Upcoming security books proposals

Thwart malicious network intrusion by using cutting-edge techniques for finding and fixing security flaws. Fully updated and expanded with nine new chapters, Gray Hat Hacking: The Ethical Hacker’s Handbook, Third Edition details the most recent vulnerabilities and remedies along with legal disclosure methods. Learn from the experts how hackers target systems, defeat production schemes, write malicious code, and exploit flaws in Windows and Linux systems. Malware analysis, penetration testing, SCADA, VoIP, and Web security are also covered in this comprehensive resource.

* Develop and launch exploits using BackTrack and Metasploit
* Employ physical, social engineering, and insider attack techniques
* Build Perl, Python, and Ruby scripts that initiate stack buffer overflows
* Understand and prevent malicious content in Adobe, Office, and multimedia files
* Detect and block client-side, Web server, VoIP, and SCADA attacks
* Reverse engineer, fuzz, and decompile Windows and Linux software
* Develop SQL injection, cross-site scripting, and forgery exploits
* Trap malware and rootkits using honeypots and SandBoxes

http://zeroscience.mk/blog/01/2011/upcoming-security-books-proposals/

CultBooking Internet Booking Engine Multiple Vulnerabilities

Open source hotel booking system (Internet Booking Engine (IBE)). Via a central api called CultSwitch it is possible to make bookings and set the actual availabilities in the hotels pms. This is easy to install and easy to integrate with full support.

1. CultBooking suffers from a local file inlcusion/disclosure (LFI/FD) vulnerability when input passed thru the ‘lang’ parameter to cultbooking.php script is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes. Conditional on ‘magic_quotes_gpc=off’.

2. CultBooking Hotel Booking System suffers from a XSS/PD vulnerability when parsing user input to the ‘bookingcode’, ‘email’ and ‘lang’ parameter via POST and GET methods in cultbooking.php script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user’s browser session.

ZSL-2011-4987 – http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4987.php
ZSL-2011-4988 – http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4988.php


ref: http://zeroscience.mk/blog/01/2011/cultbooking-internet-booking-engine-multiple-vulnerabilities/

TV Nova - Gafovi (2011)