PHP 5.3.x < 5.3.7 crypt() MD5 Incorrect Return Value

Binary data 6017.prm...

PHP 5.3.7 crypt() MD5 Incorrect Return Value

According to its banner, PHP 5.3.7 is installed on the remote host. This version contains a bug in the crypt function when generating salted MD5 hashes. The function only returns the salt rather than the salt and hash. Any authentication mechanism that uses crypt could authorize all authenticatio...

PHP &quot;crypt()&quot; MD5 Salt安全漏洞

PHP是流行的脚本语言环境。 PHP在"crypt"函数的实现上存在安全漏洞，远程攻击者可利用此漏洞绕过某些安全限制。 此漏洞源于"crypt"函数在生成有salt的MD5哈希时，仅返回salt PHP 5.3.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net...

FreeBSD : PHP -- crypt() returns only the salt for MD5 (3f1df2f9-cd22-11e0-9bb2-00215c6a37bb)

PHP development team reports : If crypt is executed with MD5 salts, the return value consists of the salt only. DES and BLOWFISH salts work as expected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXM...

WordPress Plugin MM Duplicate 1.2 - SQL Injection

Exploit Title: WordPress MM Duplicate plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0 --------------- Vulnerable code --------------- class mmduplicatepagesposts ... function mmduplicatepagesposts ... addaction'init', array&$this, 'dup'; ... function dup if$GET'duplicate' $id =...

WordPress Plugin Ajax Gallery 3.0 - SQL Injection

WordPress Plugin Ajax Gallery 3.0 - SQL Injection Exploit Title: WordPress Ajax Gallery plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0 --------------- Vulnerable code --------------- if isset $GET 'delete' && isset $GET'gId' $wpdb-query "DELETE FROM $wpdb-options WHERE...

WordPress Plugin Allow PHP in Posts and Pages 2.0.0.RC1 - SQL Injection

Exploit Title: WordPress Allow PHP in Posts and Pages plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0 --------------- Vulnerable code --------------- if!isset$POST'allowPHPNonce' if !wpverifynonce $POST'allowPHPNonce', pluginbasenameFILE header"location:".$refer; else...

PHP -- crypt() returns only the salt for MD5

PHP development team reports: If crypt is executed with MD5 salts, the return value consists of the salt only. DES and BLOWFISH salts work as expected...

Debian Security Advisory DSA 2239-1 (libmojolicious-perl)

The remote host is missing an update to libmojolicious-perl announced via advisory DSA 2239-1. OpenVAS Vulnerability Test $Id: deb22391.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2239-1 libmojolicious-perl Authors: Thomas Reinke Copyright: Copyright c...

imap-brute NSE Script

Performs brute force password auditing against IMAP servers using either LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5 or NTLM authentication. Script Arguments imap-brute.auth authentication mechanism to use LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5 or NTLM passdb, unpwdb.passlimit, unpwdb.timelimit,...

smtp-brute NSE Script

Performs brute force password auditing against SMTP servers using either LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5 or NTLM authentication. Script Arguments smtp-brute.auth authentication mechanism to use LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5 or NTLM creds.service, creds.global See the documentation for the...

Veeam ONE Monitor SNMP MIBs

Purpose This article provides an MIB file that can be used by SNMP receivers that are being sent SNMP traps when configured as documented in: Veeam ONE Monitoring Guide: Configuring SNMP Traps. Solution Download Veeam ONE SNMP MIB MD5: 21E8DDEFEC6824CA20E8C862CDA76B40 SHA-1:...

Analysis of the postgresql database attack techniques II-vulnerability warning-the black bar safety net

You can see we broke up in a field for the name, then we continue incrementing the offset value, to obtain the other field, as shown in Figure 9 and 1=2 union select 1,columnname,'3','4' from informationschema. the columns where tablename='admins' offset 2 limit 1-- ! Figure 9 Field passowrd is...

Education Station vulnerability the batch to get shell-vulnerability warning-the black bar safety net

Education Station print page vulnerability google search inurl:infoPrint. asp? ArticleID= Default background: website/adlogin. asp Squib administrator password: union select 1,2,username,password,5,6,7,8,9,1 0,1 1,1 2,1 3,1 4,1 5,1 6,1 7,1 8,1 9,2 0,2 1,2 2,2 3,2 4,2 5,2 6,2 7,2 8 from admin Afte...

Nmap NSE net: http-favicon

Gets the favicon 'favorites icon' from a web page and matches it against a database of the icons of known web applications. If there is a match, the name of the application is printed; otherwise the MD5 hash of the icon data is printed. If the script argument 'favicon.uri' is given, that relative...

Belkin G Wireless Router 5.00.12 Password Hash Disclosure

+-----------------------------------------+ | Belkin G Wireless Router Admin Exploit. | +-----------------------------------------+ Firmware Version : 5.00.12 Sep 10 2009 19:54:12 Boot Version : 1.18 Hardware : F5D7234-4 v5 01 Author : Aodrulez. Email : [email protected] Twitter :...

Belkin F5D7234-4 v5 G Wireless Router - Remote Hash Exposed

+-----------------------------------------+ | Belkin G Wireless Router Admin Exploit. | +-----------------------------------------+ Firmware Version : 5.00.12 Sep 10 2009 19:54:12 Boot Version : 1.18 Hardware : F5D7234-4 v5 01 Author : Aodrulez. Email : [email protected] Twitter :...

Belkin G Wireless Router F5D7234-4 v5 Exploit

Exploit for hardware platform in category web applications +-----------------------------------------+ | Belkin G Wireless Router Admin Exploit. | +-----------------------------------------+ Firmware Version : 5.00.12 Sep 10 2009 19:54:12 Boot Version : 1.18 Hardware : F5D7234-4 v5 01 Author :...

Hashbot - Forensic web tool to acquire and validate the web pages !

What is hashbot? Hashbot is a forensic web tool to acquire and validate, over time, the status of an individual web page or web document. Feature : Acquire Follow these steps to acquire a web document: 1. Insert the document's URL ie: https://www.evilwebpage.com/image.jpg or...

Memory corruption in Postfix SMTP server Cyrus SASL support &#40;CVE-2011-1720&#41;

On-line version will be at http://www.postfix.org/CVE-2011-1720.html Summary ======= The Postfix SMTP server has a memory corruption error when the Cyrus SASL library is used with authentication mechanisms other than PLAIN and LOGIN the ANONYMOUS mechanism is unaffected but should not be enabled...