|
 |
| SecurityReason | ||
| WLB | ||
| RSS | ||
| Corporate | ||
| Services | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
| Details : SecurityAlert | ||||
 SecurityAlert : 4003 CVE : CVE-2008-3191 CWE : Not in CWE SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : No Exploit Given : Yes Credit : CWH Underground Published : 17.07.2008
Advisory Text : ================================================= MFORUM 0.1a Arbitrary Add-Admin Vulnerability ================================================= ,--^----------,--------,-----,-------^--, | ||||||||| `--------' | O .. CWH Underground Hacking Team .. `+---------------------------^----------| `\_,-------, _________________________| / XXXXXX /`| / / XXXXXX / `\ / / XXXXXX /\______( / XXXXXX / / XXXXXX / (________( `------' AUTHOR : CWH Underground DATE : 13 July 2008 SITE : cwh.citec.us ########################################################################### ######## APPLICATION : MFORUM VERSION : 0.1a DOWNLOAD : http://downloads.sourceforge.net/marcioforum/mforum.zip ########################################################################### ######## --- Add-Admin Exploit --- ***magic_quotes_gpc = off*** ------------- Description ------------- MFORUM 0.1a has Vulnerability to escalate user's privilege to administartor's privilege. That Vulnerable in "Control Panel - Edit your profile" (http://[Target]/[mforum_path]/usercp.php?mode=edit_profile) and you can injection code into various field (City, Interest, Email, Icq, msn, Yahoo Messenger). This action will give your account can use Admin Control Panel (http://[Target]/[mforum_path]/admin/index.php) with Administrative's Privilege. ----------------- Vulnerable Path ----------------- [+] http://[target]/[mforum_path]/usercp.php?mode=edit_profile -------------- Exploit code -------------- [+] hacked", type="2 ##################################################################### Greetz : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos ##################################################################### References : http://xforce.iss.net/xforce/xfdb/43757 http://www.securityfocus.com/bid/30214 http://www.milw0rm.com/exploits/6068 Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
*BSD libc (strfmon) Multiple vulnerabilities
Maksymilian Arciemowicz discovered a Integer Overflow vulnerability in the libc library "strfmon()" function.A vulnerability could allow an attacker who successfully exploits this vulnerability to take control of the affected *BSD systems. |
||
| Apache |  |
|
» Apache Tomcat <= |
||
| PHP | |
|
» PHP 5.2.5 and prior : |
||
- 2008-03-25| Copyright © SecurityReason. All Rights Reserved. |