Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		07.04.2009
Source:
SecurityVulns ID:		9798
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Power Phlogger: information leakage, protection bypass, unauthorized access.

Affected:		POWERPHLOGGER : Power Phlogger 2.2
		FAMILYCMS : Family Connections 1.8
		IGNITE : Realtime Openfire 3.6
		JOOMLA : com_bookjoomlas Joomla Component 0.1
		VBULLETIN : vBulletin 3.8
		AMAYA : Amaya 11.1
CVE:		CVE-2009-0497 (Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the log parameter.)
		CVE-2009-0496 (Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) log parameter to (a) logviewer.jsp and (b) log.jsp; (2) search parameter to (c) group-summary.jsp; (3) username parameter to (d) user-properties.jsp; (4) logDir, (5) maxTotalSize, (6) maxFileSize, (7) maxDays, and (8) logTimeout parameters to (e) audit-policy.jsp; (9) propName parameter to (f) server-properties.jsp; and the (10) roomconfig_roomname and (11) roomconfig_roomdesc parameters to (g) muc-room-edit-form.jsp. NOTE: this can be leveraged for arbitrary code execution by using XSS to upload a malicious plugin.)
		CVE-2008-6511 (Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter.)
		CVE-2008-6510 (Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the url parameter.)
		CVE-2008-6509 (SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp.)
		CVE-2008-6508 (Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.)

Original document		MustLive, New vulnerabilities in Power Phlogger (07.04.2009)
		dontcontactorspamme_(at)_aria-security.com, Amaya 11.1 XHTML Parser Buffer Overflow (07.04.2009)
		dontcontactorspamme_(at)_aria-security.com, [Aria-Security.com] vBulletin multiple XSS (07.04.2009)
		Salvatore "drosophila" Fresta, Joomla Component com_bookjoomlas SQL Injection Vulnerability (07.04.2009)
		Salvatore "drosophila" Fresta, Family Connections 1.8.2 Blind SQL Injection (Correct Version) (07.04.2009)
		GENTOO, [ GLSA 200904-01 ] Openfire: Multiple vulnerabilities (07.04.2009)

Files:		Amaya 11.1 XHTML Parser Buffer Overflow POC
		Family Connection <= 1.8.2 - Remote Command Execution
Discuss:		Read or add your comments to this news (0 comments)