full-disclosure - Re: Vulnerabilities in DS-Syndicate for Joomla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <005801cafd12$9376b730$010000c0@ml>
Date: Wed, 26 May 2010 23:31:35 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: "Benji" <me@...ji.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerabilities in DS-Syndicate for Joomla

Hello Benji!

It's good that you are drawing attention to my advisories, but very often
your letters are unequal and not serious. So I've put you in my blacklist. I
already wrote recommendation for people to the list, to use your time
wisely. And because you can't do it by yourself (as it clear), I'll help
you. I hope now you'll become using your time more wisely.

> so you've moved from discovering leet xss vulnerabilities

I'm discovering any vulnerabilities which I meet during my researchers. I
have no prejudice for any of classes from WASC TC v1/v2. If you have some
problems with XSS or any other class of vulnerabilities, it's your own
problems (as I already mentioned to the list concerning moaning about XSS).

> to publishing old exploits?

I don't think it's old. While there are web sites with this vulnerability,
it'll be not old and actual. I found these vulnerabilities in 2009 at one
web site (and after my announce in 2010 I checked it on other web sites),
so that time were sites with these holes, and now there are sites with them.

And in my second advisory about DS-Syndicate, which I have published even
before you wrote me your letter, I wrote about new vulnerabilities which I
recently found in this plugin. So if you were looking for some fresh holes,
you could easily found them.

> I would offer you a sec. job, but unfortunately I think you're too
> qualified.

Thanks for offer :-). But I don't need offers from not serious people 
(including you).

Also note that from my side, I'd never offer you a security job, because I
need only serious employee. It's my main criterion for all kind of job,
including security job.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

----- Original Message ----- 
From: Benji
To: MustLive
Cc: full-disclosure@...ts.grok.org.uk
Sent: Sunday, May 23, 2010 1:55 PM
Subject: Re: [Full-disclosure] Vulnerabilities in DS-Syndicate for Joomla

oh cool, so you've moved from discovering leet xss vulnerabilities to
publishing old exploits?

I would offer you a sec. job, but unfortunately I think you're too
qualified.

On Sat, May 22, 2010 at 4:09 PM, MustLive <mustlive@...security.com.ua>
wrote:

Hello Full-Disclosure!

I want to warn you about security vulnerabilities in plugin DS-Syndicate for
Joomla.

-----------------------------
Advisory: Vulnerabilities in DS-Syndicate for Joomla
-----------------------------
URL: http://websecurity.com.ua/4003/
-----------------------------
Affected products: all versions of DS-Syndicate for Joomla.
-----------------------------
Timeline:

16.08.2009 - found vulnerabilities.
04.03.2010 - announced at my site. And after making of announcement of these
vulnerabilities, I found that already in 2008 this SQLi vulnerability was
found by boom3rang (before I found it in 2009). Which disclosed exploit for
it at milw0rm.com (http://www.milw0rm.com/exploits/6792). So boom3rang first
found SQLi, and I first found Full path disclosure in this plugin.
09.03.2010 - informed developer (and at developer's site I found that he'd
no more support of this plugin, after his site on Joomla was hacked).
21.05.2010 - disclosed at my site.
-----------------------------
Details:

These are SQL Injection and Full path disclosure vulnerabilities.

SQL Injection:

http://site/index2.php?option=ds-syndicate&version=1&feed_id=-1%20or%20version()=5

Full path disclosure:

http://site/index2.php?option=ds-syndicate&version=1&feed_id=

Note, that developer of the plugin don't support it anymore, so users of the
plugin need to fix it by themselves.

Just after disclosure of these vulnerabilities, I also found new
vulnerabilities in DS-Syndicate which I wrote about in separate advisory.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/