Author Archive

Multiple vulnerabilities in multiple web applications

ZSL-2012-5097 – SiNG cms 2.9.0 (email) Remote XSS POST Injection Vulnerability
ZSL-2012-5098 – web@all CMS 2.0 Multiple Remote XSS Vulnerabilities
ZSL-2012-5099 – web@all CMS 2.0 (_order) SQL Injection Vulnerability
ZSL-2012-5100 – KindEditor 4.1.2 (name parameter) Reflected XSS Vulnerability
ZSL-2012-5101 – Monstra 1.2.1 Multiple HTML Injection Vulnerabilities
ZSL-2012-5102 – xt:Commerce v4.0.15 (products_name_de) Script Insertion Vulnerability

The applications suffer from multiple stored and reflected XSS vulnerabilities including an SQL Injection.

2012
08/23
POSTED BY
CATEGORY
Internal
Comments Off

Zoho BugTracker Multiple Stored XSS Vulnerabilities

The Bug Tracking Software suffers from a stored XSS vulnerability when parsing user input to the ‘comment’ and ‘mystatus’ parameters via POST method thru ‘bugdetails.do’ and ‘addmystatus.do’ scripts. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session.

Zoho Bug Tracker

Advisory ID: ZSL-2012-5096
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5096.php

2012
08/06
POSTED BY
CATEGORY
Internal
Comments Off

PolarisCMS (blog.aspx) Remote URI Based Cross-Site Scripting Vulnerability

PolarisCMS suffers from a XSS issue when input passed to the function ‘WebForm_OnSubmit()’ via the URL to blog.aspx is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5095.php

2012
08/06
POSTED BY
CATEGORY
Internal
Comments Off

IBM System Storage DS Storage Manager Profiler Multiple Vulnerabilities

IBM System Storage DS Storage Manager Profiler suffers from an SQL Injection and a Cross-Site Scripting (XSS) vulnerability. Input passed via the GET parameter ‘selectedModuleOnly’ in ‘ModuleServlet.do’ script is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The GET parameter ‘updateRegn’ in the ‘SoftwareRegistration.do’ script is vulnerable to a XSS issue where the attacker can execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

ZSL Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5094.php

IBM Advisory: https://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172

2012
06/21
POSTED BY
CATEGORY
Internal
Comments Off

Apple iTunes 10.6.1.7 M3U Playlist File Walking Heap Buffer Overflow

The vulnerability is caused due to a boundary error in the processing of a playlist file, which can be exploited to cause a heap based buffer overflow when a user opens e.g. a specially crafted .M3U file. Successful exploitation could allow execution of arbitrary code on the affected node.

 

Apple: http://support.apple.com/kb/HT5318
ZSL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5093.php

TXT: http://www.zeroscience.mk/codes/itunes_bof.txt

2012
06/12
POSTED BY
CATEGORY
Internal
Comments Off

PyroCMS 2.1.1 CRLF Injection And Stored XSS Vulnerability

PyroCMS suffers from a stored XSS and HTTP Response Splitting vulnerability when parsing user input to the ‘title’ and ‘redirect_to’ parameters via POST method thru ‘index.php’ script. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session or insert arbitrary HTTP headers, which are included in a response sent to the user.

 

 

 

 

Advisory ID: ZSL-2012-5092
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5092.php

 

2012
06/04
POSTED BY
CATEGORY
Internal
Comments Off

Project KoKiNo

http://liquidworm.deviantart.com/art/The-Observers-301017154

http://liquidworm.deviantart.com/art/Shoo6-301016589

2012
05/16
POSTED BY
CATEGORY
Graphics
Comments Off

Artiphp CMS 5.5.0 Database Backup Disclosure Exploit

Artiphp stores database backups using backupDB() utility with a predictable file name inside the web root, which can be exploited to disclose sensitive information by downloading the file. The backup is located in ‘/artzone/artpublic/database/’ directory as ‘db_backup_[type].[yyyy-mm-dd].sql.gz’ filename.

Advisory ID: ZSL-2012-5091
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5091.php

2012
05/16
POSTED BY
CATEGORY
Internal
Comments Off

Artiphp CMS v5.5.0 Multiple XSS POST Injection Vulnerabilities

Artiphp CMS suffers from multiple cross-site scripting vulnerabilities via several parameters thru POST method. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session.

Advisory ID: ZSL-2012-5090
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5090.php

PoC:

POST /artpublic/recommandation/index.php HTTP/1.1
Content-Length: 619
Content-Type: application/x-www-form-urlencoded
Cookie: ARTI=tsouvg67cld88k9ihbqfgk3k77
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

add_img_name_post "onmouseover=prompt(1) joxy
adresse_destinataire
adresse_expediteur lab%40zeroscience.mk
asciiart_post "onmouseover=prompt(2) joxy
expediteur "onmouseover=prompt(3) joxy
message Hello%20World
message1 %ef%bf%bd%20Recommand%20%ef%bf%bd%0a%bb%20http%3a%2f%2flocalhost%2fartpublic%2frecommandation%2f
send Send
titre_sav "onmouseover=prompt(4) joxy
url_sav http%3a%2f%2flocalhost%2fartpublic%2frecommandation%2f
z39d27af885b32758ac0e7d4014a61561 "onmouseover=prompt(5) joxy
zd178e6cdc57b8d6ba3024675f443e920 2

2012
05/16
POSTED BY
CATEGORY
Internal
Comments Off

backupDB() v1.2.7a (onlyDB) Remote XSS Vulnerability

backupDB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the ‘onlyDB’ parameter of the ‘backupDB.php’ script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user’s browser session.

Advisory ID: ZSL-2012-5089
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5089.php

2012
05/16
POSTED BY
CATEGORY
Internal
Comments Off

Rete Mirabilia

Site Meter