{"hash": "d680a17e66dbae3dba433df2153f7b28681899003a7298114217a8d1ef6f044e", "id": "1337DAY-ID-20366", "lastseen": "2018-01-04T19:03:02", "viewCount": 9, "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "2e5c4a37f6b3a12273f984ab5d6c6af8", "key": "description"}, {"hash": "3737c1380b40a3ab958613dcb163887e", "key": "href"}, {"hash": "2c8bd47ca94fbc0dee93098d60d31816", "key": "modified"}, {"hash": "2c8bd47ca94fbc0dee93098d60d31816", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "ee725b88bf6f6344f7ffe761047bbaea", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "sourceData"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "sourceHref"}, {"hash": "f06b5d1f77c4497be062b7ef6b7c24f7", "key": "title"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}], "bulletinFamily": "exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "edition": 2, "enchantments": {"score": {"value": 2.0, "vector": "NONE", "modified": "2018-01-04T19:03:02"}, "dependencies": {"references": [{"type": "zdt", "idList": ["1337DAY-ID-29591"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:9227", "SECURITYVULNS:DOC:20366"]}], "modified": "2018-01-04T19:03:02"}, "vulnersScore": 2.0}, "type": "zdt", "sourceHref": "", "description": "Dork : allintext: \"JibberBook created by chromasynthetic \r Powered by MooTools, HTML Purifier, and Akismet\"\r 1) SCript\r 2) Info Vulnerabilty\r 3) P0c\n\nThis is private exploit. You can buy it at https://0day.today", "title": "jibberbook Bypass Admin Vulnerability", "history": [{"bulletin": {"hash": "fd0306fe31bbea241ff29a1bdcbaf17de552a8480c3aca9c99491d66746ae018", "id": "1337DAY-ID-20366", "lastseen": "2016-04-19T01:11:52", "enchantments": {"score": {"value": 4.3, "modified": "2016-04-19T01:11:52"}}, "hashmap": [{"hash": "ee725b88bf6f6344f7ffe761047bbaea", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "sourceData"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "f8a97d3973d9ab282f42a2f74e3b2c47", "key": "description"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}, {"hash": "2c8bd47ca94fbc0dee93098d60d31816", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "2c8bd47ca94fbc0dee93098d60d31816", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "sourceHref"}, {"hash": "f06b5d1f77c4497be062b7ef6b7c24f7", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "933d009a36db730cf87e9f925e7aab97", "key": "href"}], "bulletinFamily": "exploit", "history": [], "edition": 1, "type": "zdt", "sourceHref": "", "description": "Dork : allintext: \"JibberBook created by chromasynthetic \r Powered by MooTools, HTML Purifier, and Akismet\"\r 1) SCript\r 2) Info Vulnerabilty\r 3) P0c\n\nThis is private exploit. You can buy it at http://0day.today", "viewCount": 2, "title": "jibberbook Bypass Admin Vulnerability", "cvss": {"score": 0.0, "vector": "NONE"}, "objectVersion": "1.0", "cvelist": [], "sourceData": "", "published": "2013-02-14T00:00:00", "references": [], "reporter": "CharafAnons", "modified": "2013-02-14T00:00:00", "href": "http://0day.today/exploit/description/20366"}, "lastseen": "2016-04-19T01:11:52", "edition": 1, "differentElements": ["description", "href"]}], "objectVersion": "1.3", "cvelist": [], "sourceData": "", "published": "2013-02-14T00:00:00", "references": [], "reporter": "CharafAnons", "modified": "2013-02-14T00:00:00", "href": "https://0day.today/exploit/description/20366"}

{"zdt": [{"lastseen": "2018-04-08T14:27:17", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2018-01-20T00:00:00", "published": "2018-01-20T00:00:00", "href": "https://0day.today/exploit/description/29591", "id": "1337DAY-ID-29591", "title": "Mambo < 4.5.4 - SQL Injection Vulnerability", "type": "zdt", "sourceData": "Mambo SQL Injection\r\n \r\nVendor: Miro International Pty Ltd\r\nProduct: Mambo\r\nVersion: <= 4.5.4\r\nWebsite: http://www.mamboserver.com/\r\n \r\nBID: 20366 \r\nOSVDB: 50002 \r\n \r\nDescription:\r\nMambo is a popular Open Source Content Management System released under the GNU General Public license (GNU GPL). There are unfortunately some serious flaws in Mambo's login feature that allow for authentication bypass. This can be used to access arbitrary accounts, but even worse can be used to eventually install harmful modules and execute arbitrary php code on the server running Mambo. The Mambo team have committed fixes for these issues to SVN, and patches are available from the official Mambo website. Users are encouraged to patch the vulnerable functionality or update their Mambo installation as soon as possible. \r\n \r\n \r\nAuthentication Bypass\r\nMambo is vulnerable to an Authentication Bypass issue that is due to an SQL Injection in the login function. The SQL Injection is possible because the $passwd variable is only sanitized when it is not passed as an argument to the function. \r\nfunction login( $username=null,$passwd=null ) {\r\nglobal $acl;\r\n \r\n$usercookie = mosGetParam( $_COOKIE, 'usercookie', '' );\r\n$sessioncookie = mosGetParam( $_COOKIE, 'sessioncookie', '' );\r\nif (!$username || !$passwd) {\r\n $username = trim( mosGetParam( $_POST, 'username', '' ) );\r\n $passwd = trim( mosGetParam( $_POST, 'passwd', '' ) );\r\n $passwd = md5( $passwd );\r\n $bypost = 1;\r\n}\r\n$remember = trim( mosGetParam( $_POST, 'remember', '' ) );\r\n \r\nif (!$username || !$passwd) {\r\n echo \"<script> alert(\\\"\"._LOGIN_INCOMPLETE.\"\\\"); window.history.go(-1); </script>\\n\";\r\n exit();\r\n} else {\r\n $username = $this->_db->getEscaped($username);\r\n $this->_db->setQuery( \"SELECT id, gid, block, usertype\"\r\n . \"\\nFROM #__users\"\r\n . \"\\nWHERE username='$username' AND password='$passwd'\"\r\n );\r\n \r\n \r\nAs seen in the above code it is assumed that the $passwd variable is an md5 hash, but when sending a cookie with values like \"usercookie[password]=%27 or 1=1/*; usercookie[username]=admin\" the query is broken, and the password is never checked correctly. This issue would probably be limited to SQL Injection, but Mambo allows a user to change their password without knowing the original password. They just have to be logged in to the particular account that they want to change the password for. Using this strategy an attacker could login as the admin using the authentication bypass vulnerability, change the admin password, and then successfully log into the admin section where uploading arbitrary php code via the \"install module\" function. \r\n \r\n \r\nSolution:\r\nThe Mambo development team have committed updates to SVN, and the patches can be obtained by visiting the official mambo website. \r\n\n\n# 0day.today [2018-04-08] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/29591"}], "securityvulns": [{"lastseen": "2018-08-31T11:09:30", "bulletinFamily": "software", "description": "NULL pointer dereference.", "modified": "2008-08-15T00:00:00", "published": "2008-08-15T00:00:00", "id": "SECURITYVULNS:VULN:9227", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:9227", "title": "Ventrilo voice chat server DoS", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-08-31T11:10:27", "bulletinFamily": "software", "description": "\r\n#######################################################################\r\n\r\n Luigi Auriemma\r\n\r\nApplication: Ventrilo\r\n http://www.ventrilo.com\r\nVersions: &lt;= 3.0.2\r\nPlatforms: Windows, Linux i386, Solaris SPARC, Solaris x86, FreeBSD\r\n i386, NetBSD i386, Mac OSX PowerPC\r\nBug: NULL pointer\r\nExploitation: remote, versus server\r\nDate: 13 Aug 2008\r\nAuthors: Andre Malm Luigi Auriemma\r\n web: sheepa.org e-mail: aluigi@autistici.org\r\n web: aluigi.org\r\n\r\n\r\n#######################################################################\r\n\r\n\r\n1&#41; Introduction\r\n2&#41; Bug\r\n3&#41; The Code\r\n4&#41; Fix\r\n\r\n\r\n#######################################################################\r\n\r\n===============\r\n1&#41; Introduction\r\n===============\r\n\r\n\r\nVentrilo is one of the most knwon and used voice chat softwares for\r\ngamers.\r\n\r\n\r\n#######################################################################\r\n\r\n======\r\n2&#41; Bug\r\n======\r\n\r\n\r\nDespite the vice of the Ventrilo developers of changing the protocol of\r\ntheir application enough often &#40;like the recent senseless additional\r\nencryption keys located on their centralized servers needed for the\r\nhandshake and the in-game packets of the 3.x servers&#41;, the first packet\r\nsent to a Ventrilo server has ever the same format on any new and old\r\nversion: type 0, version and two random strings.\r\n\r\nIf the server receives a version string different than its one it sends\r\nan &quot;Incompatible version&quot; error message to the client and skips the\r\ninstructions that create the random keys used for the encryption and\r\ndecryption of all the subsequent packets.\r\n\r\nSo if an attacker supplies an invalid version and sends another packet\r\nwith any content in it, the server crashes due to the key assigned for\r\nthe decryption of the client&#39;s packets which is still unitialized &#40;in\r\nfact the NULL pointer exception happens just in the decryption\r\nfunction&#41;.\r\n\r\n\r\n#######################################################################\r\n\r\n===========\r\n3&#41; The Code\r\n===========\r\n\r\n\r\nhttp://aluigi.org/poc/ventrilobotomy.zip\r\n\r\n\r\n#######################################################################\r\n\r\n======\r\n4&#41; Fix\r\n======\r\n\r\n\r\nNo official fix.\r\n\r\nI have written an universal work-around which works with any version\r\nand platform &#40;SPARC and Mac OSX excluded&#41; of the dedicated server:\r\n\r\n http://aluigi.org/patches/ventrilobotomyfix.zip\r\n\r\n\r\n#######################################################################\r\n\r\n\r\n--- \r\nLuigi Auriemma\r\nhttp://aluigi.org", "modified": "2008-08-15T00:00:00", "published": "2008-08-15T00:00:00", "id": "SECURITYVULNS:DOC:20366", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20366", "title": "NULL pointer in Ventrilo 3.0.2", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}]}