Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: December 22, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 119 Members: 0 Total: 119 Full disclosure CyberDanube Security Research 20241219-0 | Authenticated Remote Code Execution in Ewon Flexy 205 Stored XSS with Filter Bypass - blogenginev3.3.8 [SYSS-2024-085]: Broadcom CA Client Automation - Improper Privilege Management (CWE-269) [KIS-2024-07] GFI Kerio Control <= 9.4.5 Multiple HTTP Response Splitting Vulnerabilities RansomLordNG - anti-ransomware exploit tool APPLE-SA-12-11-2024-9 Safari 18.2 APPLE-SA-12-11-2024-8 visionOS 2.2 APPLE-SA-12-11-2024-7 tvOS 18.2 APPLE-SA-12-11-2024-6 watchOS 11.2 APPLE-SA-12-11-2024-5 macOS Ventura 13.7.2 APPLE-SA-12-11-2024-4 macOS Sonoma 14.7.2 APPLE-SA-12-11-2024-3 macOS Sequoia 15.2 APPLE-SA-12-11-2024-2 iPadOS 17.7.3 APPLE-SA-12-11-2024-1 iOS 18.2 and iPadOS 18.2 SEC Consult SA-20241211-0 :: Reflected Cross-Site Scripting in Numerix License Server Administration System Login IT Security and Insecurity Portal www.waraxe.us Forum Index -> PhpBB -> 2 new Vulnerabilities 2.0.17 Goto page 1, 2Next View previous topic :: View next topic 2 new Vulnerabilities 2.0.17 Posted: Mon Oct 31, 2005 8:53 pm WaterBird Active user Joined: May 16, 2005 Posts: 37 PHPBB Multiple Unspecified Vulnerabilities 2005-10-31 http://www.securityfocus.com/bid/15246 PHPBB Global Variable Deregistration Bypass Vulnerabilities 2005-10-31 http://www.securityfocus.com/bid/15243 Posted: Mon Oct 31, 2005 11:21 pm chapinhack Beginner Joined: Nov 01, 2005 Posts: 1 how to operate this bug? some examples? Posted: Tue Nov 01, 2005 1:00 am shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 Read it properly chapinhack Quote: phpBB is prone to multiple unspecified vulnerabilities. Some of these issues result from insufficient sanitization of user-supplied data, however, the causes and impacts of other issues were not specified. phpBB 2.0.17 and prior versions are affected by these issues. Due to a lack of information, further details cannot be provided at the moment. It is possible that some of these issues were reported prior to the release of this record. This BID will be updated when more information becomes available. _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Tue Nov 01, 2005 6:34 am g30rg3_x Active user Joined: Jan 23, 2005 Posts: 31 Location: OutSide Of The PE i think most of this "fixes" just make for improvemmed... as now i just see some and they are just for performarce, i didn't see at all because it is a large list... but if i found one, i would make a full description... grettings from mexico Last edited by g30rg3_x on Tue Nov 01, 2005 3:45 pm; edited 1 time in total Posted: Tue Nov 01, 2005 7:03 am shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 Not just that but there was a way to by pass the register globals disabling in the phpBB script. _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Tue Nov 01, 2005 3:43 pm g30rg3_x Active user Joined: Jan 23, 2005 Posts: 31 Location: OutSide Of The PE yeah but is still hard for bypass register_globals but we can make a just little code for PoC... grettings shai-tan Posted: Tue Nov 01, 2005 4:49 pm shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 Not as hard as you might think. Quote: Bypass Vulnerabilities ---------------------- [1] In PHP5 <= 5.0.5 it is possible to register f.e. the global variable $foobar by supplying a GET/POST/COOKIE variable with the name 'foobar' but also by supplying a GPC variable called 'GLOBALS[foobar]'. If the variable is supplied in that way, the code above will not try to unset $foobar, but $GLOBALS, which completely bypasses the protection. [2] When the session extension is not started by a call to session_start(), PHP does not know about the variables $_SESSION or $HTTP_SESSION_VARS, which means, it is possible to fill them with any value if register_globals is turned on. Combined with the fact (that was even documented in the phpBB code), that array_merge() will fail in PHP5, when at least one of the parameters is not an array, it is possible for an attacker to simply set HTTP_SESSION_VARS to a string and let the complete protection fail, because $input ends up empty. [3] When register_long_array is turned off PHP does not know anymore about all the HTTP_* variables. This means they can be filled with anything that is completely unrelated to the existing global variables. It is obvious that the protection cannot work, when this configuration is choosen. Additonally to the 3 possible ways to bypass the globals deregistration code, several not properly initalised variables were disclosed to the vendor, that can even lead to remote code execution. And once you have done so this is the options you can look at. Quote: Not properly initialised variables ---------------------------------- [1] Within usercp_register.php the variable 'error_msg' is not properly initialised and can therefore be used to inject arbitrary HTML code [2] Within login.php the variable 'forward_page' is not properly initialised and can be used to inject arbitrary HTML code [3] Within search.php the variable 'list_cat' is not properly initialised and can be used to inject arbitrary HTML [4] Within usercp_register.php the variable 'signature_bbcode_uid' is not properly initialised and can be used for SQL injection of arbitrary 'field=xxx' statements into queries operating on the user table, when magic_quotes_gpc is turned off. [5] The same variable [4] can be used to inject f.e. the 'e' modifier into the first parameter of a preg_replace() statement, which means, that the second parameter is evaluated as PHP code. Because the second parameter is entirely filled with the user supplied signature, it is possible to execute any PHP code. This can be exploited, no matter if magic_quotes_gpc is turned on or off, just 2 different code paths need to be triggered. Glad to see you again g30rg3_x. _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Tue Nov 01, 2005 7:49 pm Tomanas Active user Joined: Jan 30, 2005 Posts: 29 ok, i read whole document and i still don't know how to exploit that bug Posted: Wed Nov 02, 2005 1:15 am g30rg3_x Active user Joined: Jan 23, 2005 Posts: 31 Location: OutSide Of The PE Thank you shai-tan... with this i think i can make a little PoC grettings Last edited by g30rg3_x on Thu Nov 03, 2005 2:50 pm; edited 1 time in total Posted: Wed Nov 02, 2005 2:17 am shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 http://www.hardened-php.net/advisory_172005.75.html No problem. _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Wed Nov 02, 2005 10:44 pm WaterBird Active user Joined: May 16, 2005 Posts: 37 as always waiting for an exploit Posted: Thu Nov 03, 2005 12:48 am shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 Best and most satisfying is learning how to make them your-self. And then making them Shai-tan _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Thu Nov 03, 2005 2:48 am WaterBird Active user Joined: May 16, 2005 Posts: 37 shai-tan wrote: Best and most satisfying is learning how to make them your-self. And then making them Shai-tan Don't have mutch time to do that Work etc :} Maybe some day :] Posted: Thu Nov 03, 2005 3:07 am shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 lolz it seems time is everones reason! lolz _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Thu Nov 03, 2005 2:49 pm g30rg3_x Active user Joined: Jan 23, 2005 Posts: 31 Location: OutSide Of The PE like everybody i dont have really much time... but i'm researching for exploit or well know in IT Security as Proof-Of-Concept, obviously i dont have enought time to do that rapidly... so, like shai-tan says its very satisfying learning how to make by your-seld, than just wait for a new exploit/PoC and just used for be just another "deface kiddie or script kiddie"... grettings from mexico shai-tan && waterbird 2 new Vulnerabilities 2.0.17 www.waraxe.us Forum Index -> PhpBB You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 2 Goto page 1, 2Next All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.044 Seconds