A buffer overflow vulnerability exists in Sam Spade 1.14 when a maliciously crafted file is processed. An attacker can exploit this vulnerability to execute arbitrary code in the context of the application. The vulnerability is due to a lack of proper validation of user-supplied input when processing a file. An attacker can exploit this vulnerability by enticing a user to process a maliciously crafted file.
The vulnerability exists due to failure in the "/admin/pages/maintenance" script to properly verify the source of the HTTP request. A remote attacker can trick a logged-in administrator to visit a page with CSRF exploit and put the entire website under maintenance. Additionally, the attacker is able to inject arbitrary HTML and JavaScript code into maintenance message and execute it in browsers of any website visitor. Successful exploitation of this vulnerability may allow an attacker to steal other users’ cookies, spread malware to website visitors, and even obtain full control over vulnerable website.
The NtCreateLowBoxToken system call accepts an array of handles which are stored with the new token. This is presumably for maintaining references to the appcontainer specific object directories and symbolic links so that they do not need to be maintained anywhere else. The function, SepReferenceLowBoxObjects which captures the handles has a couple of issues which can lead to abuse: 1) It calls ZwDuplicateObject which means the API can capture kernel handles as well as user handles. 2) No checks are made on what object types the handles represent. The fact that kernel handles can be captured isn’t as bad as it could be. As far as I can tell there’s no way of getting the handles back. The second issue though is slightly more serious as it allows a user to create a reference cycle to kernel objects and potentially maintain them indefinitely, at least until a reboot.
The editor delivered with Pligg CMS is vulnerable to directory traversal, which gives an attacker that obtained admin credentials the opportunity to view any file stored on the webserver that the webserver user has access to.
A vulnerability in the lquerylv command of IBM AIX 7.1 allows local users to gain root privileges by creating a symbolic link from /etc/suid_profile to /tmp/DEBUGCMD, and then executing the lquerylv command. This exploit uses the _DBGCMD_LQUERYLV environment variable to execute the suid_profile script, which creates a root shell in /tmp/r00tshell and sets the permissions to 6755.
Hitron routers provide an interface to test connectivity (ping, tracert) via the graphical user interface of the router (Management UI). This interface is vulnerable to code injection using the && argument after the IP address.
PHP Server Monitor uses level 20 for basic user and level 10 for Admins these are stored in Database. Basic users can elevate thier privileges to that of Administrator by crafting an HTTP payload changing their level to '10' then getting an Administrator to click an infected link or visit a malicious website to launch an CSRF attack which will grant the user admin access. This problem is due to no CSRF protection mechanism in place.
The vulnerability affects eBay Magento applications served with PHP FPM. The vulnerability can be exploited by an attacker to read arbitrary files on the server, and in some cases (e.g. when an 'expect' PHP module is installed) lead to command execution.
Reach, engage and delight more customers with newsletters, auto-responders or campaign management. An attacker can exploit a SQL injection vulnerability in the Joomla component com_jnews. The vulnerable parameter is sub_list_id[1] which needs to be encoded when exploited as: sub_list_id%5B1%5D. The vector for exploitation is sub_list_id%5B1%5D=1[SQLi]. A proof of concept for exploitation is boolean-based blind, where the attacker can inject a payload such as RLIKE (SELECT (CASE WHEN (7097=7097) THEN 1 ELSE 0x28 END))&acc_level[1]=29&passwordA=0oYmqypNqP6eU&fromFrontend=1&act=subscribe&subscriber_id=0&user_id=0&option=com_jnews&task=save&boxchecked=0&Itemid=188&d65abd4ca0e24f5d3e5af6b5c390ae17=1.
Sam Spade 1.14 is vulnerable to a SEH overflow vulnerability when a maliciously crafted file is opened. When the file is opened, the SEH chain is overwritten and the application crashes.
Services By CQR