代码审计系列8: 蝉知企业门户2.4正式版 猥琐获取管理员账户密码

简要描述： 青岛息壤网络信息有限公司成立于2013年，由禅道软件公司青岛易软天创全资投资创办，位于美丽的青岛开发区，团队成员拥有丰富的网站设计、系统研发、服务器维护和SEO经验。我们正在打造一款开源免费的企业门户系统，以帮助企业建立品牌网站，进行宣传推广、市场营销、产品销售和客户跟踪。息壤，为天下企业提供专业的营销工具！ 详细说明： 蝉知企业门户系统在安装完成后会在 \system\tmp\log\ 下生成类似 的两个文件. 我们打开 sql.20140701.log 内容如下： 20140701 13:28:01: /install.php 20140701 13:28:04:...

SimpleBoard Mambo Component <= 1.1.0 - Remote Include Vulnerability

No description provided by source. Bug Found by h4ntu http://h4ntu.com batamhacker crew Another Mambo component remote inclusion vulneribility download : http://mamboxchange.com/frs/download.php/6920/Simpleboard-1.1.0-Stable.zip bug found in file fileupload.php : requireonce$sbp/sbhelpers.php;...

QuickTime 7.5.5 / ITunes 8.0 - Remote off by one Crash Exploit

No description provided by source. Quicktime7.5.5/Itunes 8.0 Remote Heap Overflow Crash Vendor: http://www.apple.com/ Risk : high The ? quicktime type= ? tag fail to handle long strings, which can lead to a heap overflow in Quicktime/Itunes media player. This bug can be remote or local,...

Hosting Controller <= 0.6.1 Unauthenticated User Registeration (3rd)

No description provided by source. !-- Hi, I'm Soroush Dalili from GSG GrayHatz Security Group. Title: Hosting controller program have a security bug in UserProfile.asp that an authenticated user can change other's profiles. Why is it dangerous: a user can change other's email address and then us...

PHP-Nuke <= 8.0 XSS & HTML Code Injection in News Module

No description provided by source. Software Link: http://www.phpnuke.org/modules.php?name=Downloads&dop=viewdownload&cid=1 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= note : This bug found by tampering passed data . coders don't sanitize and check user entry point for news rate...

SimpCMS <= 04.10.2007 (site) Remote File Inclusion Vulnerability

No description provided by source. Bug Found By Dr.RoVeR --Arab48 Hacker Contact: [email protected] --- Script: SimpCMS Light Download: http://www.simpcms.com/light/normal/simp-cms-light.zip -- Bug File: index.php Bug code in line 31: include $site..php; -- Exploit:...

SunShop Shopping Cart <= 3.5 (abs_path) RFI Vulnerabilities

No description provided by source. sunshop 4 index.php Remote File Include Vulnerability ----------------------------------------------------------------------------------------- scripts : SunShop v3.5 Discovered By : irvian scripts site : http://www.turnkeywebtools.com/sunshop/ Thanks To :...

Max.Blog <= 1.0.6 (submit_post.php) SQL Injection Vulnerability

No description provided by source. Salvatore drosophila Fresta Application: Max.Blog http://www.mzbservices.com Version: Max.Blog = 1.0.6 Bug: SQL Injection Exploitation: Remote Dork: intext:Powered by Max.Blog Date: 27 Jan 2009 Discovered by: Salvatore drosophila Fresta Author: Salvatore...

Wordpress Mini Mail Dashboard Widget Plugin 1.36 Remote File Inclusion

No description provided by source. Exploit Title: Mini Mail Dashboard Widget Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/mini-mail-dashboard-widget Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

Hosting Controller <= 0.6.1 HotFix 2.1 Change Credit Limit Exploit

No description provided by source. Hi, I'm Soroush Dalili from GSG GrayHatz Security Group. Title: Hosting controller program have a security bug in AccountActions.asp that an authenticated user can change his/her credit and buy some services! Version: 6.1 HotFix 2.1 and older Developer url:...

Linux 3.4+ recvmmsg x32 compat - Proof of Concept

No description provided by source. / PoC trigger for the linux 3.4+ recvmmsg x32 compat bug, based on the manpage https://code.google.com/p/chromium/issues/detail?id=338594 $ while true; do echo $RANDOM /dev/udp/127.0.0.1/1234; sleep 0.25; done / define GNUSOURCE include netinet/ip.h include...

Windows NDPROXY - 本地权限提升漏洞(MS14-002)

漏洞成因 这是一个windows内核漏洞，漏洞的触发需要开启Routing and Remote Access服务，影响 windowsxp，windows2003. 先上 poc c include include int main HANDLE hDev = CreateFile"\\.\NDProxy", GENERICREAD | GENERICWRITE, FILESHAREREAD | FILESHAREWRITE, NULL, OPENEXISTING , 0, NULL; ifhDev==INVALIDHANDLEVALUE printf"CreateFile...

Yogurt Social Network 3.2 rc1 Module for XOOPS seutubo.php uid Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/30618/info Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code ...

Samba nttrans Reply - Integer Overflow Vulnerability

No description provided by source. Exploitation: samba nttrans reply integer overflow / \ / \ | || | | | \ / / . || | | | / | / / | || || //\ // / | CVE-2013-4124 samba integer overflow in nttrans reply reading ealist vulnerable samba daemon has a integer overflow to cause remote dos by...

Phabricator: Abusing daemon logs for Privilege escalation under certain scenarios

Setup Needed + A normal user account + A momentary disruption of mail services Replication steps + Login as normal user + Wait for momentary disruption of mail services + Use Password Reset Link for admin mail address + BOOM!!! + You can see the password reset link in the daemon logs because of...

openSUSE Security Update : nagstamon (openSUSE-SU-2013:1235-1)

update to 0.9.10 : + added fullscreen option + added Thruk support + added CheckMK cookie-based auth + added new Centreon autologin option + added configurable default sort order + added filter for hosts in hard/soft state for Nagios, Icinga, Opsview and Centreon + added $STATUS-INFO$ variable...

openSUSE Security Update : colord (openSUSE-2011-57)

Update to version 0.1.15 : + This release fixes an important security bug: CVE-2011-4349. + New Features : - Add a native driver for the Hughski ColorHug hardware - Export cd-math as three projects are now using it + Bugfixes : - Documentation fixes and improvements - Do not crash the daemon if...

Slack: Remote file Inclusion - RFI in upload

Hello, Everysite has a RFI vulnerability. Everysite i.e .slack.com is having this vulnerability. Proof of concept / Steps to Reproduce : ================================= 1. Sign in to your account on slack eg. I signed in https://pran3hiva.slack.com 2. Now, go to 'Change photo'. i.e...

openssl multi-threaded multi-domain EXP, support for custom ports, save the binary file to save space-bug warning-the black bar safety net

!/ usr/bin/python Quick and dirty demonstration of CVE-2 0 1 4-0 1 6 0 by Jared Stafford [email protected] The author disclaims copyright to this source code. Multi process and bin dump version by [email protected] import sys import struct import socket import time import select impo...

DIR-605L Disclosure / Bypass

DIR-605L Hardware version Ax, firmware 1.14 has two severe security bug: 1. The login password is printed out in clear text in the "Current Network Setting" page just after login "Device Info" section. 2. The router can be controlled using a crafted URL GET request, even without login e.g. use an...