Tuesday, 10 February 2015

CVE-2014-9559 SnipSnap XSS (Cross-Site Scripting) Security Web Application Zero Day Bug

keyboard and lock 





















 CVE-2014-9559 SnipSnap XSS (Cross-Site Scripting) Security Web Application Zero Day Bug
Exploit Title: SnipSnap /snipsnap-search? query Parameter XSS
Product: SnipSnap
Vulnerable Versions: 0.5.2a  1.0b1  1.0b2
Tested Version: 0.5.2a  1.0b1  1.0b2
Advisory Publication: Jan 30, 2015
Latest Update: Jan 30, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-9559
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)




Advisory Details:
(1) Vendor & Product Description
Vendor: 
SnipSnap

Product & Version: 
SnipSnap
0.5.2a
1.0b1
1.0b2

Vendor URL & Download:
Product Description: 
“SnipSnap is a user friendly content management system with features such as wiki and weblog. “




(2) Vulnerability Details:
Snipsnap web application has a computer security problem. Hackers can exploit it by XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. Snipsnap has patched some of them. CXSECurity is a huge collection of information on data communications safety. Its main objective is to inform about errors in various applications. It also publishes suggestions, advisories, solutions details related to XSS vulnerabilities and cyber intelligence recommendations.


(2.1) The code flaw occurs at “snipsnap-search?” page with “query” parameter.







References:
https://webtechwire.wordpress.com/2015/02/11/cve-2014-9559
Posted by at No comments:
Labels: , , , ,

CVE-2014-8490 TennisConnect COMPONENTS System XSS (Cross-Site Scripting) Security Vulnerability












CVE-2014-8490  TennisConnect COMPONENTS System XSS (Cross-Site Scripting) Web Application Zero Day Bug

Exploit Title: TennisConnect "TennisConnect COMPONENTS System" /index.cfm pid Parameter XSS
Product: TennisConnect COMPONENTS System
Vendor:    TennisConnect
Vulnerable Versions: 9.927
Tested Version:    9.927
Advisory Publication: Nov 18, 2014
Latest Update:    Nov 18, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-8490
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Advisory Details:

(1) Vendor & Product Description:


Vendor:
TennisConnect



Product & Vulnerable Versions:
TennisConnect COMPONENTS System
9.927


Vendor URL & Download:
Product can be obtained from here,
http://www.tennisconnect.com/products.cfm#Components



Product Description:
TennisConnect COMPONENTS
* Contact Manager (online player database)
* Interactive Calendar including online enrollment
* League & Ladder Management through Tencap Tennis
* Group Email (including distribution lists, player reports, unlimited sending volume and frequency)
* Multi-Administrator / security system with Page Groups
* Member Administration
* MobileBuilder
* Online Tennis Court Scheduler
* Player Matching (Find-a-Game)
* Web Site Builder (hosted web site and editing tools at www. your domain name .com)




(2) Vulnerability Details.
TennisConnect COMPONENTS System web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. TennisConnect COMPONENTS System has patched some of them. "Bugtraq is an electronic mailing list dedicated to issues about computer security. On-topic issues are new discussions about vulnerabilities, vendor security-related announcements, methods of exploitation, and how to fix them. It is a high-volume mailing list, and almost all new vulnerabilities are discussed there.". It has listed similar exploits, such as Bugtraq (Security Focus) 32920.

TennisConnect COMPONENTS System has a security problem. It is vulnerable to XSS attacks.

(2.1) The code flaw occurs at "/index.cfm?" page, with "&pid" parameter.

References:
http://packetstormsecurity.com/files/129662/TennisConnect-9.927-Cross-Site-Scripting.html
http://tetraph.com/security/cves/cve-2014-8490
https://cxsecurity.com/issue/WLB-2014120151
http://cve.scap.org.cn/CVE-2014-8490.html
http://en.hackdig.com/?11701.htm
http://webtechhut.blogspot.com/2015/02/cve-2014-8490-tennisconnect-components.html
http://seclists.org/fulldisclosure/2014/Dec/83
http://computerobsess.blogspot.com/2015/02/cve-2014-8490-tennisconnect-components.html
http://diebiyi.com/articles/security/xss-vulnerability/cve-2014-8490
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01464.html
https://progressive-comp.com/?l=full-disclosure&m=141896694615302&w=1
http://whitehatpost.blog.163.com/blog/static/2422320542015110102316210/#
http://tetraph.blogspot.com/2015/02/cve-2014-8490-tennisconnect-components.html
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1352
Posted by at No comments:
Labels: , , , , , , , , ,

CVE-2014-9558 SmartCMS Multiple SQL Injection Security Web Application Zero Day Bug




















CVE-2014-9558 SmartCMS Multiple SQL Injection Security Web Application Zero Day Bug



Exploit Title: Smartwebsites SmartCMS v.2 Multiple SQL Injection Security Vulnerabilities
Product: SmartCMS v.2
Vendor: Smartwebsites
Vulnerable Versions: v.2
Tested Version: v.2
Advisory Publication: Jan 22, 2015
Latest Update: Jan 22, 2015
Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) (CWE-89)
CVE Reference: CVE-2014-9558
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore: 6.4
Exploitability Subscore: 10.0
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service
Writer and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)






Advisory Details:



(1) Vendor & Product Description



Vendor: 
Smartwebsites




Product & Version: 
SmartCMS 
v.2




Vendor URL & Download:



Product Description:
“SmartCMS is one of the most user friendly and smart content management systems there is in the Cyprus market. It makes the content management of a webpage very easy and simple, regardless of the user's technical skills. When we designed the SmartCMS - Online Content Management System, we had you, the user, in mind. We have put ourselves in your shoes and wandered what would be like to have a simple, yet powerful system that would make the update of a website something fun to do. And here we are now! 6 years passed since the first release of SmartCMS. Now it is a popular and successful system which helps many companies become more competitive and successful online. The SmartCMS systems comes with a batch of useful tools and modules which make your online content management experience enjoyable, while increasing your productivity instantly.




SmartCMS offers you the following:
One complete solution for the content management of your website.
Professional design.
Minimal running cost.
Maximum security and scalability.
Unlimited number of pages, images and files.
Complete control over your website, without the need for specialized technical skills and without any dependencies on third party.
Support for multiple languages.
Quality and reliable professional customer support.
Improved customer service.”










(2) Vulnerability Details:
SmartCMS web application has a computer cyber security bug problem. Hacker can exploit it by SQL Injection attacks. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. SmartCMS has patched some of them. CXSECurity is a huge collection of information on data communications safety. Its main objective is to inform about errors in various applications. It also publishes suggestions, advisories, solutions details related to SQL Injection vulnerabilities and cyber intelligence recommendations.



(2.1) The first code flaw occurs at “index.php?” page with “pageid” “lang” multiple parameters.



(2.2) The second code flaw occurs at “sitemap.php?” page with “pageid” “lang” multiple parameters.






References:
http://whitehatpost.blog.163.com/blog/static/242232054201511112757529/
Posted by at No comments:
Labels: , , , ,

CVE-2014-9557 SmartCMS Multiple XSS (Cross-Site Scripting) Security Vulnerability

































CVE-2014-9557 SmartCMS Multiple XSS (Cross-Site Scripting) Web Application Zero Day Bug
Exploit Title: Smartwebsites SmartCMS v.2 Multiple XSS Security Vulnerabilities
Product: SmartCMS v.2
Vendor: Smartwebsites
Vulnerable Versions: v.2
Tested Version: v.2
Advisory Publication: Jan 22, 2015
Latest Update: Jan 22, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-9557
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore (@justqdjing)








Advisory Details:
(1) Vendor & Product Description
Vendor:
Smartwebsites

Product & Version:
SmartCMS v.2
Vendor URL & Download:
Product Description: 
“SmartCMS is one of the most user friendly and smart content management systems there is in the Cyprus market. It makes the content management of a webpage very easy and simple, regardless of the user's technical skills. When we designed the SmartCMS - Online Content Management System, we had you, the user, in mind. We have put ourselves in your shoes and wandered what would be like to have a simple, yet powerful system that would make the update of a website something fun to do. And here we are now! 6 years passed since the first release of SmartCMS. Now it is a popular and successful system which helps many companies become more competitive and successful online. The SmartCMS systems comes with a batch of useful tools and modules which make your online content management experience enjoyable, while increasing your productivity instantly.


SmartCMS offers you the following:


One complete solution for the content management of your website.
Professional design.
Minimal running cost.
Maximum security and scalability.
Unlimited number of pages, images and files.
Complete control over your website, without the need for specialized technical skills and without any dependencies on third party.
Support for multiple languages.
Quality and reliable professional customer support.
Improved customer service.”



(2) Vulnerability Details:
SmartCMS web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. SmartCMS has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".
(2.1) The first code flaw occurs at “index.php?” page with “pageid” “lang” multiple parameters.

(2.2) The second code flaw occurs at “sitemap.php?” page with “pageid” “lang” multiple parameters.







References:
http://itsecurity.lofter.com/post/1cfbf9e7_5c3a4a8
Posted by at No comments:
Labels: , , , ,

Friday, 9 January 2015

CNN出现XSS及Open Redirect安全漏洞

CNN出现XSS及Open Redirect安全漏洞



CNN (美 国有线电视新闻网络) 出现一个安全漏洞，可被XSS及Open Redirect攻击利用。受到攻击之后，CNN采取措施检测Open Redirect 漏洞。这一措施在测试阶段表现良好。CNN的网站几乎不存在易受Open Redirect攻击的链接。但网站上仍有一个Open Redirect漏洞 未被修复。CNN.com曾于2013年受到Open Redirect的攻击，于2007年受到XSS攻击。该漏洞由南洋理工大学数学系安全研究人员王 晶 (Wang Jing) 发现并报告。















该漏洞可在没有用户登录凭证的情况下被利用。作者称XSS漏洞在Ubuntu (14.04) 的Firefox (34.0) 以及Windows 7的 IE (9.0.15) 上进行了测试。Open Redirect漏洞在Windows 8的Chrome 32以及Mac OS X v10.7的 Safari 6.16上进行了测试。POC网址为https://www.youtube.com/watch?v=Cu47XiDV38M& feature=youtu.be；以及https://www.youtube.com/watch?v=FE8lhDvKGN0& feature=youtu.be。

http://khalil-shreateh.com/khalil.shtml/index.php/it-highlights/latest-vulnerabilities-and-exploits/259-cnn-cross-site-scripting-open-redirect.html
Posted by at No comments:
Labels: , , , , , , , , , , , , , , , , , , ,

Tuesday, 30 December 2014

DoubleClick do Google pode ser vulnerável a ataques

DoubleClick do Google pode ser vulnerável a ataques


Segundo o pesquisador Wang Jing, um estudante de matemática , a partir de Nanyang Technological Univeristity , Singapura, do Tetraph blog, o DoubleClick – sistema de compra e venda de anúncios do Google – estaria suscetível a ataques do tipo spam e phishing. A descoberta deixa o Google e os utilizadores/usuários do DoubleClick em alerta.





















Entenda a vulnerabilidade do DoubleClick

Em sua pesquisa, Wang Jing encontrou vulnerabilidades de Open Redirect, que permitiram que hackers redirecionassem usuários para um site malicioso, sem a necessidade de qualquer validação, ou seja, o usuário clicaria em um anúncio e ao invés de ser direcionado para o site da propaganda, seria redirecionado para um site infectado.

Jing afirmou ainda que a grande popularidade do DoubleClick faz com que os ataques a essas vulnerabilidades sejam mais comuns, em especial para spam e phishing.








Posted by at No comments:

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability













Exploit Title: “Ping Identity Corporation” “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability
Product: PingFederate 6.10.1 SP Endpoints
Vendor: Ping Identity Corporation
Vulnerable Versions: 6.10.1
Tested Version: 6.10.1
Advisory Publication: Dec 09, 2014
Latest Update: Dec 09, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8489
CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 10.0
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]








http://article.gmane.org/gmane.comp.security.fulldisclosure/1302/match=
Posted by at No comments:
Labels: , , , , , , , , , , , ,
Subscribe to: Posts (Atom)