Archive for August, 2012

Express Burn Plus v4.58 EBP Project File Handling Buffer Overflow PoC

The vulnerability is caused due to a boundary error in the processing of a project file, which can be exploited to cause a unicode buffer overflow when a user opens e.g. a specially crafted .EBP file. Successful exploitation could allow execution of arbitrary code on the affected machine.

——————————————————————————–
(13d4.a84): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=050a8c70 ebx=004034fc ecx=00000041 edx=fc4d5390 esi=0157cf68 edi=001297fe
eip=004678ef esp=00126420 ebp=001274c0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
*** WARNING: Unable to verify checksum for image00400000
*** ERROR: Module load completed but symbols could not be loaded for image00400000
image00400000+0x678ef:
004678ef 66890c02 mov word ptr [edx+eax],cx ds:0023:0157e000=????
0:000> d eax
050a8c70 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8c80 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8c90 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8ca0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8cb0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8cc0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8cd0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8ce0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0:000> d esi
0157cf68 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cf78 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cf88 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cf98 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cfa8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cfb8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cfc8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cfd8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.

———————————————————————————-

Advisory ID: ZSL-2012-5103
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5103.php

Multiple vulnerabilities in multiple web applications

ZSL-2012-5097SiNG cms 2.9.0 (email) Remote XSS POST Injection Vulnerability
ZSL-2012-5098web@all CMS 2.0 Multiple Remote XSS Vulnerabilities
ZSL-2012-5099web@all CMS 2.0 (_order) SQL Injection Vulnerability
ZSL-2012-5100KindEditor 4.1.2 (name parameter) Reflected XSS Vulnerability
ZSL-2012-5101Monstra 1.2.1 Multiple HTML Injection Vulnerabilities
ZSL-2012-5102xt:Commerce v4.0.15 (products_name_de) Script Insertion Vulnerability

The applications suffer from multiple stored and reflected XSS vulnerabilities including an SQL Injection.

Zoho BugTracker Multiple Stored XSS Vulnerabilities

The Bug Tracking Software suffers from a stored XSS vulnerability when parsing user input to the ‘comment’ and ‘mystatus’ parameters via POST method thru ‘bugdetails.do’ and ‘addmystatus.do’ scripts. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session.

Zoho Bug Tracker

Advisory ID: ZSL-2012-5096
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5096.php

PolarisCMS (blog.aspx) Remote URI Based Cross-Site Scripting Vulnerability

PolarisCMS suffers from a XSS issue when input passed to the function ‘WebForm_OnSubmit()’ via the URL to blog.aspx is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5095.php