JSPMyAdmin SQL Injection, CSRF & XSS Vulnerabilities

Credits: John Page hyp3rlinx Domains: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/AS-JSPMYADMIN0529.txt Vendor: code.google.com/p/jsp-myadmin Product: JSPAdmin 1.1 is a Java web based MySQL database management system. Advisory Information:...

JSPMyAdmin 1.1 - Multiple Vulnerabilities

JSPMyAdmin 1.1 - Multiple Vulnerabilities Exploit Title: JSPMyAdmin 1.1 SQL Injection, CSRF & XSS Google Dork: intitle:SQL Injection Date: 2015-05-29 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org/ Vendor Homepage: https://code.google.com/p/jsp-myadmin/ Software Link:...

JSPAdmin 1.1 SQL Injection / CSRF / Cross Site Scripting

Credits: John Page hyp3rlinx Domains: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/AS-JSPMYADMIN0529.txt Vendor: code.google.com/p/jsp-myadmin Product: JSPAdmin 1.1 is a Java web based MySQL database management system. Advisory Information:...

JSPMyAdmin 1.1 - Multiple Vulnerabilities

Exploit Title: JSPMyAdmin 1.1 SQL Injection, CSRF & XSS Google Dork: intitle:SQL Injection Date: 2015-05-29 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org/ Vendor Homepage: https://code.google.com/p/jsp-myadmin/ Software Link: https://code.google.com/p/jsp-myadmin/ Version:...

Anti-Malware & Brute-Force Security by ELI <= 4.15.22 - Stored XSS

The Anti-Malware and Brute-Force Security by ELI has two issues which we will cover in this report. The first is that no nonce CSRF token is utilized on the settings screen. This could potentially result in resource utilization by performing a large number of scans simultaneously, should an...

Anti-Malware & Brute-Force Security by ELI <= 4.15.22 - Stored XSS

The Anti-Malware and Brute-Force Security by ELI has two issues which we will cover in this report. The first is that no nonce CSRF token is utilized on the settings screen. This could potentially result in resource utilization by performing a large number of scans simultaneously, should an...

DokuWiki persistent Cross Site Scripting

Advisory ID: SGMA15-001 Title: DokuWiki persistent Cross Site Scripting Product: DokuWiki Version: 2014-09-29c and probably prior Vendor: www.dokuwiki.org Vulnerability type: Persistent XSS Risk level: Medium Credit: Filippo Cavallarin - segment.technology CVE: N/A Vendor notification: 2015-03-18...

Shopify: Notification request disclose private information about other myshopify accounts

Hello Attacker, using notification feature in Admin panel, can successfully disclose\enumerate Shopify customers and retrieve their user-id, first+last name and email address. Last part of information is most avluble piece of information, since it can be used to conduct targeted attack on Shopify...

Shopify: CSRF token fixation in facebook store app that can lead to adding attacker to victim acc

hey guys i just found an csrf token fixation in facebook store app which is an offical shopify app link https://docs.shopify.com/manual/more/official-shopify-apps/facebook-store The CSRF bug which connects attacker's Facebook account to victim's shopify account. This is done by exploiting 'Connec...

Pimcore CMS 3.0.5 Cross Site Request Forgery

Affected software: pimcore cms Type of vulnerability:csrf URL:pimcore.org Discovered by: provensec Website: provensec.com version: Version: 3.0.5 Build: 3468 Proof of concept no csrf token on add dashboard form...

DokuWiki 2014-09-29c Cross Site Scripting

Advisory ID: SGMA15-001 Title: DokuWiki persistent Cross Site Scripting Product: DokuWiki Version: 2014-09-29c and probably prior Vendor: www.dokuwiki.org Vulnerability type: Persistent XSS Risk level: Medium Credit: Filippo Cavallarin - segment.technology CVE: N/A Vendor notification: 2015-03-18...

Mambo 4.6.5 Cross Site Request Forgery / SQL Injection

Affected software: Mambo Type of vulnerability: csrf to sql injection URL: http://source.mambo-foundation.org/ Discovered by: Provensec Website: http://www.provensec.com version 4.6.5 Proof of concept no csrf token were used on sql query form so attacker can leverage csrf to execute sql query on...

phpMyAdmin 4.0.x < 4.0.10.9 / 4.2.x < 4.2.13.2 / 4.3.x < 4.3.11.1 Information Disclosure Vulnerability (PMASA-2015-1)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.9, 4.2.x prior to 4.2.13.2, or 4.3.x prior to 4.3.11.1. It is, therefore, affected by an information disclosure vulnerability due to the length of compressed HTTPS...

CVE-2015-2206

libraries/selectlang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to...

CVE-2015-2206

libraries/selectlang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to...

CVE-2015-2206

libraries/selectlang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to...

Enter: The csrf token remains same after user logs in

As the CSRF token doesn't change after login. Any other user that uses the same workstation is vulnerable. A safer way would be to use dynamic CSRF token or just change the token after login, so attacker doesnt get hold of this. Details of the attacks scenario in a shared workstation environment ...

phpMyAdmin -- Risk of BREACH attack due to reflected parameter

The phpMyAdmin development team reports: Risk of BREACH attack due to reflected parameter. With a large number of crafted requests it was possible to infer the CSRF token by a BREACH attack. Mitigation factor: this vulnerability can only be exploited in the presence of another vulnerability that...

Risk of BREACH attack due to reflected parameter.

PMASA-2015-1 Announcement-ID: PMASA-2015-1 Date: 2015-03-04 Summary Risk of BREACH attack due to reflected parameter. Description With a large number of crafted requests it was possible to infer the CSRF token by a BREACH attack. Severity We consider this vulnerability to be non critical...

Mobile Vikings: CSRF token from another valid user session accepted

While testing website i have found interesting issue. For example request to remove sim auth: POST /en/sims/authorization/remove/admin/1036359/ HTTP/1.1 Host: mobilevikings.be User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:35.0 Gecko/20100101 Firefox/35.0 Accept: / Accept-Language:...