A SQL injection vulnerability exists in Joomla! Component JoomBlog v1.3.1. An attacker can send a specially crafted HTTP request to the vulnerable application in order to execute arbitrary SQL commands in the back-end database. This can potentially result in the manipulation or disclosure of application data.
The vulnerability is an Error Based Sql Injection which allows an attacker to inject malicious SQL queries into the vulnerable application. The vulnerable parameters are keywords, rctyp, token and id. The payload used is ') UNION ALL SELECT NULL,CONCAT(0x7171717671,0x5055787a7374645446494e58566e66484f74555968674d504262564348434b70657a4c45556b534e,0x716a626271)#
This module will generate a plugin, pack the payload into it and upload it to a server running Piwik. Superuser Credentials are required to run this module. This module does not work against Piwik 1 as there is no option to upload custom plugins. Tested with Piwik 2.14.0, 2.16.0, 2.17.1 and 3.0.1.
There is a use-after-free in TypedArray.sort. In TypedArrayCompareElementsHelper, the comparison function is called with the following code: Var retVal = CALL_FUNCTION(compFn, CallInfo(CallFlags_Value, 3), undefined, JavascriptNumber::ToVarWithCheck((double)x, scriptContext), JavascriptNumber::ToVarWithCheck((double)y, scriptContext)). Assert(TypedArrayBase::Is(contextArray[0])); if (TypedArrayBase::IsDetachedTypedArray(contextArray[0])) { JavascriptError::ThrowTypeError(scriptContext, JSERR_DetachedTypedArray, _u("[TypedArray].prototype.sort")); } if (TaggedInt::Is(retVal)) { return TaggedInt::ToInt32(retVal); } if (JavascriptNumber::Is_NoTaggedIntCheck(retVal)) { dblResult = JavascriptNumber::GetValue(retVal); } else { dblResult = JavascriptConversion::ToNumber_Full(retVal, scriptContext); }. The TypeArray is checked to see if it has been detached, but then the return value from the function is converted to an integer, which can invoke valueOf. If this function detaches the TypedArray, one swap is perfomed on the buffer after it is freed.
When the program is invoked on a system whose kernel does not support FUSE filesystems, ntfs-3g attempts to load the 'fuse' module using /sbin/modprobe via load_fuse_module(). An attacker can set the environment variable MODPROBE_OPTIONS to something like '-C /tmp/evil_config -d /tmp/evil_root' to force modprobe to load its configuration and the module from attacker-controlled directories. This allows a local attacker to load arbitrary code into the kernel.
The MemoryIntArray class allows processes to share an in-memory array of integers by transferring an ashmem file descriptor. As the class implements the Parcelable interface, it can be passed within a Parcel or a Bundle and transferred via binder to remote processes. The implementation of MemoryIntArray keeps track of the 'owner' of each instance by recording the pid of the creating process within the constructor and serializing it to the Parcel whenever the instance is marshalled. Moreover, each MemoryIntArray instance keeps an additional field, mMemoryAddr, denoting the address at which the array is mapped in memory. This field is also written to a Parcel whenever the instance is marshalled (therefore transferring instances of MemoryIntArray between processes automatically reveals information about the address-space of the sharing process, constituting an information-leak). When MemoryIntArray instances are deserialized, they perform a check to see whether or not the current process is the 'owner' process of the deserialized instance. If so, the transferred memory address in the parcel is used as the memory address of the shared buffer (as the address space in which the array was created is the same as the current address space). Since all of the fields above are simply written to a Parcel, they can be easily spoofed by an attacker to contain any value.
The lghashstorageserver binder service (/system/bin/lghashstorageserver) implementation on the LG G4 is vulnerable to path traversal, allowing an app to read and write 0x20 bytes from any file in the context of the lghashstorageserver. A proof-of-concept (PoC) is provided which reads from /proc/self/attr/current for the lghashstorageserver.
The lgdrmserver binder service (/system/bin/lgdrmserver) implements a handle system to store pointers to objects allocated by the drm implementation (/system/lib/liblgdrm.so). In several places, these handles are retrieved from a received binder Parcel, looked up in a SortedVector under a global lock, the lock is then released and the handle is passed to one of the DRM_xyz functions in liblgdrm.so which then uses the handle without holding any locks. The attached PoC simply creates a number of process instances using the function DRM_ProcessInit (lgdrm binder ordinal 2), then triggers the race condition by trying to cause a double free on one of these instances using DRM_ProcessEnd (lgdrm binder ordinal 8). This will result in heap corruption during the second call to DRM_ProcessEnd with the (now invalid) process object, which will eventually crash the lgdrmserver process (usually during a subsequent call to malloc).
The CentOS7's kernel is disrupted by vulnerability on rsyslog daemon, in which the cpu usage will be 100% until the remote exploit launches on the victim's server.
ShadeYou service executes any file path send through socket without verification as SYSTEM user.
Services By CQR