Macedonian information security research and development laboratory

(XSS) Input thru the GET parameters ‘limit’ and ‘search_folder’ in ‘ajax_get_file_listing.php’ are not sanitized allowing the attacker to execute HTML code into user’s browser session on the affected site.

(CRLF Injection/HTTP Response Splitting) Input passed to the POST parameter ‘editorChoice’ in ‘admin_blocks.php’ and ‘admin_pages.php’ and the POST parameter ‘theme’ in ‘admin_css.php’, ‘admin_js.php’ and ‘admin_templates.php’ is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user.

(LFI/DT) Input passed via the ‘fileName’ parameter thru the simplexml_load_file() function is not properly verified in ‘/admin/admin_blocks.php’ and ‘/admin/admin_pages.php’ (post-auth) before being used to load files. This can be exploited to disclose the contents of arbitrary files via directory traversal attacks.

Advisories:
ZSL-2011-5058 – http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5058.php
ZSL-2011-5059 – http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5059.php
ZSL-2011-5060 – http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5060.php

:):

Summary

MG2 is the sequel to the popular image gallery script MiniGal. One of the highlights of MG2 is, that it supports PHP running in safe mode which is unsupported by almost all other dynamic image gallery scripts on the web.

Description
MG2 suffers from multiple XSS vulns. Several parameters are vulnerable that are not sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4993.php

The web is now the cybercriminal’s favored means of attack, with a newly infected
website discovered every few seconds. Hijacked trusted sites, poisoned search
results, fake anti-virus software and phishing websites are a sample of the exploits
that hit users’ browsers every day. That leaves your business in a bind: Accessing
the web poses enormous risks, yet you can’t afford to be isolated from the
internet and its resources. This white paper examines the latest web threats, and
recommends four best practices and a layered approach that enables your users
while also protecting your organization’s endpoints, network and data.

Read on: sophos-safer-web-browsing-wpna.pdf

Vendor: OIC Group Inc.
Product web page: http://www.exponentcms.org
Affected version: 0.97

Summary: Open Source Content Management System (PHP+MySQL).

Desc: Exponent CMS suffers from multiple vulnerabilities:

#1. Local File Inclusion / File Disclosure Vulnerability
#2. Arbitrary File Upload / File Modify Vulnerability
#3. Reflected Cross-Site Scripting Vulnerability

(1) LFI/FD occurs when input passed thru the params:
- “action”
- “expid”
- “ajax_action”
- “printerfriendly”
- “section”
- “module”
- “controller”
- “int”
- “src”
- “template”
- “page”
- “_common”

to the scripts:
- “index.php”
- “login_redirect.php”
- “mod_preview.php”
- “podcast.php”
- “popup.php”
- “rss.php”

is not properly verified before being used to include files.
This can be exploited to include files from local resources
with directory traversal attacks and URL encoded NULL bytes.

(2) AFU/E occurs due to an error in:
- “upload_fileuploadcontrol.php”
- “upload_standalone.php”
- “manifest.php”
- “delete.php”
- “edit.php”
- “manage.php”
- “rank_switch.php”
- “save.php”
- “view.php”
- “class.php”
- “deps.php”
- “delete_form.php”
- “delete_process.php”
- “search.php”
- “send_feedback.php”
- “viewday.php”
- “viewmonth.php”
- “viewweek.php”
- “testbot.php”
- “activate_bot.php”
- “deactivate_bot.php”
- “manage_bots.php”
- “run_bot.php”
- “class.php”
- “delete_board.php”
- “delete_post.php”
- “edit_board.php”
- “edit_post.php”
- “edit_rank.php”
- “monitor_all_boards.php”
- “monitor_board.php”
- “monitor_thread.php”
- “preview_post.php”
- “save_board.php”
- “save_post.php”
- “save_rank.php”
- “view_admin.php”
- “view_board.php”
- “view_rank.php”
- “view_thread.php”
- “banner_click.php”
- “ad_delete.php”
- “ad_edit.php”
- “ad_save.php”
- “af_delete.php”
- “af_edit.php”
- “af_save.php”
- “delete_article.php”
- “edit_article.php”
- “save_article.php”
- “save_submission.php”
- “submit_article.php”
- “view_article.php”
- “view_submissions.php”
- “coretasks.php”
- “htmlarea_tasks.php”
- “search_tasks.php”
- “clear_smarty_cache.php”
- “configuresite.php”
- “config_activate.php”
- “config_configuresite.php”
- “config_delete.php”
- “config_save.php”
- “examplecontent.php”
- “finish_install_extension.php”
- “gmgr_delete.php”
- “gmgr_editprofile.php”
- “gmgr_membership.php”
- “gmgr_savegroup.php”
- “gmgr_savemembers.php”

as it allows uploads of files with multiple extensions to a
folder inside the web root. This can be exploited to execute
arbitrary PHP code by uploading a specially crafted PHP script.

The uploaded files are stored in: [CMS_ROOT_HOST]\files

(3) XSS occurs when input passed to the params:
- “u”
- “expid”
- “ajax_action”
- “ss”
- “sm”
- “url”
- “rss_url”
- “lang”
- “toolbar”
- “section”
- “section_name”
- “src”

in scripts:
- “slideshow.js.php”
- “picked_source.php”
- “magpie_debug.php”
- “magpie_simple.php”
- “magpie_slashbox.php”
- “test.php”
- “fcktoolbarconfig.js.php”
- “section_linked.php”
- “index.php”

is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script
code in a user’s browser session in context of an affected site.

Tested on: Microsoft Windows XP Professional SP3 (English)
Apache 2.2.14 (Win32)
MySQL 5.1.41
PHP 5.3.1

Vendor status: [09.10.2010] Vulnerabilities discovered.
[10.10.2010] Vendor contacted.
[13.10.2010] No reply from vendor.
[14.10.2010] Public advisory released.

Advisory ID: ZSL-2010-4969
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4969.php

Vulnerabilities discovered by: Gjoko ‘LiquidWorm’ Krstic
liquidworm gmail com
Zero Science Lab – http://www.zeroscience.mk

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4969.php

Raw analysis (hi 5 John Leitch): Log_Exponent.txt (616 KB)

c0c0n, previously known as Cyber Safe, is an annual event conducted as part of the International Information Security Day. The Information Security Research Association along with Matriux Security Community is organizing a 2 day International Security and Hacking Conference titled c0c0n 2010, as part of Information Security Day 2010. The event is supported by the Kochi City Police. Various technical, non-technical, legal and community events are organized as part of the program. c0c0n 2010 is scheduled on 05, 06 Aug 2010

The number of digital security incidents and cyber crimes are increasing daily on a proportionate rate. The industry is demanding more and more security professionals and controls to curb this never ending threat to information systems.

c0c0n is aimed at providing a platform to discuss, showcase, educate, understand and spread awareness on the latest trends in information, cyber and hi-tech crimes. It also aims to provide a hand-shaking platform for various corporate, government organizations including the various investigation agencies, academia, research organizations and other industry leaders and players for better co-ordination in making the cyber world a better and safe place to be.

Yet another speech by Maximiliano Soler held on 5th and 6th of August, 2010 in Kochi, India. Maxi thru his presentation mentioned in Recoleccion de Informacion con Google (OWASP Argentina) wonderfully describes the various techniques using Google search for gaining sensitive information when conducting penetration tests.

For more details about the c0c0n conference and speakers visit http://www.informationsecurityday.com/c0c0n/, speakers: http://www.informationsecurityday.com/c0c0n/speakers.html

t00t Maxi ;)