From 47f2545a50331db066b1a92dfec8bf59455e1c38 Mon Sep 17 00:00:00 2001 From: Peter van der Laan Date: Wed, 6 Nov 2013 11:25:03 +0100 Subject: [PATCH 1/5] Update plugin_vulns.xml --- data/plugin_vulns.xml | 63 ++++++++++++++++++------------------------- 1 file changed, 26 insertions(+), 37 deletions(-) diff --git a/data/plugin_vulns.xml b/data/plugin_vulns.xml index 9293a3c9..b50bbd2f 100644 --- a/data/plugin_vulns.xml +++ b/data/plugin_vulns.xml @@ -123,8 +123,7 @@ Crayon Syntax Highlighter - Remote File Inclusion Vulnerability 50804 - http://ceriksen.com/2012/10/15/wordpress-crayon-syntax-highlighter-remote-file-inclusion-vulnerability/ - + http://ceriksen.com/2012/10/15/wordpress-crayon-syntax-highlighter-remote-file-inclusion-vulnerability/ RFI 1.13 @@ -197,9 +196,7 @@ FireStorm Professional Real Estate - Multiple SQL Injection 50873 - - http://ceriksen.com/2012/10/25/wordpress-firestorm-professional-real-estate-plugin-sql-injection-vulnerability/ - + http://ceriksen.com/2012/10/25/wordpress-firestorm-professional-real-estate-plugin-sql-injection-vulnerability/ SQLI 2.06.03 @@ -290,8 +287,7 @@ 50832 http://www.securityfocus.com/bid/57133 http://packetstormsecurity.com/files/119329/ - http://ceriksen.com/2013/01/03/wordpress-google-document-embedder-arbitrary-file-disclosure/ - + http://ceriksen.com/2013/01/03/wordpress-google-document-embedder-arbitrary-file-disclosure/ exploit/unix/webapp/wp_google_document_embedder_exec UNKNOWN @@ -551,9 +547,7 @@ Asset Manager - upload.php Arbitrary Code Execution 82653 - - http://www.ethicalhack3r.co.uk/security/wordpress-plugin-asset-manager-upload-php-arbitrary-code-execution/ - + http://www.ethicalhack3r.co.uk/security/wordpress-plugin-asset-manager-upload-php-arbitrary-code-execution/ http://packetstormsecurity.com/files/113285/ http://xforce.iss.net/xforce/xfdb/80823 @@ -676,7 +670,7 @@ powerzoomer - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20253 + http://1337day.com/exploit/20253 UPLOAD @@ -754,7 +748,7 @@ wp-3dflick-slideshow - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20255 + http://1337day.com/exploit/20255 UPLOAD @@ -840,7 +834,7 @@ wp-homepage-slideshow - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20260 + http://1337day.com/exploit/20260 UPLOAD @@ -857,7 +851,7 @@ wp-image-news-slider - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20259 + http://1337day.com/exploit/20259 UPLOAD @@ -892,7 +886,7 @@ wp-levoslideshow - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20250 + http://1337day.com/exploit/20250 UPLOAD @@ -919,7 +913,7 @@ wp-powerplaygallery - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20252 + http://1337day.com/exploit/20252 UPLOAD @@ -936,7 +930,7 @@ wp-royal-gallery - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20261 + http://1337day.com/exploit/20261 UPLOAD @@ -1022,7 +1016,7 @@ Spider Catalog - Multiple SQL Injection and Cross Site Scripting Vulnerabilities - http://www.securityfocus.com/bid/60079/info + http://www.securityfocus.com/bid/60079 MULTI @@ -1088,9 +1082,7 @@ ABtest - Directory Traversal - - http://scott-herbert.com/blog/2012/10/11/wordpress-plugin-abtest-vulnerable-to-a-directory-traversal-attack-1110 - + http://scott-herbert.com/blog/2012/10/11/wordpress-plugin-abtest-vulnerable-to-a-directory-traversal-attack-1110 UNKNOWN @@ -2387,7 +2379,7 @@ WP Cycle Playlist - Multiple Vulnerabilities - http://1337day.com/exploits/17396 + http://1337day.com/exploit/17396 MULTI @@ -2456,7 +2448,7 @@ WP-AutoYoutube <= 0.1 - Blind SQL Injection Vulnerability - http://1337day.com/exploits/17368 + http://1337day.com/exploit/17368 SQLI @@ -4591,9 +4583,7 @@ http://www.acunetix.com/blog/web-security-zone/wp-plugins-remote-code-execution/ http://wordpress.org/support/topic/pwn3d - - http://blog.sucuri.net/2013/04/update-wp-super-cache-and-w3tc-immediately-remote-code-execution-vulnerability-disclosed.html - + http://blog.sucuri.net/2013/04/update-wp-super-cache-and-w3tc-immediately-remote-code-execution-vulnerability-disclosed.html exploits/unix/webapp/php_wordpress_total_cache RCE @@ -4664,7 +4654,7 @@ ipfeuilledechou - SQL Injection Vulnerability http://www.exploit4arab.com/exploits/377 - http://1337day.com/exploits/20206 + http://1337day.com/exploit/20206 SQLI @@ -4771,7 +4761,7 @@ Developer Formatter - CSRF and XSS Vulnerability http://illsecure.com/code/Wordpress-DevFormatter-CSRF-Vulnerability.txt - http://1337day.com/exploits/20210 + http://1337day.com/exploit/20210 51912 MULTI @@ -5299,7 +5289,7 @@ wp-explorer-gallery - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20251 + http://1337day.com/exploit/20251 UPLOAD @@ -5309,7 +5299,7 @@ accordion - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20254 + http://1337day.com/exploit/20254 UPLOAD @@ -5319,7 +5309,7 @@ wp-catpro - Arbitrary File Upload Vulnerability - http://www.1337day.com/exploit/20256 + http://1337day.com/exploit/20256 UPLOAD @@ -5372,7 +5362,7 @@ p1m media manager - SQL Injection Vulnerability - http://www.1337day.com/exploit/20270 + http://1337day.com/exploit/20270 SQLI @@ -5412,7 +5402,7 @@ ForumConverter - SQL Injection Vulnerability - http://www.1337day.com/exploit/20275 + http://1337day.com/exploit/20275 SQLI @@ -5422,7 +5412,7 @@ Newsletter - SQL Injection Vulnerability - http://www.1337day.com/exploit/20287 + http://1337day.com/exploit/20287 SQLI @@ -5542,7 +5532,7 @@ Google Alert And Twitter 3.1.5 - XSS Exploit, SQL Injection - http://1337day.com/exploits/20433 + http://1337day.com/exploit/20433 MULTI @@ -5962,8 +5952,7 @@ WP-Banners-Lite - XSS vulnerability http://seclists.org/fulldisclosure/2013/Mar/209 - http://threatpost.com/en_us/blogs/xss-flaw-wordpress-plugin-allows-injection-malicious-code-032513 - + http://threatpost.com/en_us/blogs/xss-flaw-wordpress-plugin-allows-injection-malicious-code-032513 XSS From 39724afc8140a7ca144a879efd4bbf8d01f62d3a Mon Sep 17 00:00:00 2001 From: Peter van der Laan Date: Wed, 6 Nov 2013 12:37:15 +0100 Subject: [PATCH 2/5] Update plugin_vulns.xml --- data/plugin_vulns.xml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/data/plugin_vulns.xml b/data/plugin_vulns.xml index b50bbd2f..ea5be5ef 100644 --- a/data/plugin_vulns.xml +++ b/data/plugin_vulns.xml @@ -5,7 +5,7 @@ - Content Slide <=1.4.2 - Cross Site Requst Forgery Vulnerability + Content Slide <= 1.4.2 - Cross Site Requst Forgery Vulnerability 93871 2013-2708 @@ -151,7 +151,7 @@ - Thank You Counter Button <=1.8.2 - XSS + Thank You Counter Button <= 1.8.2 - XSS 50977 @@ -162,7 +162,7 @@ - Bookings <=1.8.2 - XSS + Bookings <= 1.8.2 - XSS 50975 @@ -173,7 +173,7 @@ - Cimy User Manager <=1.4.2 - Arbitrary File Disclosure + Cimy User Manager <= 1.4.2 - Arbitrary File Disclosure 50834 http://ceriksen.com/2012/10/24/wordpress-cimy-user-manager-arbitrary-file-disclosure/ @@ -205,7 +205,7 @@ - WP125 <=1.4.4 - Multiple XSS + WP125 <= 1.4.4 - Multiple XSS 50976 @@ -213,7 +213,7 @@ 1.4.5 - WP125 <=1.4.9 - CSRF + WP125 <= 1.4.9 - CSRF 92113 2013-2700 @@ -1687,7 +1687,7 @@ - WP Property <=1.35.0 - Arbitrary File Upload + WP Property <= 1.35.0 - Arbitrary File Upload 18987 23651 @@ -2731,7 +2731,7 @@ - Is-human <=1.4.2 - Remote Command Execution Vulnerability + Is-human <= 1.4.2 - Remote Command Execution Vulnerability 17299 @@ -6333,7 +6333,7 @@ - WP Print Friendly <=0.5.2 - Security Bypass Vulnerability + WP Print Friendly <= 0.5.2 - Security Bypass Vulnerability 93243 53371 From b6cc3400e84da2227868da56471643b9c759b232 Mon Sep 17 00:00:00 2001 From: Peter van der Laan Date: Wed, 6 Nov 2013 13:15:16 +0100 Subject: [PATCH 3/5] Update theme_vulns.xml --- data/theme_vulns.xml | 82 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/data/theme_vulns.xml b/data/theme_vulns.xml index 27591241..94c6e3d9 100644 --- a/data/theme_vulns.xml +++ b/data/theme_vulns.xml @@ -1827,6 +1827,7 @@ 98927 29068 http://www.securityfocus.com/bid/63306 + http://1337day.com/exploit/21442 http://themeforest.net/item/area53-a-responsive-html5-wordpress-theme/2538737 RCE @@ -1903,6 +1904,7 @@ Saico - Arbitrary File Upload Vulnerability 29150 + http://1337day.com/exploit/21440 UPLOAD @@ -1928,4 +1930,84 @@ + + + Anthology - Remote File Upload Vulnerability + + http://1337day.com/exploit/21460 + + UPLOAD + + + + + + Amoveo - Arbitrary File Upload Vulnerability + + http://1337day.com/exploit/21451 + + UPLOAD + + + + + + Switchblade - Arbitrary File Upload Vulnerability + + http://1337day.com/exploit/21457 + + UPLOAD + + + + + + Magnitudo - Arbitrary File Upload Vulnerability + + http://1337day.com/exploit/21457 + + UPLOAD + + + + + + Ghost - Arbitrary File Upload Vulnerability + + http://1337day.com/exploit/21416 + + UPLOAD + + + + + + Right Now - Arbitrary File Upload Vulnerability + + http://1337day.com/exploit/21420 + + UPLOAD + + + + + + Cold Fusion - Arbitrary File Upload Vulnerability + + http://1337day.com/exploit/21431 + + UPLOAD + + + + + + Chameleon - Arbitrary File Upload Vulnerability + + http://1337day.com/exploit/21449 + + UPLOAD + + + From 5e6efb4cb7b4364a2b5d7acf05f14fde192defc5 Mon Sep 17 00:00:00 2001 From: Peter van der Laan Date: Wed, 6 Nov 2013 15:05:37 +0100 Subject: [PATCH 4/5] Update output.rb --- lib/common/models/wp_version/output.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/common/models/wp_version/output.rb b/lib/common/models/wp_version/output.rb index e9965a32..27a8a0a0 100644 --- a/lib/common/models/wp_version/output.rb +++ b/lib/common/models/wp_version/output.rb @@ -10,7 +10,7 @@ class WpVersion < WpItem unless vulnerabilities.empty? puts - puts red('[!]') + " We have identified #{vulnerabilities.size} vulnerabilities from the version number:" + puts red('[!]') + " Identified #{vulnerabilities.size} vulnerabilities from the version number:" vulnerabilities.output end From 843f783a7a543a6f93201b9649c0e5a7651ddf58 Mon Sep 17 00:00:00 2001 From: Peter van der Laan Date: Wed, 6 Nov 2013 20:12:25 +0100 Subject: [PATCH 5/5] Update output.rb --- lib/common/models/wp_version/output.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/common/models/wp_version/output.rb b/lib/common/models/wp_version/output.rb index 27a8a0a0..1154a295 100644 --- a/lib/common/models/wp_version/output.rb +++ b/lib/common/models/wp_version/output.rb @@ -10,7 +10,7 @@ class WpVersion < WpItem unless vulnerabilities.empty? puts - puts red('[!]') + " Identified #{vulnerabilities.size} vulnerabilities from the version number:" + puts red('[!]') + " #{vulnerabilities.size} vulnerabilities identified from the version number:" vulnerabilities.output end