Video: Bypassing phpNuke 8.x Referer Check Anti-CSRF Defense
[View Online | Download]
Description: This demo proves that simply validating hostname in HTTP Referer, a widely deployed quick anti-csrf defense, can easily be bypassed.
Jcow CMS 4.x:4.2 <= , 5.x:5.2 <= | Arbitrary Code Execution
1. OVERVIEW
Jcow CMS versions (4.x: 4.2 and lower, 5.x: 5.2 and lower) are vulnerable to Arbitrary Code Execution.
2. BACKGROUND
Jcow is a flexible Social Networking software written in PHP. It can help you to build a social network for your interests and passions, a member community for your existing website and a social networking site like facebook/myspace/twitter.
3. VULNERABILITY DESCRIPTION
The parameter "attachment" is not properly sanitized upon submission to /index.php, which allows attacker to execute arbitrary PHP code of his own.
4. VERSIONS AFFECTED
Free version: 4.x: 4.2 and lower
Commercial version: 5.x: 5.2 and lower)
5. PROOF-OF-CONCEPT/EXPLOIT
http://dev.metasploit.com/redmine/attachments/1660/jcow_eval.rb
jcow 4.2.1:
file: /includes/libs/ss.inc.php
line: 167
$app = $_POST['attachment'];
if (strlen($app) && $app != 'status') {
include_once('modules/'.$app.&#