ALCASAR is a free Network Access Controller which controls the Internet consultation networks. It authenticates, attributes and protects users' access regardless their connected equipment (PC, smartphone, game console, etc.). I recently released an exploit for ALCASAR 2.8 (ALCASAR <= 2.8 Remote Code Execution Vulnerability Root). As a reminder, it was a trivial code execution via a unfiltered exec() call: $pattern = preg_replace('/www./','',$_SERVER['HTTP_HOST']); exec("grep -Re ^$pattern$ /etc/dansguardian/lists/blacklists/*/domains|cut -d'/' -f6", $output); A few days later, a new version corrects the vulnerability. Or maybe not...
This exploit allows an attacker to escape from the Comodo Sandbox environment. The exploit is a proof-of-concept code that can be used to bypass the Comodo Sandbox security mechanism. The exploit works by creating a malicious executable file that is then executed in the sandbox environment. The malicious executable file contains code that will modify the system registry and allow the attacker to gain access to the system.
The vulnerability exists due to a poor regex in the file ParserLib.pas. It will not handle null byte so a request to http://localhost:80/?search=%00{.exec|cmd.} will stop regex from parse macro, and macro will be executed and remote code injection happen.
The 'id' variable in the URL is not sanitized, allowing for an attacker to inject malicious SQL code.
A persistent input validation web vulnerability has been discovered in the ChatSecure IM v2.2.4 iOS mobile web-application. The vulnerability allows an attacker to inject own malicious script codes to the application-side of the chat im ios app.
A local file include web vulnerability has been discovered in the official Photorange v1.0 iOS mobile web-application. The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path commands to compromise the mobile web-application.
The 'contacts_id' variable is not sanitized, allowing for an attacker to inject malicious SQL code into the query.
Goto http://server add a new lead fill all the fields properly but Fill the email filed with xss payload as given in the screenshot. payload used '><img src=d onerror=confirm(/provensec/);>. click save and close button. Now goto the leads list page. click on the lead which we have created. XSS payload will be executed.
ALCASAR Web UI, accessible by any unauthenticated user, suffers from a trivial vulnerability. In the "index.php" file: $pattern = preg_replace('/www./','',$_SERVER['HTTP_HOST']); exec("grep -Re ^$pattern$ /etc/dansguardian/lists/blacklists/*/domains|cut -d'/' -f6", $output); By sending a specially crafted value in the "host" HTTP header, it is possible to inject the exec() function in order to execute commands as Apache user. In addition, the Apache user is able to call sudo for these binaries: /sbin/ip,/sbin/arping,/sbin/arp,/usr/sbin/arpscan,/usr/sbin/tcpdump,/usr/local/bin/alcasar-watchdog.sh,/usr/local/sbin/alcasar-dhcp.sh,/usr/local/bin/alcasar-conf.sh,/usr/local/sbin/alcasar-mysql.sh,/usr/local/sbin/alcasar-bl.sh,/usr/local/sbin/alcasar-dns.sh
This module exploits an arbitrary file upload vulnerability in ManageEngine DesktopCentral v7 to v9 build 90054 (including the MSP versions). A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution as SYSTEM. Some early builds of version 7 are not exploitable as they do not ship with a bundled Java compiler.
Services By CQR