CVE-2014-9560 Softbb.net SoftBB SQL Injection Security Vulnerabilities

Exploit Title: Softbb.net SoftBB /redir_last_post_list.php post Parameter SQL Injection

Product: SoftBB (mods)

Vendor: Softbb.net

Vulnerable Versions: v0.1.3

Tested Version: v0.1.3

Advisory Publication: Jan 10, 2015

Latest Update: Jan 10, 2015

Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

CVE Reference: CVE-2014-9560

CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0 

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

http://www.inzeed.com/kaleidoscope/sql-injection-vulnerability/cve-2014-9560-softbb-net-softbb-sql-injection-security-vulnerability/

CVE-2014-9561 Softbb.net SoftBB XSS (Cross-Site Scripting) Security Vulnerability

Exploit Title: Softbb.net SoftBB /redir_last_post_list.php post Parameter XSS

Product: SoftBB (mods)

Vendor: Softbb.net

Vulnerable Versions: v0.1.3

Tested Version: v0.1.3

Advisory Publication: Jan 10, 2015

Latest Update: Jan 10, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-9561

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/xss-vulnerability/cve-2014-9561-softbb-net-softbb-xss-cross-site-scripting-security-vulnerability/

CVE-2014-8752 JCE-Tech “Video Niche Script” XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-8752 JCE-Tech "Video Niche Script" XSS (Cross-Site Scripting) Web Application Zero Day Bug

Exploit Title: JCE-Tech "Video Niche Script" /view.php Multiple Parameters XSS

Product: "Video Niche Script"

Vendor: JCE-Tech

Vulnerable Versions: 4.0

Tested Version: 4.0

Advisory Publication: Nov 18, 2014

Latest Update: Nov 18, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8752

Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Advisory Details:

(1) Vendor & Product Description:


Vendor:

JCE-Tech

Product & Vulnerable Versions:
Video Niche Script
4.0



Vendor URL & Download:
Product can be obtained from here,
http://sourceforge.net/p/vufind/news/




Product Introduction Overview:

http://jce-tech.com/products/

Product Description:

"The PHP Video Script instantly creates a niche video site based on keywords users control via the admin console. The videos are displayed on users' site, but streamed from the YouTube servers."

(2) Vulnerability Details.

JCE-Tech "Video Niche Script" web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. JCE-Tech has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".

(2.1) The code flaw occurs at "view.php" page with "video", "title" parameter.

References:

http://marc.info/?l=full-disclosure&m=141896681915260&w=4

http://tetraph.com/security/cves/cve-2014-8752

http://computerobsess.blogspot.com/2015/02/cve-2014-8752-jce-tech-video-niche.html

http://seclists.org/fulldisclosure/2014/Dec/84

http://www.securityfocus.com/bid/71738

http://www.intelligentexploit.com/view-details.html?id=20454

http://packetstormsecurity.com/files/129661/JCE-Tech-4.0-Cross-Site-Scripting.html

http://en.hackdig.com/?11701.htm

http://www.inzeed.com/kaleidoscope/xss-vulnerability/cve-2014-8752

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01463.html

http://webtechhut.blogspot.com/2015/02/cve-2014-8752-jce-tech-video-niche.html
https://cxsecurity.com/issue/WLB-2014120154

http://whitehatpost.blog.163.com/blog/static/242232054201511095133273/#

https://tetraph.wordpress.com/2015/02/10/cve-2014-8752

CVE-2014-8490 TennisConnect COMPONENTS System XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-8490  TennisConnect COMPONENTS System XSS (Cross-Site Scripting) Web Application Zero Day Bug



Exploit Title: TennisConnect "TennisConnect COMPONENTS System" /index.cfm pid Parameter XSS
Product: TennisConnect COMPONENTS System
Vendor:    TennisConnect
Vulnerable Versions: 9.927
Tested Version:    9.927
Advisory Publication: Nov 18, 2014
Latest Update:    Nov 18, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-8490
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Advisory Details:

(1) Vendor & Product Description:


Vendor:
TennisConnect



Product & Vulnerable Versions:
TennisConnect COMPONENTS System
9.927


Vendor URL & Download:
Product can be obtained from here,
http://www.tennisconnect.com/products.cfm#Components



Product Description:
TennisConnect COMPONENTS
* Contact Manager (online player database)
* Interactive Calendar including online enrollment
* League & Ladder Management through Tencap Tennis
* Group Email (including distribution lists, player reports, unlimited sending volume and frequency)
* Multi-Administrator / security system with Page Groups
* Member Administration
* MobileBuilder
* Online Tennis Court Scheduler
* Player Matching (Find-a-Game)
* Web Site Builder (hosted web site and editing tools at www. your domain name .com)




(2) Vulnerability Details.
TennisConnect COMPONENTS System web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. TennisConnect COMPONENTS System has patched some of them. "Bugtraq is an electronic mailing list dedicated to issues about computer security. On-topic issues are new discussions about vulnerabilities, vendor security-related announcements, methods of exploitation, and how to fix them. It is a high-volume mailing list, and almost all new vulnerabilities are discussed there.". It has listed similar exploits, such as Bugtraq (Security Focus) 32920.

TennisConnect COMPONENTS System has a security problem. It is vulnerable to XSS attacks.

(2.1) The code flaw occurs at "/index.cfm?" page, with "&pid" parameter.








References:
http://packetstormsecurity.com/files/129662/TennisConnect-9.927-Cross-Site-Scripting.html
http://tetraph.com/security/cves/cve-2014-8490
https://cxsecurity.com/issue/WLB-2014120151
http://cve.scap.org.cn/CVE-2014-8490.html
http://en.hackdig.com/?11701.htm
http://webtechhut.blogspot.com/2015/02/cve-2014-8490-tennisconnect-components.html
http://seclists.org/fulldisclosure/2014/Dec/83
http://computerobsess.blogspot.com/2015/02/cve-2014-8490-tennisconnect-components.html
http://diebiyi.com/articles/security/xss-vulnerability/cve-2014-8490
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01464.html
https://progressive-comp.com/?l=full-disclosure&m=141896694615302&w=1
http://whitehatpost.blog.163.com/blog/static/2422320542015110102316210/#
http://tetraph.blogspot.com/2015/02/cve-2014-8490-tennisconnect-components.html
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1352

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

Exploit Title: “Ping Identity Corporation” “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability
Product: PingFederate 6.10.1 SP Endpoints
Vendor: Ping Identity Corporation
Vulnerable Versions: 6.10.1
Tested Version: 6.10.1
Advisory Publication: Dec 09, 2014
Latest Update: Dec 09, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8489
CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 10.0
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]








http://article.gmane.org/gmane.comp.security.fulldisclosure/1302/match=

CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Web Application Cyber Security Zero Day Bug

CVE-2014-8751  goYWP WebPress Multiple XSS (Cross-Site Scripting) Web Application Cyber Security Zero Day Bug

Exploit Title: goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Product: WebPress

Vendor: goYWP

Vulnerable Versions: 13.00.06

Tested Version: 13.00.06

Advisory Publication: December 09, 2014

Latest Update: January 01, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8751

Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Advisory Details:


(1) Vendor & Product Description:


Vendor:
goYWP



Product & Vulnerable Versions:
WebPress
13.00.06



Vendor URL & Download:
Product can be obtained from here,
http://www.goywp.com/view/cms
http://www.goywp.com/demo.php



Google Dork:
Powered by goYWP.com

Product Introduction:

“WebPress is the foundation on which we build web sites. It’s our unique Content Management System (CMS), flexible enough for us to build your dream site, and easy enough for you to maintain it yourself. Webpress online content payment utility fit goywp unique modules solutions interactive services tried-and-true combination tools education ywp nkpress nkpress th pay customers website services webpress bills allowing cms custom location ywp ywp our team history connect feedback featured sites client streetparagould area network blog facebook twitter linkedin flickr delicious myspace e-newsletter subscribe 112 ywp about nkpress about development web design flash applications mobile design custom networking e-commerce th programming social software interface upi websites great schools utilities sizes businesses creates client blog expectations approach area branding work featured add-on tons custom programming changing industry security offer management contact e-commerce granular integration.”

(2) Vulnerability Details:
WebPress web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. WebPress has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".

(2.1) The first security code flaw occurs at “/search.php” page with “&search_param” parameter in HTTP GET.

(2.2) The second security code flaw occurs at “/forms.php” (form submission ) page with “&name”, “&address” “&comment” parameters in HTTP POST.

References:

http://seclists.org/fulldisclosure/2014/Dec/34

http://www.cnvd.org.cn/flaw/show/CNVD-2014-09095

http://cxsecurity.com/issue/WLB-2014120057

http://packetstormsecurity.com/files/129443/goYWP-WebPress

http://marc.info/?l=full-disclosure&m=141815910228867&w=4

http://www.scap.org.cn/CVE-2014-8751.html
http://computerobsess.blogspot.com/2014/12/cve-2014-8751-goywp-webpress-multiple.html

http://advisories75.rssing.com/chan-6966477/all_p243.html#item4845

http://diebiyi.com/articles/security/xss-vulnerability/cve-2014-8751

https://computertechhut.wordpress.com/2014/12/29/cve-2014-8751

https://progressive-comp.com/?l=full-disclosure&m=141815910228867&w=1
http://germancast.blogspot.de/2014/12/goywp-xss-bug.html
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01415.html

CVE-2014-7291 Springshare LibCal XSS (Cross-Site Scripting) Web Application Zero Day Bug

Exploit Title: Springshare LibCal Multiple XSS (Cross-Site Scripting) Security Weakness
Product: LibCal
Vendor: Springshare
Vulnerable Versions: 2.0
Tested Version: 2.0
Advisory Publication: Nov 25, 2014
Latest Update: Nov 25, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-7291
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Solution Status: Fixed by Vendor
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)









Recommendation Details:


(1) Vendor & Product Description:


Vendor:
Springshare


Product & Vulnerable Versions:
LibCal
2.0

Vendor URL & download:

http://springshare.com/libcal/

Product Introduction Overview: “LibCal is an easy to use calendaring and event management platform for libraries. Used by 1,600+ libraries worldwide, LibCal makes it a breeze to manage online calendar of events, offer room bookings online, manage the opening hours for various locations."

    "Manage Calendar & Event Registrations
    Create custom Registration Forms
    Manage Consultation Appointments"
    Create an Online Room Booking System
    Display Library & Departmental Hours
    Share Calendar/Event Info via Widgets"




(2) Vulnerability Details: Springshare LibCal web application has a security bug problem. Hacker can exploit it by XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several Springshare LibCal products vulnerabilities have been found by some other bug hunter researchers before. Springshare LibCal has patched some of them. The MITRE Corporation is a not-for-profit company that operates multiple federally funded research and development centers (FFRDCs), which provide innovative, practical solutions for some of our nation's most critical challenges in defense and intelligence, aviation, civil systems, homeland security, the judiciary, healthcare, and cybersecurity. It has published suggestions, advisories, solutions details related to Springshare LibCal vulnerabilities.



(2.1) The first code programming flaw  occur at “/api_events.php?” page, with “&m” and “&cid” parameters.






(3) Solutions: 2014-10-01: Report vulnerability to Vendor 2014-10-15: Vendor replied with thanks and vendor changed the source code






 
References:

https://cxsecurity.com/issue/WLB-2014120002

http://seclists.org/fulldisclosure/2014/Nov/90

http://packetstormsecurity.com/files/129289/Springshare-LibCal-2.0

http://computerobsess.blogspot.com/2014/12/cve-2014-7291-springshare-libcal-xss.html

http://www.scap.org.cn/CVE-2014-7291.html

http://whitehatpost.blog.163.com/blog/static/2422320542014112982712/#

http://www.cnnvd.org.cn/vulnerability/show/cv_id/2014110532

http://webtechhut.blogspot.com/2014/12/cve-2014-7291-springshare-libcal-xss.html

http://www.cnvd.org.cn/flaw/show/CNVD-2014-08568

http://marc.info/?l=full-disclosure&m=141705590727919&w=4

http://www.inzeed.com/kaleidoscope/cves/cve-2014-7291
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01369.html

Newtelligence DasBlog CVE-2014-7292 Open Redirection Vulnerability

Newtelligence DasBlog CVE-2014-7292 Open Redirection Vulnerability



Bugtraq ID:     70654
Class:     Input Validation Error
CVE:     CVE-2014-7292
Remote:     Yes
Local:     No
Published:     Oct 20 2014 12:00AM
Updated:     Oct 20 2014 12:00AM
Credit:     Wang Jing





http://www.securityfocus.com/bid/70654