Arbitrary '.SWF' File Upload" webapps php AkaStep
2012-05-20 "Concrete CMS < 5.5.21 - Multiple Vulnerabilities" webapps php AkaStep
2012-05-10 "Chevereto 1.91 - '/Upload/engine.php?v' Traversal Arbitrary File Enumeration" webapps php AkaStep
2012-05-10 "Chevereto 1.91 - '/Upload/engine.php?v' Cross-Site Scripting" webapps php AkaStep
2012-04-27 "MySQLDumper 1.24.4 - 'sql.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php AkaStep
2012-04-27 "MySQLDumper 1.24.4 - 'install.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php AkaStep
2012-04-27 "MySQLDumper 1.24.4 - 'install.php?language' Traversal Arbitrary File Access" webapps perl AkaStep 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected