ZSL by Progressive Design

F.E.A.R. 2

Информациско безбедносна проценка на веб апликации (изучување на случај)

Информациско безбедносна проценка на веб апликации (изучување на случај)

View more documents from Zero Science Lab.

Imaginary Sight - Great Comsos

Upcoming security books proposals

Thwart malicious network intrusion by using cutting-edge techniques for finding and fixing security flaws. Fully updated and expanded with nine new chapters, Gray Hat Hacking: The Ethical Hacker’s Handbook, Third Edition details the most recent vulnerabilities and remedies along with legal disclosure methods. Learn from the experts how hackers target systems, defeat production schemes, write malicious code, and exploit flaws in Windows and Linux systems. Malware analysis, penetration testing, SCADA, VoIP, and Web security are also covered in this comprehensive resource.

* Develop and launch exploits using BackTrack and Metasploit
* Employ physical, social engineering, and insider attack techniques
* Build Perl, Python, and Ruby scripts that initiate stack buffer overflows
* Understand and prevent malicious content in Adobe, Office, and multimedia files
* Detect and block client-side, Web server, VoIP, and SCADA attacks
* Reverse engineer, fuzz, and decompile Windows and Linux software
* Develop SQL injection, cross-site scripting, and forgery exploits
* Trap malware and rootkits using honeypots and SandBoxes

http://zeroscience.mk/blog/01/2011/upcoming-security-books-proposals/

CultBooking Internet Booking Engine Multiple Vulnerabilities

Open source hotel booking system (Internet Booking Engine (IBE)). Via a central api called CultSwitch it is possible to make bookings and set the actual availabilities in the hotels pms. This is easy to install and easy to integrate with full support.

1. CultBooking suffers from a local file inlcusion/disclosure (LFI/FD) vulnerability when input passed thru the ‘lang’ parameter to cultbooking.php script is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes. Conditional on ‘magic_quotes_gpc=off’.

2. CultBooking Hotel Booking System suffers from a XSS/PD vulnerability when parsing user input to the ‘bookingcode’, ‘email’ and ‘lang’ parameter via POST and GET methods in cultbooking.php script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user’s browser session.

ZSL-2011-4987 – http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4987.php
ZSL-2011-4988 – http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4988.php


ref: http://zeroscience.mk/blog/01/2011/cultbooking-internet-booking-engine-multiple-vulnerabilities/

TV Nova - Gafovi (2011)

Embedthis Appweb Web Server 3.2.2-1 (Ejscript) Remote XSS Vulnerability

------------------------------------

Embedthis Appweb Web Server 3.2.2-1 (Ejscript) Remote XSS Vulnerability


Vendor: Embedthis Software LLC
Product web page: http://www.appwebserver.org, http://www.ejscript.org
Version affected: 3.2.2-1

Summary: Appweb has a multi-threaded, event-driven, core to deliver
exceptional throughput, response and outstanding memory utilization.
It is compact and will embed using as little as 800K of memory.

Desc: Appweb Web Server suffers from a remote reflected Cross-Site
Scripting vulnerability when input passed to the Ejscript web
framework is not properly sanitized, allowing the attacker to
execute arbitrary HTML and script code in a user's browser
session and aid in phishing attacks.

Tested on: Microsoft Windows XP Professional SP3 (EN)

Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.mk

Advisory ID: ZSL-2010-4985
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4985.php

12.10.2010


PoC:

http://localhost/ejs/%3Cscript%3Ealert%281%29%3C/script%3E

------------------------------------


http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4985.php

Digital Response

http://liquidworm.deviantart.com/art/Digital-Response-190632223

Undefined 0001

http://liquidworm.deviantart.com/art/Undefined-0001-189090295

Native Instruments Multiple Products Multiple Vulnerabilities

Zero Science Lab has discovered multiple vulnerabilities in various products developed by Native Instruments. Upon the discoveries, we’ve contacted the vendor to report all the issues. Their technical support, at first, were confused about our e-mail sent to them, thinking that we have troubles using their software. As we explained to them in details in the next e-mail, about QA, about security bulletins, about public disclosure policy, the security industry etc. they finally forwarded the conversation e-mails to the “corresponding” department, which we think that they don’t even have any related team to respond for these kind of incidents. Anywayz, no one shows interest from Native Instruments, thus are informed about the date of public disclosure (this post).


http://zeroscience.mk/blog/11/2010/native-instruments-multiple-products-multiple-vulnerabilities/

Eevaan Wepah

eXV² Content Management System 2.10 Remote XSS Vulnerability

eXV² Content Management System 2.10 Remote XSS Vulnerability


Vendor: eXV² Team
Product web page: http://www.exv2.de
Affected version: 2.10 (LiveCD)

Summary: eXV² is a free CMS for building and operating private
home pages, small and large communities and it's also easily
used for small to medium business presences.

Desc: The CMS suffers from a remote reflected Cross-Site Scripting
vulnerability when input passed thru "rssfeedURL" and "subm" parameter
in "archive.php", "topics.php", "example.php" and "index.php" is not
sanitized, allowing the attacker to execute arbitrary HTML and script
code in a user's browser session and aid in phishing attacks.

Tested on: Microsoft Windows XP Pro (EN)
Apache 2.2.14 (Win32)
MySQL 5.1.41
PHP 5.3.1

Vendor status: [09.10.2010] Vulnerability discovered.
[10.10.2010] Contact with the vendor.
[14.10.2010] No reply from vendor.
[15.10.2010] Public advisory released.

Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.mk

Advisory ID: ZSL-2010-4970
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4970.php

Patch+Advisory+Zen Cart+t00t

Тимот на Zen Ventures (http://www.zen-cart.com) во соработка со Zero Science Lab, објави безбедносни закрпи за заштита на своите корисници. Најновата верзија, 1.3.9g, објавена на 29.09.2010 е подобрената верзија од 1.3.9f, во која имаше ранливости од типот XSS, SQLi и LFI/FD.


Zen Cart безбедносни предупредувања и закрпи


;)

MoodBoard

Ref: http://liquidworm.deviantart.com/gallery/

MySource Matrix 3.28.3 (height) Remote Reflected XSS Vulnerability

Title:

MySource Matrix 3.28.3 (height) Remote Reflected XSS Vulnerability




Vendor:

Squiz Pty Ltd. - http://www.squiz.net
http://www.matrix.squiz.net/

Summary:

MySource Matrix is a powerful Open Source Content Management System
(CMS) written in PHP and is suitable for many types of organisations.


Description:

Input passed via the "height" parameter to char_map.php is not properly
sanitised before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context of an
affected site.


Tested on:

MS WinXP Pro SP3 (EN)
PHP 5.3.0
MySQL 5.1.36
Apache 2.2.11 (Win32)


Version affected:

3.28.3


Vulnerable lines:

182: // <?php echo $_REQUEST['width'];?>;
183: // <?php echo $_REQUEST['height'];?>;


Solution:

Existing users can remove the two commented out lines from:
/path/to/matrix/fudge/wysiwyg/plugins/special_chars/char_map.php (lines 182 and 183)


Vendor status:

[05.09.2010] Vulnerability discovered.
[06.09.2010] Vendor contacted.
[06.09.2010] Vendor replied asking details.
[06.09.2010] Sent analysis report to vendor.
[06.09.2010] Vendor verifies vulnerability.
[06.09.2010] Vendor releases fix versions 3.26.8 and 3.28.4.
[06.09.2010] Public advisory released.


Vulnerability discovered by:

Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
http://www.zeroscience.mk


Zero Science Lab Advisory ID:

ZSL-2010-4962


Advisory URL:

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4962.php



PoC:

http://200.200.200.200/fudge/wysiwyg/plugins/special_chars/char_map.php?width=233%3C/script%3E&height=233%3Cscript%3Ealert%28%27zsl%27%29%3C%2fscript%3E

Mack the Knife

Time is on my side by teppei

http://liquidworm.deviantart.com/art/Time-is-on-my-side-by-teppei-176951584

SmartCode ServerX VNC Server ActiveX 1.1.5.0 (scvncsrvx.dll) DoS Exploit

Title: SmartCode ServerX VNC Server ActiveX 1.1.5.0 (scvncsrvx.dll) DoS Exploit


Vendor: SmartCode Solutions
Product Web Page: htt://www.s-code.com
Version Tested: 1.1.5.0

Summary: SmartCode ServerX VNC Server control is a VNC server implemented as an
ActiveX component, which makes it extremely easy for you to integrate VNC support
into your Web or desktop applications. In the simplest scenario, you would add the
ServerX ActiveX component to your project, place the ServerX instance in a form,
and modify the ActiveX properties if desired. That's it - you just created an
application with a VNC Server embedded in it.

Desc: The vulnerability exist in the CSC_ServerXControl class with all its members.
When parsing overly long string while listening for incoming connection the application
crashes along with IE, corrupting the memory.

--

(26d8.25bc): C++ EH exception - code e06d7363 (first chance)
CSC_ServerXControl::FinalRelease
eax=00000000 ebx=00000000 ecx=7c800000 edx=7c97b120 esi=7c90de50 edi=00000000
eip=7c90e4f4 esp=0013fe5c ebp=0013ff58 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
7c90e4f4 c3 ret

--

Tested On: Microsoft Windows XP Professional SP3 (EN)
Windows Internet Explorer 8.0.6001.18702

Zero Science Lab Advisory ID: ZSL-2010-4948
Zero Science Lab Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4948.php


Vulnerability Discovered By: Gjoko 'LiquidWorm' Krstic
liquidworm gmail com

Zero Science Lab - http://www.zeroscience.mk

13.08.2010

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4948.php

Avatar Game