Archive for February, 2012

webgrind 1.0 (file param) Local File Inclusion Vulnerability

webgrind suffers from a file inlcusion vulnerability (LFI) when input passed thru the ‘file’ parameter to index.php is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes.


---------------------------
/index.php:
-----------
122: case 'fileviewer':
123: $file = get('file');
124: $line = get('line');
---------------------------

Advisory details: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5075.php

Thanks to Michael Meyer, OpenVAS Project.

SQLBuddy And webgrind Multiple XSS Vulnerabilities

webgrind suffers from a XSS vulnerability when parsing user input to the ‘dataFile’ parameter via GET method in the index.php script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user’s browser session.

Advisory details: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5073.php
PoC: http://www.zeroscience.mk/codes/webgrind_xss.txt

SQL Buddy suffers from a XSS vulnerability when parsing user input to the ‘DATABASE’, ‘HOST’ and ‘USER’ parameters via POST method in ‘login.php’, and the ‘db’ parameter in ‘dboverview.php’ via GET method. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session.

Advisory details: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5074.php
PoC: http://www.zeroscience.mk/codes/sqlbuddy_xss.txt

WampServer <= 2.2c (lang) Remote Cross-Site Scripting Vulnerability

WampServer is vulnerable to cross-site scripting vulnerability. This issue is due to the application’s failure to properly sanitize user-supplied input thru the ‘lang’ parameter (GET) in index.php script. An attacker may leverage any of the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials, phishing as well as other attacks.

Advisory ID: ZSL-2012-5072
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5072.php

Related Advisory ID: ZSL-2010-4926
Related Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4926.php

CVE-2010-0700: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0700
CWE-79: http://cwe.mitre.org/data/definitions/79.html

SciTools Understand 2.6 (wintab32.dll) DLL Loading Arbitrary Code Execution

The vulnerability is caused due to the application loading libraries (wintab32.dll) in an insecure manner. This can be exploited to load arbitrary libraries by tricking a user into opening an Understand Project file (.UDB) located on a remote WebDAV or SMB share.

Vendor releases patch for this issue: http://scitools.com/download/latest/Understand/Understand-2.6.600-Windows-32bit.exe

Advisory details: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5071.php

ManageEngine ADManager Plus 5.2 Multiple XSS Vulnerabilities

ADManager Plus suffers from multiple XSS vulnerabilities when parsing user input to the ‘domainName’ parameter in the ‘/jsp/AddDC.jsp’ script via GET method and ‘operation’ parameter in the ‘/DomainConfig.do’ script via POST method. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session.

PoC(s):

#1

– GET http://localhost:8080/jsp/AddDC.jsp?domainName=”><script>alert(‘zsl’)</script> HTTP/1.1

#2

– POST http://localhost:8080/DomainConfig.do?methodToCall=save HTTP/1.1

– DOMAIN_NAME=test&DOMAIN_CONTROLLER_NAME=testsrv&save=Add&operation=”><script>alert(‘zsl’)</script>&reset=

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5070.php