{"zdt": [{"lastseen": "2018-01-02T11:24:22", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2010-09-19T00:00:00", "published": "2010-09-19T00:00:00", "id": "1337DAY-ID-14108", "href": "https://0day.today/exploit/description/14108", "type": "zdt", "title": "Joomla Component com_restaurantguide Multiple Vulnerabilities", "sourceData": "=============================================================\r\nJoomla Component com_restaurantguide Multiple Vulnerabilities\r\n=============================================================\r\n\r\n# Exploit Title: Joomla Component com_restaurantguide Multiple Vulnerabilities\r\n# Date: 18.09.2010\r\n# Author: Valentin\r\n# Category: webapps/0day\r\n# Version: 1.0.0\r\n \r\n# Tested on: Debian lenny, Apache2, MySQL 5, Joomla 1.5.x\r\n# CVE : \r\n# Code :\r\n \r\n \r\n[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]\r\n>> General Information\r\nAdvisory/Exploit Title = Joomla Component com_restaurantguide Multiple Vulnerabilities\r\nAuthor = Valentin Hoebel\r\nContact = [email\u00a0protected]\r\n \r\n \r\n[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]\r\n>> Product information\r\nName = Restaurant Guide\r\nVendor = Oh-Taek Im\r\nVendor Websites = http://www.photoindochina.com/, http://extensions.joomla.org/extensions/directory-a-documentation/thematic-directory/14054\r\nAffected Version(s) = 1.0.0\r\n \r\n \r\n[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]\r\n>> SQL Injection\r\nindex.php?option=com_restaurantguide&view=country&id='&Itemid=69\r\n(id parameter is vulnerable)\r\n \r\n \r\n>> HTML/JS/VBS Code Injection (all input fields, also in the admin backend)\r\nIt is possible to inject HTML/JS/VBS code into the document although XSS filters are active. Simply end the current HTML tag and convert your code into decimal HTMl code without semicolons:\r\n\"><A HREF=\"http://www.google.com./\">injected</A>\r\n(which is \"><A HREF=\"http://www.google.com./\">injected</A>)\r\nThe code doesn't get parsed, so it is not possible to exploit this weakness. However, including arbitrary plain text into the current website is possible. Dangerous! :D\r\n \r\n \r\n>> Interesting stuff\r\na) Triggering various error messages in the admin panel is possible, e.g.:\r\nadministrator/index.php?option=com_restaurantguide&controller=restaurantitems&task=edit&cid[]=[try ' or -1 or an ID which does not exist]\r\nSometimes the code of the component gets displayed within the browser window when you try to trigger errors with different variables.\r\n \r\nb) Playing around with the controller variable\r\nadministrator/index.php?option=com_restaurantguide&controller=../../../../../../../../../etc/passwd%00\r\n(NOT a LFI vulnerability since the controller classes are defined in the source code, you just get different error messages.. nothing to exploit here..)\r\n \r\n \r\n[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]\r\n>> Additional Information\r\nAdvisory/Exploit Published = 18.09.2010\r\n \r\n \r\n[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]\r\n>> Misc\r\nGreetz = cr4wl3r, JosS, packetstormsecurity.org\r\n \r\n \r\n[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]\r\n\r\n\n\n# 0day.today [2018-01-02] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/14108"}], "securityvulns": [{"lastseen": "2018-08-31T11:10:30", "bulletinFamily": "software", "description": "\r\n\r\nOriginal advisory http://dsecrg.com/pages/vul/show.php?id=119\r\n\r\n\r\nDigital Security Research Group [DSecRG] Advisory #DSECRG-09-019\r\n\r\nApplication: Apache Geronimo Application Server\r\nVersions Affected: 2.1 - 2.1.3\r\nVendor URL: http://geronimo.apache.org/\r\nBug: Multiple XSS Vulnerabilities\r\nExploits: YES\r\nReported: 10.12.2008\r\nVendor response: 10.12.2008\r\nSolution: YES \r\nDate of Public Advisory: 16.04.2009\r\nCVE-number: 2009-0038\r\nAuthor: Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)\r\n\r\n\r\n\r\nDescription\r\n***********\r\n\r\nGeronimo Server Console multiple XSS vulnerabilities.\r\n\r\nVarious linked and stored cross-site scripting (XSS) vulnerabilities were found in the Apache Geronimo administrative\r\nconsole and related utilities.\r\n\r\nThis affects all full JavaEE Geronimo releases or other distributions which include the administration web console up to\r\nand including Geronimo 2.1.3.\r\n\r\n\r\n\r\nDetails\r\n*******\r\n\r\nUsing this vulnerability attacker can steal administrator's cookie and then authentificate as administrator or perform\r\ncertain administrative actions.\r\n\r\n1. Linked XSS vulnerability.\r\n\r\nAttacker can inject XSS in URL string.\r\n\r\nExample:\r\n\r\nhttp://[server]/console/portal/"><script>alert('DSecRG XSS')</script><!--\r\n\r\n\r\n2. Multiple Stored XSS vulnerabilities found in script \r\n\r\n/console/portal/Server/Monitoring\r\n\r\nVulnerable parameters: "name", "ip", "username", "description".\r\n\r\nAttacker can inject scripts into monitorings.\r\n\r\nExample [Monitoring - Create View]:\r\n\r\nname = <script>alert('DSecRG XSS')</script>\r\ndescription = </textarea><script>alert("DSecRG XSS")</script>\r\n\r\nor\r\n\r\nhttp://[server]/console/portal//Server/Monitoring/__ac0x3monitoring0x2monitoring!126896788|0/__pm0x3monitoring0x2monitoring!126896788|0_edit?action=saveAddView&name="><script>alert("DSecRG\r\nXSS")</script>&description=</textarea><script>alert("DSecRG XSS")</script>\r\n\r\n\r\n\r\nSolution\r\n********\r\n\r\nThis s\r\n\r\necurity vulnerabilities fixed in Geronimo 2.1.4 release.\r\n\r\nNew version of Geronimo 2.1.4 can be downloaded from this location:\r\n\r\nhttp://geronimo.apache.org/downloads.html\r\n\r\nAn alternative workaround (if you choose to not upgrade to Apache Geronimo 2.1.4) would be to stop or undeploy the\r\nadministration web console application in the server.\r\n\r\nCredits\r\n*******\r\n\r\nhttp://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214\r\n\r\n\r\n\r\nAbout\r\n*****\r\n\r\nDigital Security is leading IT security company in Russia, providing information security consulting, audit and\r\npenetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS\r\nstandards. \r\nDigital Security Research Group focuses on web application and database security problems with vulnerability reports,\r\nadvisories and whitepapers posted regularly on our website.\r\n\r\nContact: research [at] dsecrg [dot] com\r\n http://www.dsecrg.com \r\n http://www.dsec.ru\r\n\r\n\r\nRegards,\r\nDigital Security Research Group [DSecRG]\r\n________________________________________\r\nDIGITAL SECURITY\r\ntel/fax: +7(812)703-1547\r\ntel: +7(812)430-9130\r\ne-mail: research@dsecrg.com\r\nweb: www.dsecrg.com\r\n----------------------------------------\r\nThis message and any attachment are confidential and may be privileged \r\nor otherwise protected from disclosure. If you are not the intended \r\nrecipient any use, distribution, copying or disclosure is strictly \r\nprohibited. If you have received this message in error, please notify \r\nthe sender immediately either by telephone or by e-mail and delete this \r\nmessage and any attachment from your system. Correspondence via e-mail \r\nis for information purposes only. Digital Security neither makes nor \r\naccepts legally binding statements by e-mail unless otherwise agreed. \r\n----------------------------------------", "modified": "2009-04-17T00:00:00", "published": "2009-04-17T00:00:00", "id": "SECURITYVULNS:DOC:21673", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21673", "title": "[DSECRG-09-019] Apache Geronimo - XSS vulnerabilities.txt", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-08-31T11:09:32", "bulletinFamily": "software", "description": "Crossite scripting, directory traversal.", "modified": "2009-04-17T00:00:00", "published": "2009-04-17T00:00:00", "id": "SECURITYVULNS:VULN:9843", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:9843", "title": "Apache Geronimo multiple security vulnerabilities", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-08-31T11:10:19", "bulletinFamily": "software", "description": "TITLE:\r\nIBM AIX dtterm Privilege Escalation Vulnerability\r\n\r\nSECUNIA ADVISORY ID:\r\nSA21673\r\n\r\nVERIFY ADVISORY:\r\nhttp://secunia.com/advisories/21673/\r\n\r\nCRITICAL:\r\nLess critical\r\n\r\nIMPACT:\r\nPrivilege escalation\r\n\r\nWHERE:\r\nLocal system\r\n\r\nOPERATING SYSTEM:\r\nAIX 5.x\r\nhttp://secunia.com/product/213/\r\n\r\nDESCRIPTION:\r\nA vulnerability has been reported in IBM AIX, which can be exploited\r\nby malicious, local users to gain escalated privileges.\r\n\r\nThe vulnerability is caused due to an unspecified error in dtterm and\r\nallows execution of arbitrary code with root privileges.\r\n\r\nSOLUTION:\r\nApply APARs.\r\n\r\nAIX 5.3:\r\nApply APAR IY89052.\r\n\r\nAIX 5.2:\r\nApply APAR IY89045.\r\n\r\nPROVIDED AND/OR DISCOVERED BY:\r\nReported by the vendor.\r\n\r\nORIGINAL ADVISORY:\r\nIBM:\r\nhttp://www-1.ibm.com/support/docview.wss?uid=isg1IY89052\r\nhttp://www-1.ibm.com/support/docview.wss?uid=isg1IY89045\r\n\r\n----------------------------------------------------------------------\r\n\r\nAbout:\r\nThis Advisory was delivered by Secunia as a free service to help\r\neverybody keeping their systems up to date against the latest\r\nvulnerabilities.\r\n\r\nSubscribe:\r\nhttp://secunia.com/secunia_security_advisories/\r\n\r\nDefinitions: (Criticality, Where etc.)\r\nhttp://secunia.com/about_secunia_advisories/\r\n\r\n\r\nPlease Note:\r\nSecunia recommends that you verify all advisories you receive by\r\nclicking the link.\r\nSecunia NEVER sends attached files with advisories.\r\nSecunia does not advise people to install third party patches, only\r\nuse those supplied by the vendor.", "modified": "2006-08-31T00:00:00", "published": "2006-08-31T00:00:00", "id": "SECURITYVULNS:DOC:14108", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:14108", "title": "[SA21673] IBM AIX dtterm Privilege Escalation Vulnerability", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}]}
