[Openvas-commits] r2826 - in trunk/openvas-plugins: . scripts
scm-commit@wald.intevation.org
scm-commit at wald.intevation.org
Wed Mar 18 10:43:47 CET 2009
Author: mime
Date: 2009-03-18 10:43:43 +0100 (Wed, 18 Mar 2009)
New Revision: 2826
Added:
trunk/openvas-plugins/scripts/Beerwins_PhpLinkAdmin_1_0.nasl
Modified:
trunk/openvas-plugins/ChangeLog
trunk/openvas-plugins/scripts/chipmunk_forum_xss.nasl
trunk/openvas-plugins/scripts/mldonkey_2_9_7_remote.nasl
trunk/openvas-plugins/scripts/zeroblog_xss.nasl
Log:
Bug fixes, Added new plugin
Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog 2009-03-18 09:34:31 UTC (rev 2825)
+++ trunk/openvas-plugins/ChangeLog 2009-03-18 09:43:43 UTC (rev 2826)
@@ -1,3 +1,14 @@
+2008-03-18 Michael Meyer <mime at gmx.de>
+ * scripts/chipmunk_forum_xss.nasl
+ scripts/zeroblog_xss.nasl:
+ Fix error "Too many args for function 'get_kb_item'"
+
+ * scripts/mldonkey_2_9_7_remote.nasl:
+ Need header in buf
+
+ * scripts/Beerwins_PhpLinkAdmin_1_0.nasl:
+ Added new plugin
+
2008-03-18 Chandrashekhar B <bchandra at secpod.com>
* extra/lsc_generator/LSCGenerator.py,
extra/lsc_generator/test/sanity_test.py,
Added: trunk/openvas-plugins/scripts/Beerwins_PhpLinkAdmin_1_0.nasl
===================================================================
--- trunk/openvas-plugins/scripts/Beerwins_PhpLinkAdmin_1_0.nasl 2009-03-18 09:34:31 UTC (rev 2825)
+++ trunk/openvas-plugins/scripts/Beerwins_PhpLinkAdmin_1_0.nasl 2009-03-18 09:43:43 UTC (rev 2826)
@@ -0,0 +1,91 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id: bugs_online_sql_injection.nasl 130 2009-03-15 14:10:21Z mime $
+#
+# Beerwin's PhpLinkAdmin Remote File Include and Multiple SQL
+# Injection Vulnerabilities
+#
+# Authors:
+# Michael Meyer
+#
+# Copyright:
+# Copyright (c) 2009 Michael Meyer
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if (description)
+{
+ script_id(100058);
+ script_bugtraq_id(34129);
+ script_version ("1.0");
+
+ script_name(english:"Beerwin's PhpLinkAdmin Remote File Include and Multiple SQL Injection Vulnerabilities");
+ desc["english"] = "
+
+ Overview:
+ Beerwin's PhpLinkAdmin is prone to multiple input-validation
+ vulnerabilities, including a remote file-include issue and multiple
+ SQL-injection issues.
+
+ A successful exploit may allow an attacker to execute malicious code
+ within the context of the webserver process, compromise the
+ application, access or modify data, or exploit latent
+ vulnerabilities in the underlying database.
+
+ Beerwin's PhpLinkAdmin 1.0 is vulnerable; other versions may also be
+ affected.
+
+ See also:
+ http://www.securityfocus.com/bid/34129
+
+ Risk factor : Medium";
+
+ script_description(english:desc["english"]);
+ script_summary(english:"Determine if Beerwin's PhpLinkAdmin is vulnerable to SQL Injection and Remote File Include");
+ script_category(ACT_GATHER_INFO);
+ script_family(english:"Web application abuses");
+ script_copyright(english:"This script is Copyright (C) 2009 Michael Meyer");
+ script_dependencie("find_service.nes", "http_version.nasl");
+ script_require_ports("Services/www", 80);
+ script_exclude_keys("Settings/disable_cgi_scanning");
+ exit(0);
+}
+
+include("http_func.inc");
+include("http_keepalive.inc");
+
+port = get_http_port(default:80);
+
+if(!get_port_state(port))exit(0);
+if(!can_host_php(port:port))exit(0);
+
+
+dir = make_list("/phplinkadmin",cgi_dirs());
+foreach d (dir)
+{
+ url = string(d, "//edlink.php?linkid=-1%27%20union%20all%20select%201,2,3,4,0x4f70656e5641532d53514c2d496e6a656374696f6e2d54657374%27--");
+ req = http_get(item:url, port:port);
+ buf = http_keepalive_send_recv(port:port, data:req, bodyonly:1);
+ if( buf == NULL )continue;
+
+ if(
+ egrep(pattern: "OpenVAS-SQL-Injection-Test", string: buf)
+ )
+ {
+ security_warning(port:port);
+ exit(0);
+ }
+}
+exit(0);
Modified: trunk/openvas-plugins/scripts/chipmunk_forum_xss.nasl
===================================================================
--- trunk/openvas-plugins/scripts/chipmunk_forum_xss.nasl 2009-03-18 09:34:31 UTC (rev 2825)
+++ trunk/openvas-plugins/scripts/chipmunk_forum_xss.nasl 2009-03-18 09:43:43 UTC (rev 2826)
@@ -63,7 +63,7 @@
port = get_http_port(default:80);
if (!get_port_state(port)) exit(0);
if (!can_host_php(port:port)) exit(0);
-if (get_kb_item("www/", port, "/generic_xss")) exit(0);
+if (get_kb_item(string("www/", port, "/generic_xss"))) exit(0);
xss = "'</a><IFRAME SRC=javascript:alert(%27XSS%20DETECTED%20BY%20NESSUS%27)></IFRAME>";
exss = urlencode(str:xss);
Modified: trunk/openvas-plugins/scripts/mldonkey_2_9_7_remote.nasl
===================================================================
--- trunk/openvas-plugins/scripts/mldonkey_2_9_7_remote.nasl 2009-03-18 09:34:31 UTC (rev 2825)
+++ trunk/openvas-plugins/scripts/mldonkey_2_9_7_remote.nasl 2009-03-18 09:43:43 UTC (rev 2826)
@@ -79,11 +79,10 @@
if(isnull(port))exit(0);
req = http_get(item:string("//etc/passwd"), port:port);
- buf = http_keepalive_send_recv(port:port, data:req, bodyonly:TRUE);
+ buf = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);
if(buf == NULL )exit(0);
if( egrep(pattern:"root:.*:0:[01]:.*", string: buf) ) {
-
security_warning(port:port,data:desc["english"]);
exit(0);
@@ -94,7 +93,6 @@
if(isnull(version) || version >< "unknown")exit(0);
if(version <= "2.9.7") {
-
info = string("Medium\n\nAccording to its version number (");
info += version;
info += string(") MLDonkey is\nvulnerable, but seems to be reject connections from ");
Modified: trunk/openvas-plugins/scripts/zeroblog_xss.nasl
===================================================================
--- trunk/openvas-plugins/scripts/zeroblog_xss.nasl 2009-03-18 09:34:31 UTC (rev 2825)
+++ trunk/openvas-plugins/scripts/zeroblog_xss.nasl 2009-03-18 09:43:43 UTC (rev 2826)
@@ -60,7 +60,7 @@
port = get_http_port(default:80);
if (!get_port_state(port)) exit(0);
if (!can_host_php(port:port)) exit(0);
-if (get_kb_item("www/", port, "/generic_xss")) exit(0);
+if (get_kb_item(string("www/", port, "/generic_xss"))) exit(0);
xss = "'<IFRAME SRC=javascript:alert(%27XSS DETECTED BY NESSUS%27)></IFRAME>";
exss = urlencode(str:xss);
More information about the Openvas-commits
mailing list