A backdoor introduced by attackers allows unauthenticated users remote root access to systems which run the maliciously modified version of the ProFTPD daemon.

The DBA Management Server component of EnterpriseDB Postgres Plus Advanced Server does not restrict access to the underlying JBoss JMX Console. This can be abused by remote, unauthenticated attackers to execute arbitrary code on the vulnerable server. This module uploads an arbitrary .WAR application to the target in order to deploy an agent on it. On Windows targets, the deployed agent will run with SYSTEM privileges.

PoPToP PPTP server before 1.1.4-b3 allows remote attackers to execute code via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.

This module exploits a remote command execution vulnerability in the Zope web application server used by Plone, by sending a specially crafted HTTP request to the affected web site. The vulnerability exists because it is possible to remotely invoke the popen2 function from the Python os package with arbitrary arguments in the context of the affected server. This can be exploited by remote unauthenticated attackers to execute arbitrary code on the target machine.

Insufficient sanitization in PineApp Mail SeCure ldapsyncnow.php lead to remote code execution.

This module exploits the following vulnerability, as described by the CVE database: "The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete." However, this exploit does not use the zend_hash_init technique used by other proof-of-concept codes and research papers, and does therefore not depend on a specific PHP configuration. Notably it does not require register_globals to be turned on (it is off by default) and will work against any Linux machine running Apache (1 or 2) and PHP (from 4.1.0 to 4.3.7). Successful exploitation of this vulnerability is highly dependent on Apache's and PHP's versions, configurations, and memory usage. This module will successively run 5 different phases: the first 4 phases will determine the parameters needed to trigger the memory_limit in an exploitable manner, the 5th and last phase will bruteforce the 3 remaining parameters and finally install an agent.

This module exploits a vulnerability in PHP Charts 1.0. The url.php script evals every single GET key/value pair, leading to code execution.

This module exploits an argument injection vulnerability in PHP up to version 5.3.12 and 5.4.2 when running as a standalone CGI processor and takes advantage of the -d flag to achieve remote code execution.

This module exploits a Remote Code Execution vulnerability in PHPMyAdmin installing an agent. In PHPMyAdmin 3.0.0 RC1 it works with MYSQL 5 and above. In PHPMyAdmin 2.9.11 and below, it works if the databes is before MYSQL 5 This module starts a web server on the Core Impact Console to publish the agent, which is downloaded from the target. It only works for Cookie-Authenticated sites.

This module abuses a vulnerability in phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 that allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.