On the login page, an attacker can enter 'admin' as the username and 'or '1'='1' as the password to bypass authentication.
This control contains 19 members, as follow: Members: 19 URL Language UnicodeURL ZoomOutput ViewOutput View_ContinuousOutput UpdateURL DownloadURL m_ViewDir RequiredVersion Zoom View Rotate GoTo Open Close UILanguage Print DRMRights Particularly this one "URL" results vulnerable to a buffer overflow if you pass an overly long string (more than 2048 bytes) as filename and browse to the crafted web page (e.g. http://www.SomeSite.com/File.pdf) and then refresh the page.
A Cross-Site Scripting (XSS) vulnerability exists in ORACLE Business Process Management (Process Administrator) version 5.7-6.0-10.3 +MP's. The vulnerability is due to insufficient sanitization of user-supplied input in the web-based user interface for managing the process execution environment, including process definitions, process instances, and process services. An attacker can exploit this vulnerability by sending a maliciously crafted request to the vulnerable application. Successful exploitation could result in the execution of arbitrary HTML and script code in the context of the affected application.
The parameters viewform and id are not properly sanitised before being used in a SQL query. Successful exploitation requires that 'magic_quotes_gpc' is disabled.
The user Proxy feature of Novell GroupWise WebAccess is vulnerable to a stack overflow exploit. An authenticated user could potentially trigger and execute arbitrairy code on the server.
eXtreme Message Board 1.9.11 is vulnerable to multiple CSRF vulnerabilities. An attacker can exploit these vulnerabilities to change the admin password, set a custom post number and status for the admin user.
Ad Network Script is developed in PHP and uses a MySQL database. Ad Network Script allows you to run your own ads network similar to adengage.com or adbrite.com. An attacker can exploit a persistent XSS vulnerability by registering on the website and then navigating to the directory page. On the directory page, the attacker can insert malicious code into the “Ad Text” and “Ad Headline” fields. The malicious code will then be executed when the page is viewed by other users.
The vulnerability exists due to failure in the "/admin/helper/deleteArticle.php" script to properly sanitize user-supplied input in "id" variable. Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database. Attacker can use browser to exploit this vulnerability.
This is an exploit for MS10-038/CVE-2010-0822. It is a buffer overflow exploit that is hardcoded for Windows XP SP3. The exploit is in the form of an Excel file, which is hosted on krash.in. The Office 2007 version is 12.0.4518.1014, although the MS10-038 bulletin states that Office 2007 is not vulnerable. The exploit is written in Python and uses binascii to convert a hex string to a binary string.
Apache Struts team has announced uploaded but has not released, due to an unreasonably prolonged voting process, the 2.2.0 release of the Struts2 web framework which fixes vulnerability that I've reported to them on May 31st 2010. Apache Struts team is ridiculously slow in releasing the fixed version and all of my attempts to expedite the process have failed. Struts2 is Struts + WebWork. WebWork in turn uses XWork to invoke actions and call appropriate setters/getters based on HTTP parameter names, which is achieved by treating each HTTP parameter name as an OGNL statement. OGNL (Object Graph Navigation Language) is what turns user.address.city=Bishkek&user['favoriteDrink']=kumys into action.getUser().getAddress().setCity("Bishkek") action.getUser().setFavoriteDrink("kumys"). This is performed by the ParametersInterceptor, which calls ValueStack.setValue() with user-supplied HTTP parameters as arguments. In addition to property getting/setting, OGNL supports many more features such as method calling, static method calling, constructor calling, ability to work with context variables, and more. Since HTTP parameter names are OGNL statements, to prevent an attacker from calling arbitrary methods via HTTP parameters XWork has the following two variables guarding methods execution: OgnlContext's property 'xwork.MethodAccessor.denyMethodExecution' (set to true by default) and SecurityMemberAccess private field called 'allowStaticMethodAccess' (set to false by default). OGNL Context variables make it easier for developer to access various freqently used objects, OGNL context has a set of predefined variables. One of them is 'context' which is an instance of ActionContext. ActionContext in turn has a reference to ValueStack.
Services By CQR