01664c67b8
11 new exploits JITed egg-hunter stage-0 shellcode Adjusted universal for xp/vista/win7 JITed egg-hunter stage-0 shellcode Adjusted universal for XP/Vista/Windows 7 BlazeDVD 5.1- (.plf) Stack Buffer Overflow PoC Exploit - ALSR/DEP Bypass on Win7 BlazeDVD 5.1 - (.plf) Stack Buffer Overflow PoC Exploit (Windows 7 ALSR/DEP Bypass) Winamp 5.572 - Local BoF Exploit (Win7 ASLR and DEP Bypass) Winamp 5.572 - Local BoF Exploit (Windows 7 ASLR and DEP Bypass) RM Downloader 3.1.3 - Local SEH Exploit (Win7 ASLR and DEP Bypass) RM Downloader 3.1.3 - Local SEH Exploit (Windows 7 ASLR and DEP Bypass) UFO: Alien Invasion 2.2.1 - BoF Exploit (Win7 ASLR and DEP Bypass) UFO: Alien Invasion 2.2.1 - BoF Exploit (Windows 7 ASLR and DEP Bypass) The KMPlayer 3.0.0.1440 - (.mp3) Buffer Overflow Exploit (Win7 + ASLR Bypass) The KMPlayer 3.0.0.1440 - (.mp3) Buffer Overflow Exploit (Windows 7 + ASLR Bypass) Mozilla Firefox 3.6.16 mChannel Object Use After Free Exploit (Win7) Mozilla Firefox 3.6.16 - mChannel Object Use After Free Exploit (Windows 7) QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS QQPLAYER Player 3.2 - PICT PnSize Buffer Overflow Windows DEP_ASLR BYPASS GNU Bash - Environment Variable Command Injection (ShellShock) Bash - Environment Variables Code Injection Exploit (ShellShock) GNU Bash - Environment Variable Command Injection (Shellshock) Bash - Environment Variables Code Injection Exploit (Shellshock) OpenVPN 2.2.29 - ShellShock Exploit OpenVPN 2.2.29 - Shellshock Exploit Bash - CGI RCE Shellshock Exploit (Metasploit) Bash CGI - RCE Shellshock Exploit (Metasploit) PHP 5.x (< 5.6.2) - Shellshock Exploit (Bypass disable_functions) PHP 5.x (< 5.6.2) - Bypass disable_functions (Shellshock Exploit) OSSEC 2.8 - Privilege Escalation OSSEC 2.8 - hosts.deny Privilege Escalation ShellShock dhclient Bash Environment Variable Command Injection PoC dhclient 4.1 - Bash Environment Variable Command Injection PoC (Shellshock) OSSEC 2.7 <= 2.8.1 - Local Root Escalation OSSEC 2.7 <= 2.8.1 - _diff_ Command Local Root Escalation Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) #2 Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2) BigTree CMS Cross Site Request Forgery Vulnerability Advantech Switch Bash Environment Variable Code Injection (Shellshock) Advantech Switch - Bash Environment Variable Code Injection (Shellshock) KiTTY Portable <= 0.65.0.2p Local kitty.ini Overflow (Wow64 Egghunter Win7) KiTTY Portable <= 0.65.0.2p Local kitty.ini Overflow (Win8.1/Win10) KiTTY Portable <= 0.65.0.2p - Local kitty.ini Overflow (Wow64 Egghunter Windows 7) KiTTY Portable <= 0.65.0.2p - Local kitty.ini Overflow (Windows 8.1/Windows 10) Windows Null-Free Shellcode - Primitive Keylogger to File - 431 (0x01AF) bytes Ajaxel CMS 8.0 - Multiple Vulnerabilities i.FTP 2.21 - Host Address / URL Field SEH Exploit Dell SonicWall Scrutinizer <= 11.0.1 - setUserSkin/deleteTab SQL Injection Remote Code Execution ZeewaysCMS - Multiple Vulnerabilities ASUS Memory Mapping Driver (ASMMAP/ASMMAP64): Physical Memory Read/Write Certec EDV atvise SCADA Server 2.5.9 - Privilege Escalation Microsoft Windows 7 - WebDAV Privilege Escalation Exploit (MS16-016) (2) RPCScan 2.03 - Hostname/IP Field SEH Overwrite PoC ImageMagick Delegate Arbitrary Command Execution Ruby on Rails Development Web Console (v2) Code Execution
94 lines
No EOL
2.5 KiB
Text
Executable file
94 lines
No EOL
2.5 KiB
Text
Executable file
ZeewaysCMS Multiple Vulnerabilities
|
|
|
|
|
|
[Software]
|
|
|
|
- ZeewaysCMS
|
|
|
|
|
|
[Vendor Product Description]
|
|
|
|
- ZeewaysCMS is a Content Management System and a complete Web & Mobile Solution developed by Zeeways for Corporates,
|
|
Individuals or any kind of Business needs.
|
|
|
|
|
|
- Site: http://www.zeewayscms.com/
|
|
|
|
|
|
[Advisory Timeline]
|
|
|
|
[25.03.2016] Vulnerability discovered.
|
|
[25.03.2016] Vendor contacted.
|
|
[29.03.2016] Follow up with the vendor.
|
|
[29.03.2016] Vendor responded asking for details.
|
|
[29.03.2016] Advisory and details sent to the vendor.
|
|
[06.04.2016] Follow up with the vendor. No response received.
|
|
[06.05.2016] Public security advisory released.
|
|
|
|
|
|
[Bug Summary]
|
|
|
|
- Directory Traversal
|
|
|
|
- Cross Site Scripting (Stored)
|
|
|
|
|
|
[Impact]
|
|
|
|
- High
|
|
|
|
|
|
[Affected Version]
|
|
|
|
- Unknown
|
|
|
|
|
|
[Tested on]
|
|
|
|
- Apache/2.2.27
|
|
- PHP/5.4.28
|
|
|
|
|
|
[Advisory]
|
|
|
|
- ID: ZSL-2016-5319
|
|
- URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5319.php
|
|
|
|
|
|
[Bug Description and Proof of Concept]
|
|
|
|
- ZeewaysCMS suffers from a file inclusion vulnerability (LFI) when encoded input passed thru the 'targeturl' GET
|
|
parameter is not properly verified before being used to include files. This can be exploited to include files from
|
|
local resources with directory traversal attacks and URL encoded NULL bytes.
|
|
https://en.wikipedia.org/wiki/Directory_traversal_attack
|
|
|
|
- Multiple cross-site scripting vulnerabilities were also discovered. The issue is triggered when input passed
|
|
via multiple parameters is not properly sanitized before being returned to the user. This can be exploited to
|
|
execute arbitrary HTML and script code in a user's browser session in context of an affected site.
|
|
https://en.wikipedia.org/wiki/Cross-site_scripting
|
|
|
|
|
|
[Proof-of-Concept]
|
|
|
|
1. Directory Traversal:
|
|
|
|
http://localhost/demo//createPDF.php?targeturl=Ly4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uL2V0Yy9wYXNzd2Q=&&pay_id=4&&type=actual
|
|
Parameters: targeturl (GET)
|
|
|
|
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
|
2. Cross Site Scripting (Stored)
|
|
|
|
http://localhost/demo/profile
|
|
Parameters: screen_name, f_name, l_name, uc_email, uc_mobile, user_contact_num (POST)
|
|
|
|
Payload(s):
|
|
Content-Disposition: form-data; name="screen_name"
|
|
|
|
"><script><<imgIMG SRC=oi onerror=JaVaScript:alert(1)>
|
|
|
|
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
|
All flaws described here were discovered and researched by:
|
|
|
|
Bikramaditya Guha aka "PhoenixX" |