Multiple persistent input validation vulnerabilities are detected in the car portal v3.0 web application. The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent). Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context manipulation. Exploitation requires low user interaction.
Alienvault OSSIM Open Source SIEM 3.1 is prone to XSS and SQL-Injection vulnerabilities. PoC-Exploit includes two XSS and one SQL-Injection vulnerability. The SQL-Injection requires authentication. The XSS vulnerabilities can be exploited by sending malicious payloads in the URL.
An attacker can exploit this vulnerability by sending a crafted HTTP request with a maliciously crafted page parameter. This parameter can be used to include a file from the local file system, which can be used to execute arbitrary code.
Axous 1.1.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by sending malicious SQL queries to the application. This can be done by appending malicious SQL queries to the vulnerable parameter in the URL. For example, http://[target]/page.phtml?id=-1'
The readfile function of CPE17 Autorun Killer <= 1.7.1 is vulnerable to a stack buffer overflow attack. An attacker can exploit this vulnerability by sending a specially crafted payload to the vulnerable application, which can lead to arbitrary code execution.
Wordpress 3.3.1 suffers from multiple CSRF vulnerabilities which allow an attacker to change post title, add administrators/users, delete administrators/users, approve and unapprove comment, delete comment, change background image, insert custom header image, change site title, change administrator's email, change Wordpress Address, change Site Address, when an authenticated user/admin browses a special crafted web page. May be other parameters can be modified. This vulnerability is caused by a security flaw in anti-CSRF token (_wpnonce, _wpnonce_create-user, _ajax_nonce, _wpnonce-custom-header-upload, _wpnonce-custom-background-upload, _wpnonce-update-blogoptions, _wpnonce-update-comment_status, _wpnonce-delete-comment, _wpnonce-delete-user, _wpnonce-delete-tag, _wpnonce-add-tag) implementation.
The 'id' parameter on the get_hours.php page is vulnerable to XSS and SQL Injection. No authentication is needed. This is a reflective XSS vulnerability.
Wordpress Zingiri Web Shop Plugin contains multiple XSS vulnerabilities. The 'page' variable in plugins/zingiri-web-shop/zing.inc.php is not properly sanitized before being used, allowing an attacker to inject malicious JavaScript code. Additionally, the 'notes' variable in fws/pages-front/onecheckout.php is also not properly sanitized before being used, allowing an attacker to inject malicious JavaScript code. This code can be stored in the database and executed when an administrator views the list of ordered items.
During backup procedures, PLESK panel is keeping a detailed log of the process under /opt/psa/PMM/sessions in Debian/Ubuntu installations and /usr/local/psa/PMM/sessions in Centos under the directory with the current date. A detailed log file is created with the name psadump.log, with readable permissions for everyone. The file will reveal the admin password used from the backup process to dump the mysql databases from the sites being backed up. It's possible to locate data also under the sessions directory from incomplete/crashed backup sessions where the log files are not safely removed from the system.
mount.cifs (GNU Software) is part of linux base system, and is setuided on most of the distributions (archlinux, debian, ubuntu, ...). This software mounts cifs partition to directories authorized by fstab. Althow there is not authorized cifs mounts, is possible by the second parameter to control a privileged chdir() syscall and infer the return value throught the responses. This implies, a little security breach on linux permissions. A non root user can enumerate files and directories as root. This can help to exploit another vulnerabilities, enumerate /root/ contents, descriptors used by any process, user homes, etc.
Services By CQR