Menu

Search for hundreds of thousands of exploits

"RubyGems fastreader - 'entry_controller.rb' Remote Command Execution"

Author

Exploit author

"Larry W. Cashdollar"

Platform

Exploit platform

multiple

Release date

Exploit published date

2013-03-12

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
source: https://www.securityfocus.com/bid/58450/info

fastreader is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.

fastreader 1.0.8 is affected; other versions may also be vulnerable. 

The following example URI is available:

http://www.g;id;.com
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Expense Management System - 'description' Stored Cross Site Scripting" webapps multiple "Nikhil Kumar"
2020-12-02 "Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting" webapps multiple "Parshwa Bhavsar"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Under Construction Page with CPanel 1.0 - SQL injection" webapps multiple "Mayur Parmar"
Release Date Title Type Platform Author
2019-01-16 "Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit" webapps php "Larry W. Cashdollar"
2018-10-11 "jQuery-File-Upload 9.22.0 - Arbitrary File Upload" webapps php "Larry W. Cashdollar"
2018-09-18 "WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting" webapps php "Larry W. Cashdollar"
2018-04-23 "Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure" webapps php "Larry W. Cashdollar"
2017-08-31 "Joomla! Component Huge-IT Video Gallery 1.0.9 - SQL Injection" webapps php "Larry W. Cashdollar"
2017-08-31 "Joomla! Component Huge-IT Portfolio Gallery Plugin 1.0.7 - SQL Injection" webapps php "Larry W. Cashdollar"
2017-08-31 "Joomla! Component Huge-IT Portfolio Gallery Plugin 1.0.6 - SQL Injection" webapps php "Larry W. Cashdollar"
2016-09-22 "Joomla! Component com_videogallerylite 1.0.9 - SQL Injection" webapps php "Larry W. Cashdollar"
2016-09-16 "Joomla! Component Portfolio Gallery 1.0.6 - SQL Injection" webapps php "Larry W. Cashdollar"
2016-09-16 "Joomla! Component Catalog 1.0.7 - SQL Injection" webapps php "Larry W. Cashdollar"
2015-12-30 "DeleGate 9.9.13 - Local Privilege Escalation" local linux "Larry W. Cashdollar"
2015-08-10 "WordPress Plugin Candidate Application Form 1.0 - Arbitrary File Download" webapps php "Larry W. Cashdollar"
2015-08-10 "WordPress Plugin Simple Image Manipulator 1.0 - Arbitrary File Download" webapps php "Larry W. Cashdollar"
2015-08-10 "WordPress Plugin Recent Backups 0.7 - Arbitrary File Download" webapps php "Larry W. Cashdollar"
2015-08-10 "WordPress Plugin WPTF Image Gallery 1.03 - Arbitrary File Download" webapps php "Larry W. Cashdollar"
2015-07-13 "WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download" webapps php "Larry W. Cashdollar"
2015-07-08 "WordPress Plugin Easy2Map 1.24 - SQL Injection" webapps php "Larry W. Cashdollar"
2015-07-08 "WordPress Plugin WP E-Commerce Shop Styling 2.5 - Arbitrary File Download" webapps php "Larry W. Cashdollar"
2015-06-12 "WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal" webapps php "Larry W. Cashdollar"
2015-06-12 "WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload" webapps php "Larry W. Cashdollar"
2015-04-02 "WordPress Plugin VideoWhisper Video Conference Integration 4.91.8 - Arbitrary File Upload" webapps php "Larry W. Cashdollar"
2015-04-02 "WordPress Plugin VideoWhisper Video Presentation 3.31.17 - Arbitrary File Upload" webapps php "Larry W. Cashdollar"
2014-11-10 "WordPress Plugin / Joomla! Component XCloner - Multiple Vulnerabilities" webapps php "Larry W. Cashdollar"
2013-07-09 "Solaris Recommended Patch Cluster 6/19 (x86) - Local Privilege Escalation" local linux_x86 "Larry W. Cashdollar"
2013-03-12 "RubyGems fastreader - 'entry_controller.rb' Remote Command Execution" remote multiple "Larry W. Cashdollar"
2013-02-05 "Oracle Automated Service Manager 1.3 - Installation Privilege Escalation" local linux "Larry W. Cashdollar"
2012-12-09 "Centrify Deployment Manager 2.1.0.283 - Local Privilege Escalation" local linux "Larry W. Cashdollar"
2010-03-24 "Sun Connection Update Manager for Solaris - Multiple Insecure Temporary File Creation Vulnerabilities" local solaris "Larry W. Cashdollar"
2003-07-01 "InterSystems Cache 4.1.15/5.0.x - Insecure Default Permissions" local linux "Larry W. Cashdollar"
2003-04-23 "SAP Database 7.3/7.4 - SDBINST Race Condition" local linux "Larry W. Cashdollar" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected