Login or Register ::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  :: February 8, 2012 Menu  Home  Logout  Discussions  Forums  Members List  IRC chat  Tools  Base64 coder  MD5 hash  CRC32 checksum  ROT13 coder  SHA-1 hash  URL-decoder  Sql Char Encoder  Affiliates  Error solutions  y3dips ITsec  Md5 Cracker  plain-text.info  Game Reviews  User Manuals  AlbumNow  Content  Content  Sections  FAQ  Top  Info  Feedback  Recommend Us  Search  Journal  Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: Nicholas New Today: 2 New Yesterday: 3 Overall: 7982 People Online: Visitors: 247 Members: 3 Total: 250 Online Now: 01: mehdox - Forums 02: Mullog - Forums 03: ZiPo - Homepage milw0rm ·[webapps / 0day] - Tube Ace(Adult PHP Tube Script) SQL Injection ·[webapps / 0day] - GAzie <= 5.20 Cross Site Request Forgery ·[dos / poc] - Edraw Diagram Component 5 ActiveX buffer overflow DoS ·[dos / poc] - PHP 5.4.0RC6 64bit Denial of Service ·[dos / poc] - PHP 5.4SVN-2012-02-03 htmlspecialchars/entities Buffer Overflow ·[dos / poc] - torrent-stats httpd.c Denial of Service ·[remote exploits] - Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Execute ·[remote exploits] - Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57 ·[dos / poc] - NetSarang Xlpd Printer Daemon 4 Denial of Service Vulnerability ·[dos / poc] - OfficeSIP Server 3.1 Denial Of Service Vulnerability read more... PacketStorm News ·Debian Security Advisory 2384-2 ·Secunia Security Advisory 47843 ·Secunia Security Advisory 47856 ·Secunia Security Advisory 47859 ·Secunia Security Advisory 47851 ·Secunia Security Advisory 47806 ·Secunia Security Advisory 47846 ·Secunia Security Advisory 47817 ·Secunia Security Advisory 47813 ·Secunia Security Advisory 47847 read more... IT Security and Insecurity Portal www.waraxe.us Forum Index -> XMB forum -> Sql injection and global variables poison in XMB Forum 1.9.1    View previous topic :: View next topic  Sql injection and global variables poison in XMB Forum 1.9.1 Posted: Tue Aug 09, 2005 8:00 pm Heintz Valuable expert   Joined: Jun 12, 2004 Posts: 88 Location: Estonia/Sweden http://www.securityfocus.com/archive/1/407701/30/0/threaded Vendor notified at and partial patch: http://forums.xmbforum.com/viewthread.php?tid=754523 firstly the input validation at xmb.php: foreach ($global as $num => $array) { if (is_array($array)) { extract($array, EXTR_OVERWRITE); } } this should put to not overwrite any variables cause it overwrite server set variables too. this creates problems when user submits a additional field in form: <input type="text" name="_SERVER[REMOTE_ADDR]" value="555.555.555.555"> secondly there is a case of sql injection in include/u2u.inc.php line ~491: Code: $in = ''; foreach ( $u2u_select as $value ) { if ( $GLOBALS['type'.$value] != 'outgoing' ) { $in .= ( empty( $in ) ) ? "$value" : ",$value"; } } ... $db->query( "UPDATE $table_u2u SET readstatus='no' WHERE u2uid IN($in) AND owner='$self[username]'" ); the variable $in is not actually validated and could and will cause problems if not fixed. Greets #rainbowcrack and http://www.waraxe.us thought i disclose an old issue, sorry for greets being short, but i didnt think it was a very big thing to greet about at the moment _________________ AT 14:00 /EVERY:1 DHTTP /oindex.php www.waraxe.us:80 | FIND "SA#037" 1>Nul 2>&1 & IF ERRORLEVEL 0 "c:program filesApache.exe stop & DSAY alarmaaa!" Posted: Wed Aug 10, 2005 9:47 am waraxe Site admin   Joined: May 11, 2004 Posts: 2390 Location: Estonia, Tartu Congrats, Heintz. Nice work! Posted: Wed Sep 07, 2005 10:07 pm Twist Regular user   Joined: Jul 22, 2005 Posts: 6 so how and what do i do, using this to take over someones forum... Posted: Sat Sep 10, 2005 6:07 am slimjim100 Valuable expert   Joined: Jun 09, 2004 Posts: 208 Location: USA Great Work Heintz! Plain-Text.info loves you _________________ www.anti-hacker.info Posted: Sun Jan 25, 2009 10:44 pm miqrogroove Beginner   Joined: Jan 26, 2009 Posts: 2 Hello and thank you all for this information. I was given the opportunity to take over XMB development last year. Fixing this bug was one of my first official acts. I could not find the original notification about this bug, so I have forwarded the original link to the new CVE vendor statement. I will personally handle any new security notices for XMB. You are welcome to re-test the new versions 1.9.10 and 1.9.11. Enjoy Posted: Sun Jan 25, 2009 11:10 pm waraxe Site admin   Joined: May 11, 2004 Posts: 2390 Location: Estonia, Tartu OK, XMB will be in my TODO list Sql injection and global variables poison in XMB Forum 1.9.1   www.waraxe.us Forum Index -> XMB forum You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT   Page 1 of 1   All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 Year Oldest FirstNewest First  Select a forum Security Research by waraxe----------------General discussionHow to fixMetasploit related Hash cracking requests----------------MD5 hashesAll other hashesHash related information http://www.waraxe.us portal----------------SuggestionsCooperation proposals Security bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holes Various software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107FullxmlMamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo Gallery Programming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssembler Reverse engineering----------------Newbies cornerDisassemblingPHP script decode requests Miscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy database Direct Downloads----------------ToolsTutorialsWordlists Recycle Bin----------------Removed messagesOutdated posts   Powered by phpBB © 2001-2008 phpBB Group

All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2010 Janek Vind "waraxe"

Page Generation: 0.145 Seconds