YGN Ethical Hacker Group Blog

1. OVERVIEW The zFTP server is found to be vulnerable to denial of service in handling STAT and CWD commands with overly large buffer requests. 2. BACKGROUND The zFTP server is a Windows based FTP server with focus on clever Active Directory integration and powerful, effortless administration. 3. VERSIONS AFFECTED 2011-04-13 and earlier 4. PROOF-OF-CONCEPT/EXPLOIT http://www.exploit-db.com/exploits/18028/ 5. SOLUTION The vendor has released the patched version ( http://download.zftpserver.com/zFTPServer_Suite_Setup.exe ) 6. VENDOR Vastgota-Data 7. CREDIT This vulnerability was discovered by Myo Soe, http://yehg.net, YGN Ethical Hacker Group, Myanmar. 8. DISCLOSURE TIME-LINE 2011-06-19: notified vendor through email 2011-10-17: vendor released fixed version, 2011-10-17 2011-10-25: vulnerability disclosed 9. REFERENCES Original Advisory URL: http://core.yehg.net/lab/pr0js/advisories/[zftpserver_2011-04-13]_stat,cwd_dos zFTP Server Home Page:...

How do attackers try to know PHP version if the server has disabled "X-Powered-By" header (i.e expose_php = Off)?  The vTiger CRM has a flaw that allows attackers to know exact PHP version without authentication.  Attacker can know it by simply visiting the following url without authentication.  /phpversionfail.php  The message shows: "PHP 5.0.x or above is required. Your current PHP version is 5.3 Kindly upgrade the PHP installation, any try again! " Version Affected: Tested on vTiger CRM 5.2.1 

1. OVERVIEW The vTiger CRM 5.2.1 and lower versions are vulnerable to Blind SQL Injection. No fixed version has been released as of 2011-10-05. 2. BACKGROUND vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support. vtiger CRM is a widely used product with thousands of users in dozens of countries. It has a vibrant community of users driving the product forward, and contributing to it's development. Over 2 million copies of vtiger CRM have been downloaded so far. It was launched as a fork of version 1.0 of the SugarCRM project launched on December 31st, 2004. 3. VULNERABILITY DESCRIPTION The "onlyforuser" parameter was not properly sanitized, which allows attacker to conduct Blind SQL Injection Attack. This could an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosur...

1. OVERVIEW The vTiger CRM 5.2.1 and lower versions are vulnerable to Remote Code Execution. No fixed version has been released as of 2011-10-05. 2. BACKGROUND vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support. vtiger CRM is a widely used product with thousands of users in dozens of countries. It has a vibrant community of users driving the product forward, and contributing to it's development. Over 2 million copies of vtiger CRM have been downloaded so far. It was launched as a fork of version 1.0 of the SugarCRM project launched on December 31st, 2004. 3. VULNERABILITY DESCRIPTION vTiger uses the vulnerable version of phpmailer class file located at /cron/class.phpmailer.php . 4. VERSIONS AFFECTED Tested on 5.2.1 5. PROOF-OF-CONCEPT/EXPLOIT File: /cron/class.phpmailer.php [code] 391: function SendmailSend($header, $bo...

1. OVERVIEW The vTiger CRM 5.2.1 and lower versions are vulnerable to Cross Site Scripting. No fixed version has been released as of 2011-10-04. 2. BACKGROUND vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support. vtiger CRM is a widely used product with thousands of users in dozens of countries. It has a vibrant community of users driving the product forward, and contributing to it's development. Over 2 million copies of vtiger CRM have been downloaded so far. It was launched as a fork of version 1.0 of the SugarCRM project launched on December 31st, 2004. 3. VULNERABILITY DESCRIPTION Multiple parameters were not properly sanitized, which allows attacker to conduct Cross Site Scripting attack. This may allow an attacker to create a specially crafted URL that would execute arbitrary script code in a victim's browser. 4. VERSION...