diff --git a/files.csv b/files.csv index eded41140..060a8770a 100755 --- a/files.csv +++ b/files.csv @@ -32352,7 +32352,7 @@ id,file,description,date,author,platform,type,port 35897,platforms/windows/remote/35897.html,"CygniCon CyViewer ActiveX Control 'SaveData()' Insecure Method Vulnerability",2011-06-28,"High-Tech Bridge SA",windows,remote,0 35898,platforms/multiple/remote/35898.php,"Atlassian JIRA <= 3.13.5 File Download Security Bypass Vulnerability",2011-06-28,"Ignacio Garrido",multiple,remote,0 35899,platforms/php/webapps/35899.txt,"Mangallam CMS - SQL Injection Web Vulnerability",2015-01-26,Vulnerability-Lab,php,webapps,0 -35900,platforms/php/webapps/35900.txt,"Barracuda Networks Cloud Series - Filter Bypass Vulnerability",2015-01-26,Vulnerability-Lab,php,webapps,0 +35900,platforms/cgi/webapps/35900.txt,"Barracuda Networks Cloud Series - Filter Bypass Vulnerability",2015-01-26,Vulnerability-Lab,cgi,webapps,0 35901,platforms/windows/local/35901.txt,"VLC Player 2.1.5 - DEP Access Violation Vulnerability",2015-01-26,"Veysel HATAS",windows,local,0 35902,platforms/windows/local/35902.txt,"VLC Player 2.1.5 - Write Access Violation Vulnerability",2015-01-26,"Veysel HATAS",windows,local,0 35904,platforms/jsp/webapps/35904.txt,"ManageEngine ServiceDesk Plus 9.0 (< Build 9031) - User Privileges Management Vulnerability",2015-01-26,"Rewterz - Research Group",jsp,webapps,0 @@ -32499,3 +32499,4 @@ id,file,description,date,author,platform,type,port 36056,platforms/windows/remote/36056.rb,"Achat v0.150 beta7 Buffer Overflow",2015-02-11,metasploit,windows,remote,9256 36057,platforms/cgi/webapps/36057.txt,"IBM Endpoint Manager - Stored XSS Vulnerability",2015-02-11,"RedTeam Pentesting",cgi,webapps,52311 36058,platforms/php/webapps/36058.txt,"Wordpress Video Gallery 2.7.0 - SQL Injection Vulnerability",2015-02-12,"Claudio Viviani",php,webapps,0 +36059,platforms/php/webapps/36059.txt,"Exponent CMS 2.3.1 - Multiple XSS Vulnerabilities",2015-02-12,"Mayuresh Dani",php,webapps,80 diff --git a/platforms/php/webapps/35900.txt b/platforms/php/webapps/35900.txt deleted file mode 100755 index c956599ad..000000000 --- a/platforms/php/webapps/35900.txt +++ /dev/null @@ -1,143 +0,0 @@ -Document Title: -=============== -Barracuda Networks Cloud Series - Filter Bypass Vulnerability - - -References (Source): -==================== -http://www.vulnerability-lab.com/get_content.php?id=754 - -Barracuda Networks Security ID (BNSEC): 731 - - -Release Date: -============= -2015-01-19 - - -Vulnerability Laboratory ID (VL-ID): -==================================== -754 - - -Common Vulnerability Scoring System: -==================================== -4.5 - - -Abstract Advisory Information: -============================== -The Vulnerability Laboratory Research Team discovered a filter bypass vulnerability in the official Barracuda Cloud Series Products. - - -Vulnerability Disclosure Timeline: -================================== -2015-01-19: Public Disclosure (Vulnerability Laboratory) - - -Discovery Status: -================= -Published - - -Affected Product(s): -==================== -Barracuda Networks -Product: Cloud Control Center 2014 Q2 - - -Exploitation Technique: -======================= -Remote - - -Severity Level: -=============== -Medium - - -Technical Details & Description: -================================ -A filter bypass vulnerability has been discovered in the official Barracuda Networks Cloud Series Appliance Applications 2014-Q1. -The filter bypass issue allows an attacker to bypass the secure filter validation of the service to execute malicious script codes. - -The barracuda filter blocks for example standard iframes, scripts and other invalid code context: The cloud service has a own exception-handling -to parse or encode malicious injected web context. The mechanism filters the first request and sanitizes the output in every input field. - -During a pentest we injected a standard iframe to check and provoke the validation. The frame got blocked! In the next step the attacker splits (%20%20%20) -the request and injects at the end an onload frame to an external malicious source. The second iframe with the onload alert executes the script codes after -the validation encoded only the first script code tag. The second script code tag can bypass the applicance filter mechanism and executes in the web context -of affected modules. The secure validation does not recognize a splitted request which results in client-side and application-side script code execution in -the cloud series products. - -The security risk of the filter bypass vulnerability is estimated as medium and the cvss (common vulnerability scoring system) count is 4.5 (medium). -Exploitation of the filter bypass vulnerability requires a low privileged application user account with restricted access and low user interaction. -Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects and persistent manipulation -of affected or connected module context. - -Vulnerable Request Method(s): - [+] POST & GET - - -Proof of Concept (PoC): -======================= -The filter bypass web vulnerability can be exploited by local privileged user accounts and remote attackers with low or medium user interaction. -For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. - -PoC: -