CVE-2015-2066 - DLGuard SQL Injection Web Security Vulnerabilities

CVE-2015-2066 - DLGuard SQL Injection Web Security Vulnerabilities

Exploit Title: CVE-2015-2066 DLGuard /index.php c parameter SQL Injection Web Security Vulnerabilities

Product: DLGuard

Vendor: DLGuard

Vulnerable Versions: v4.5

Tested Version: v4.5

Advisory Publication: February 18, 2015

Latest Update: May 01, 2015

Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [CWE-89]

CVE Reference: CVE-2015-2066

CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

Writer and Reporter: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Caution Details:

(1) Vendor & Product Description:

Vendor:

DLGuard

Product & Version:

DLGuard

v4.5

Vendor URL & Download:

DLGuard can be downloaded from here,

http://www.dlguard.com/dlginfo/index.php

Product Introduction Overview:

“DLGuard is a powerful, yet easy to use script that you simply upload to your website and then rest assured that your internet business is not only safe, but also much easier to manage, automating the tasks you just don't have the time for."

"DLGuard supports the three types, or methods, of sale on the internet:

<1>Single item sales (including bonus products!)

<2>Multiple item sales

<3>Membership websites"

"DLGuard is fully integrated with: PayPal, ClickBank, 2Checkout, Authorize.Net, WorldPay, AlertPay, Ebay, PayDotCom, E-Gold, 1ShoppingCart, Click2Sell, Mal's E-Commerce, LinkPoint, PagSeguro, CCBill, CommerseGate, DigiResults, FastSpring, JVZoo, MultiSafePay, Paypal Digital Goods, Plimus, RevenueWire/SafeCart, SWReg, WSO Pro, and even tracks your free product downloads. The DLGuard built-in Shopping Cart offers Paypal, Authorize.net, and 2Checkout payment options. The Membership areas allow Paypal, Clickbank, 2Checkout, and LinkPoint recurring billing as well as linking to any PayPal, ClickBank, 2Checkout, Authorize.Net, WorldPay, AlertPay, Ebay, PayDotCom, E-Gold, 1ShoppingCart, E-Bullion, LinkPoint, PagSeguro, CCBill, CommerseGate, DigiResults, FastSpring, JVZoo, MultiSafePay, Paypal Digital Goods, Plimus, RevenueWire/SafeCart, SWReg, WSO Pro single sale and free products so that people who buy your products can access your members area. DLGuard is the perfect solution to secure your single sale item, such as a niche marketing website, software sales, ebook sales, and more! DLGuard not only protects your download page, but it makes setting up new products, or making changes to existing products so much quicker and easier than before."

(2) Vulnerability Details:

DLGuard web application has a computer security bug problem. It can be exploited by SQL Injection attacks. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Several similar products vulnerabilities have been found by some other bug hunter researchers before. DLguard has patched some of them. The MITRE Corporation is a not-for-profit company that operates multiple federally funded research and development centers (FFRDCs), which provide innovative, practical solutions for some of our nation's most critical challenges in defense and intelligence, aviation, civil systems, homeland security, the judiciary, healthcare, and cybersecurity. It has phase, votes, comments and proposed details related to important vulnerabilities.

(2.1) The bug programming flaw vulnerability occurs at "&c" parameter in “index.php?” page.

 

References:

http://seclists.org/fulldisclosure/2015/Feb/69

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01703.html

https://progressive-comp.com/?a=139222176300014&r=1&w=1%E2%80%8B

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1607

http://lists.openwall.net/full-disclosure/2015/02/18/6

http://marc.info/?a=139222176300014&r=1&w=4

http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/sql-injection-vulnerability/

https://plus.google.com/u/0/107140622279666498863/posts/44pDNaZao8v

https://inzeed.wordpress.com/2015/05/10/cve-2015-2066-dlguard

http://shellmantis.tumblr.com/post/118658089031/inzeed-cve-2015-2066

http://tetraphlike.lofter.com/post/1cf5a072_6ea70f7

http://russiapost.blogspot.ru/2015/05/cve-2015-2066-dlguard-sql-injection-web.html21

https://www.facebook.com/computersecurities/posts/375386899314769

http://blog.163.com/greensun_2006/blog/static/11122112201541193421290/

https://twitter.com/tetraphibious/status/597577800023838720

http://www.weibo.com/3973471553/Chj5OFIPk?from=page_1005053973471553

http://www.tetraph.com/blog/sql-injection-vulnerability/cve-2015-2066

http://www.inzeed.com/kaleidoscope/sql-injection-vulnerability/cve-2015-2066

ESPN Are Suffering Serious XSS and Dest Redirect Privilege Escalation Security Vulnerabilities

ESPN Are Suffering Serious XSS and Dest Redirect Privilege Escalation Security Vulnerabilities

Popular ESPN website (espn.go.com) has been found to be vulnerable to multiple serious XSS and Dest Redirect Privilege Escalation security vulnerabilities according to Jing Wang, a mathematics student from the School of Physical and Mathematical Sciences at Nanyang Technological University in Singapore.

Wang found a large number of ESPN’s credible links were vulnerable to XSS and Dest Redirect Privilege Escalation attacks. These vulnerabilities occur at ESPN’s “login” & “register” pages.

ESPN is one of the most common U.S.-based cable and satellite TV channel with close to 100 million subscribers. Its Alexa global rank is 63 and US rank is 14. Based on eBizMBA, “As of December 1, 2014, ESPN has an estimated 80,000,000 unique monthly visitors.” At the same time, ESPN broadcasts in more than 200 countries.

Wang posted his findings on the Full Disclosure forum. He wrote that he had reported the issues to ESPN in early May 2014 but the vulnerabilities are still unpatched. According to Wang, “Those vulnerabilities are very dangerous. Since they happen at ESPN’s “login” & “register” pages that are credible. Attackers can abuse those links to mislead ESPN’s users. The success rate of attacks may be high.“


Proof of concept videos have also been released on YouTube to illustrate an attack.

(1)XSS DEMO
https://www.youtube.com/watch?v=gGEZO8wbTBU

(2)Dest Redirect Privilege Escalation DEMO
https://www.youtube.com/watch?v=lCvBt8Elj9w

According to OWASP, “XSS allows attackers to execute scripts in the victims browser which can hijack user sessions, deface websites or redirect the user to malicious sites.” While Dest Redirect Privilege Escalation “is used in phishing attacks to get users to visit malicious sites without realizing it.”
If ESPN’s users were exploited, attackers can get their identity. Those attacks can also be used to steal password, perform denial of service attacks, spy users’ habits, alter browser functionality, access sensitive information and so on.

Wang wrote his tests were using Firefox (33.0) in Ubuntu (14.04) and IE (8.0. 7601) in Windows 8. And the attack could work without a user being logged in. 

CVE-2014-8752 JCE-Tech “Video Niche Script” XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-8752 JCE-Tech "Video Niche Script" XSS (Cross-Site Scripting) Web Application Zero Day Bug

Exploit Title: JCE-Tech "Video Niche Script" /view.php Multiple Parameters XSS

Product: "Video Niche Script"

Vendor: JCE-Tech

Vulnerable Versions: 4.0

Tested Version: 4.0

Advisory Publication: Nov 18, 2014

Latest Update: Nov 18, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8752

Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Advisory Details:

(1) Vendor & Product Description:


Vendor:

JCE-Tech

Product & Vulnerable Versions:
Video Niche Script
4.0



Vendor URL & Download:
Product can be obtained from here,
http://sourceforge.net/p/vufind/news/




Product Introduction Overview:

http://jce-tech.com/products/

Product Description:

"The PHP Video Script instantly creates a niche video site based on keywords users control via the admin console. The videos are displayed on users' site, but streamed from the YouTube servers."

(2) Vulnerability Details.

JCE-Tech "Video Niche Script" web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. JCE-Tech has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".

(2.1) The code flaw occurs at "view.php" page with "video", "title" parameter.

References:

http://marc.info/?l=full-disclosure&m=141896681915260&w=4

http://tetraph.com/security/cves/cve-2014-8752

http://computerobsess.blogspot.com/2015/02/cve-2014-8752-jce-tech-video-niche.html

http://seclists.org/fulldisclosure/2014/Dec/84

http://www.securityfocus.com/bid/71738

http://www.intelligentexploit.com/view-details.html?id=20454

http://packetstormsecurity.com/files/129661/JCE-Tech-4.0-Cross-Site-Scripting.html

http://en.hackdig.com/?11701.htm

http://www.inzeed.com/kaleidoscope/xss-vulnerability/cve-2014-8752

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01463.html

http://webtechhut.blogspot.com/2015/02/cve-2014-8752-jce-tech-video-niche.html
https://cxsecurity.com/issue/WLB-2014120154

http://whitehatpost.blog.163.com/blog/static/242232054201511095133273/#

https://tetraph.wordpress.com/2015/02/10/cve-2014-8752

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

Exploit Title: “Ping Identity Corporation” “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability
Product: PingFederate 6.10.1 SP Endpoints
Vendor: Ping Identity Corporation
Vulnerable Versions: 6.10.1
Tested Version: 6.10.1
Advisory Publication: Dec 09, 2014
Latest Update: Dec 09, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8489
CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 10.0
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]








http://article.gmane.org/gmane.comp.security.fulldisclosure/1302/match=

CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Web Application Cyber Security Zero Day Bug

CVE-2014-8751  goYWP WebPress Multiple XSS (Cross-Site Scripting) Web Application Cyber Security Zero Day Bug

Exploit Title: goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Product: WebPress

Vendor: goYWP

Vulnerable Versions: 13.00.06

Tested Version: 13.00.06

Advisory Publication: December 09, 2014

Latest Update: January 01, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8751

Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Advisory Details:


(1) Vendor & Product Description:


Vendor:
goYWP



Product & Vulnerable Versions:
WebPress
13.00.06



Vendor URL & Download:
Product can be obtained from here,
http://www.goywp.com/view/cms
http://www.goywp.com/demo.php



Google Dork:
Powered by goYWP.com

Product Introduction:

“WebPress is the foundation on which we build web sites. It’s our unique Content Management System (CMS), flexible enough for us to build your dream site, and easy enough for you to maintain it yourself. Webpress online content payment utility fit goywp unique modules solutions interactive services tried-and-true combination tools education ywp nkpress nkpress th pay customers website services webpress bills allowing cms custom location ywp ywp our team history connect feedback featured sites client streetparagould area network blog facebook twitter linkedin flickr delicious myspace e-newsletter subscribe 112 ywp about nkpress about development web design flash applications mobile design custom networking e-commerce th programming social software interface upi websites great schools utilities sizes businesses creates client blog expectations approach area branding work featured add-on tons custom programming changing industry security offer management contact e-commerce granular integration.”

(2) Vulnerability Details:
WebPress web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. WebPress has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".

(2.1) The first security code flaw occurs at “/search.php” page with “&search_param” parameter in HTTP GET.

(2.2) The second security code flaw occurs at “/forms.php” (form submission ) page with “&name”, “&address” “&comment” parameters in HTTP POST.

References:

http://seclists.org/fulldisclosure/2014/Dec/34

http://www.cnvd.org.cn/flaw/show/CNVD-2014-09095

http://cxsecurity.com/issue/WLB-2014120057

http://packetstormsecurity.com/files/129443/goYWP-WebPress

http://marc.info/?l=full-disclosure&m=141815910228867&w=4

http://www.scap.org.cn/CVE-2014-8751.html
http://computerobsess.blogspot.com/2014/12/cve-2014-8751-goywp-webpress-multiple.html

http://advisories75.rssing.com/chan-6966477/all_p243.html#item4845

http://diebiyi.com/articles/security/xss-vulnerability/cve-2014-8751

https://computertechhut.wordpress.com/2014/12/29/cve-2014-8751

https://progressive-comp.com/?l=full-disclosure&m=141815910228867&w=1
http://germancast.blogspot.de/2014/12/goywp-xss-bug.html
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01415.html

CVE-2014-7291 Springshare LibCal XSS (Cross-Site Scripting) Web Application Zero Day Bug

Exploit Title: Springshare LibCal Multiple XSS (Cross-Site Scripting) Security Weakness
Product: LibCal
Vendor: Springshare
Vulnerable Versions: 2.0
Tested Version: 2.0
Advisory Publication: Nov 25, 2014
Latest Update: Nov 25, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-7291
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Solution Status: Fixed by Vendor
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)









Recommendation Details:


(1) Vendor & Product Description:


Vendor:
Springshare


Product & Vulnerable Versions:
LibCal
2.0

Vendor URL & download:

http://springshare.com/libcal/

Product Introduction Overview: “LibCal is an easy to use calendaring and event management platform for libraries. Used by 1,600+ libraries worldwide, LibCal makes it a breeze to manage online calendar of events, offer room bookings online, manage the opening hours for various locations."

    "Manage Calendar & Event Registrations
    Create custom Registration Forms
    Manage Consultation Appointments"
    Create an Online Room Booking System
    Display Library & Departmental Hours
    Share Calendar/Event Info via Widgets"




(2) Vulnerability Details: Springshare LibCal web application has a security bug problem. Hacker can exploit it by XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several Springshare LibCal products vulnerabilities have been found by some other bug hunter researchers before. Springshare LibCal has patched some of them. The MITRE Corporation is a not-for-profit company that operates multiple federally funded research and development centers (FFRDCs), which provide innovative, practical solutions for some of our nation's most critical challenges in defense and intelligence, aviation, civil systems, homeland security, the judiciary, healthcare, and cybersecurity. It has published suggestions, advisories, solutions details related to Springshare LibCal vulnerabilities.



(2.1) The first code programming flaw  occur at “/api_events.php?” page, with “&m” and “&cid” parameters.






(3) Solutions: 2014-10-01: Report vulnerability to Vendor 2014-10-15: Vendor replied with thanks and vendor changed the source code






 
References:

https://cxsecurity.com/issue/WLB-2014120002

http://seclists.org/fulldisclosure/2014/Nov/90

http://packetstormsecurity.com/files/129289/Springshare-LibCal-2.0

http://computerobsess.blogspot.com/2014/12/cve-2014-7291-springshare-libcal-xss.html

http://www.scap.org.cn/CVE-2014-7291.html

http://whitehatpost.blog.163.com/blog/static/2422320542014112982712/#

http://www.cnnvd.org.cn/vulnerability/show/cv_id/2014110532

http://webtechhut.blogspot.com/2014/12/cve-2014-7291-springshare-libcal-xss.html

http://www.cnvd.org.cn/flaw/show/CNVD-2014-08568

http://marc.info/?l=full-disclosure&m=141705590727919&w=4

http://www.inzeed.com/kaleidoscope/cves/cve-2014-7291
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01369.html