The administration interface has a login form with an username- and a passwordfield. Entering a valid username (default value is »esadmin«) and a very long string into the password field a buffer overflow is triggered. The function Java_com_ibm_es_oss_CryptionNative_ESEncrypt() defined in the file /opt/IBM/es/lib/libffq.cryptionjni.so is copying the password value to a fixed size buffer of 2048 bytes. There are two attack points to exploit this buffer overflow. The first attack is based on the following buffer combination password = 2080 bytes + firstattackpoint EAX+EDI (4 bytes). The inserted value for »firstattackpoint« will be used in the registers EAX and EDI. These registers are used to write data into. This means you can insert any arbitrary address, where you want to write to. The second attack is overwriting the saved return address and has the following layout. password = 2080 bytes + firstattackpoint EAX+EDI (4 bytes) + 480 bytes + EDX (4 bytes) + EAX (4 bytes) + EIP (4 bytes). To reach the return to your overwritten instruction pointer, you have to insert a valid writeable address as firstattackpoint. This second attack has some restrictions, you can only use printable ASCII values. Non printable characters will be removed from the input string. This is no real barrier, since the code is big enough to have many jmp/call addresses, which have printable ASCII values in their addresses. During the overwrite the register ESI is pointing to your input, so you could use a call *%esi to jump to your ASCII filtered shellcode. During the first attackpoint your input is unfiltered, you can insert arbitrary values. If you combine both attacks together, you can exploit it remotely and get a (root) shell. Default running user is root :)
The forms in the administrator interface are not protected against XSRF. The attacker can do any action in the context of the victim. An example attack scenario could be: The attacker creates a malicious website with a prepared form to add a new user, which will be submitted on load. The exploit code provided adds an admin user.
This exploit allows an attacker to change the admin password of the admin panel of osCommerce. After the password is changed, the attacker has all admin privileges.
An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable Joomla component (com_img) to read arbitrary files from the server. The vulnerable parameter is ‘controller’ which can be abused to traverse the directory structure and read any file on the server.
An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable application. The request contains a malicious SQL query in the 'catid' parameter of the 'index.php' script. This can allow the attacker to access the sensitive information stored in the back-end database.
An attacker can inject malicious HTML and XSS code into the vulnerable parameter 'id' of the btg_oglas component in Joomla. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
MySQL is prone to a denial-of-service vulnerability. An attacker can exploit this issue to crash the database, denying access to legitimate users.
Input passed to the 'q' parameter in when 'option' is set to 'com_jquarks4s' and 'task' to 'submitSurvey' is not properly verified before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
This exploit is used to gain access to the Woltlab Burning Board Userlocator V2.5 by exploiting a SQL injection vulnerability. The exploit requires the host name, path and ID of the target to be entered. The exploit then sends a request to the target with a malicious payload which is used to extract the username and password of the target. The exploit is written in Ruby.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Groupwise Internet Agent where IMAP services run. Authored by Francis Provencher from Protek Research Lab's, the exploit targets the IMAP LIST LSUB command. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the IMAP LIST LSUB command. By sending a specially crafted request, an attacker can cause a stack-based buffer overflow and execute arbitrary code.
Services By CQR