lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <1158080639.28021.9.camel@linuxraid.site>
Date: Tue, 12 Sep 2006 21:03:59 +0400
From: Alex <alex@...ln.com>
To: bugtraq@...urityfocus.com
Subject: [eVuln] NX5Linkx Multiple Vulnerabilities

New eVuln Advisory:
NX5Linkx Multiple Vulnerabilities
http://evuln.com/vulns/138/summary.html

--------------------Summary----------------
eVuln ID: EV0138
CVE: CVE-2006-4503 CVE-2006-4504 CVE-2006-4505
Vendor: NX5
Vendor's Web Site: http://nx5ware.nx5.org/
Software: NX5Linkx
Sowtware's Web Site: http://nx5ware.nx5.org/links.php
Versions: 1.0
Critical Level: Dangerous
Type: Multiple Vulnerabilities
Class: Remote
Status: Unpatched. No reply from developer(s)
PoC/Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

-----------------Description---------------
1. Arbitrary file disclosure Vulnerability 

Vulnerable script: link.php 

Parameter logo is not properly sanitized. It used as full local path to
logo filename. Script do the copy of this file in logos directory. This
directory is available from the web. 
This can be used to read arbitrary files. 


2. Multiple SQL Injections. 

Vulnerable scripts: The name of those scripts are defined by webmaster.
First - (a) displays links list. Second - (b) "out" script which do the
redirections when someone clicks on link 

Parameters c(script "a"), l(script "b") are not properly sanitized
before being used in SQL query. This can be used to make any SQL query
or make a HTTP response-splitting attack by injecting arbitrary SQL
code. 

Condition: magic_quotes_gpc = off 


3. HTTP Response Splitting. 

Vulnerable Script: link.php 

Parameter url is not properly sanitized. This can be used to make HTTP
Response Splitting attack. 



--------------PoC/Exploit----------------------
Available at: http://evuln.com/vulns/138/exploit.html

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)


Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ