PHP EXT/Session HTTP应答头注入漏洞

PHP是一款广泛使用的WEB开发脚本语言。 PHP的ext/session在置于会话COOKIE前没有URL编码会话ID，远程攻击者可以利用漏洞可以对会话COOKIE进行注入攻击。 当PHP' ext/session调用sessionstart，会在部分情况下发送新会话COOKIE，这些情况如下： - session id嵌入到PATHINFO - session id重生成 - session id通过sessionid设置 - sessionstart多次调用...

dokeos180-sql.txt

!/usr/bin/perl -w Dokeos alertdocument.cookie Also, the amount of XSS vulnerabilites in this application is truely unbelievable...

BoastMachine v3.0 platinum - Session Эd Hacking

Vagrant - E-hack.org 05.22.2007 BoastMachine v3.0 platinum - Session Id Hacking After the login into the site which alllows new user registration. Site user's data which is entered to change the topic, can be changed by another user, and that is a security hole because of ID interchangeability in...

Dokeos 1.6.5 - 'courseLog.php?scormcontopen' SQL Injection

!/usr/bin/perl -w Dokeos = 1.6.5 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code courseLog.php: if $GET'scormcontopen' includeonceapigetlibrarypath.'/database.lib.php'; include'../scorm/XMLencode.php';...

Alstrasoft e-Friends 4.21 - Admin Session Retrieve

!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc2 echo "Usage: php ".$argv0." Host Path Host: target server ip/hostname Path: path of template Example: php ".$argv0." localhost /efriend/"; die; errorreporting0; iniset"maxexecutiontime",0;...

[MajorSecurity Advisory #41]onelook courts online - Session fixation Issue

MajorSecurity Advisory 41onelook courts online - Session fixation Issue Details ======= Product: courts online Remote-Exploit: yes Vendor-URL: http://www.onebyone.ch/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz http://www.majorsecurity....

PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit

Exploit for linux platform in category local exploits ======================================================= PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit ======================================================= ?php //////////////////////////////////////////////////////////////////////...

PHP 5.2.0/5.2.1 Rejected Session ID Double Free Exploit

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...

PHP 5.2.0/5.2.1 - Rejected Session ID Double-Free

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP 5.2.05.2.1 - Rejected Session ID Double-Free

PHP 5.2.05.2.1 - Rejected Session ID Double-Free ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the...

Jetty可预测随机会话ID漏洞

Jetty是一款流行的Java Web服务器。 Jetty的会话ID随机生成实现上存在漏洞，远程攻击者可能利用此漏洞获取非授权访问。 Jetty使用java.util.Random生成会话ID。java.util.random实现以下形式的线性同余随机数生成器： synchronized protected int nextint bits seed = seed 0x5DEECE66DL + 0xBL & 1L 48 - 1; return intseed 48 - bits;...

Jetty Non-random Session ID Vulnerability

Binary data 3904.prm...

Jetty Session ID Prediction

======= Summary ======= Name: Jetty Session Id Prediction Release Date: 5 February 2007 Reference: NGS00471 Discover: Chris Anley [email protected] Vendor: Mortbay Systems Affected: Jetty prior to versions 4.2.27, 5.1.12, 6.0.2 and 6.1.0pre3 Risk: High Status: Fixed ======== TimeLine ========...

CVE-2003-1312

CVE-2003-1312 affects siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder, where a session ID is placed in the SMSESSION parameter value within a URL. This could allow an attacker to obtain the session ID via network sniffing, Referer logs, or similar methods. The provided documents describe...

[SA23343] Drupal Chatroom Module Session ID Information Disclosure

TITLE: Drupal Chatroom Module Session ID Information Disclosure SECUNIA ADVISORY ID: SA23343 VERIFY ADVISORY: http://secunia.com/advisories/23343/ CRITICAL: Moderately critical IMPACT: Hijacking, Exposure of sensitive information WHERE: From remote SOFTWARE: Drupal Chatroom Module 4.x...

Envolution <= 1.1.0 (PNSVlang) Remote Code Execution Exploit

Exploit for unknown platform in category web applications ============================================================ Envolution = 1.1.0 PNSVlang Remote Code Execution Exploit ============================================================ ? print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+:...

MDPro <= 1.0.76 (Cookie: PNSVlang) Local File Include Exploit

Exploit for unknown platform in category web applications ============================================================= MDPro = 1.0.76 Cookie: PNSVlang Local File Include Exploit ============================================================= ? print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :...

MDPro 1.0.76 - Cookie PNSVlang Local File Inclusion

MDPro 1.0.76 - Cookie PNSVlang Local File Inclusion DEVIL TEAM IRC: 72.20.18.6:6667 devilteam http://www.rahim.webd.pl/ ======== Contact: [email protected] cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL TEAM Patrio...

PostNuke 0.763 - PNSV lang Remote Code Execution

PostNuke 0.763 - PNSV lang Remote Code Execution DEVIL TEAM IRC: 72.20.18.6:6667 devilteam ======== Contact: [email protected] or http://www.rahim.webd.pl/ cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL TEAM Patrio...

VMware ESX多个敏感信息泄露漏洞

VMware ESX Server是一个适用于任何系统环境的企业级虚拟计算机软件。 VMware ESX Server的管理界面使用了两个Cookies（vmware.mui.kid和vmware.mui.sid）中的会话ID。会话ID格式是私有的，包含有简单base64编码格式的用户帐号和口令。如果攻击者可以通过任何机制（如跨站脚本攻击）访问了Cookies的话，就可以获取认证凭据。 VMware ESX Server的管理界面允许用户更改口令。如果是root用户的话，还可以更改其他用户的口令。在更改口令时，会通过一个HTML表单要求用户输入并确认新的口令，然后通过HTTP...