----------------------------------------------------------------------

Hardcore Disassembler / Reverse Engineer

Reversing must be a passion as your skills will be challenged
on a daily basis and you will be working several hours
everyday in IDA, Ollydbg, and with BinDiff. Often, it is also
required that you write a PoC or even a working exploit to
prove that an issue is exploitable.

http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Pivot Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA20962

VERIFY ADVISORY:
http://secunia.com/advisories/20962/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Cross Site Scripting, System access

WHERE:
>From remote

SOFTWARE:
Pivot 1.x
http://secunia.com/product/3583/

DESCRIPTION:
rgod has discovered some vulnerabilities in Pivot, which can be
exploited by malicious users to bypass certain security restrictions
and compromise a vulnerable system, and by malicious people to
conduct cross-site scripting attacks.

1) Due to improper access controls, a malicious user can upload
arbitrary files with multiple extensions to the "images" directory
via includes/editor/insert_image.php.

Successful exploitation may allow execution of script code depending
on the HTTP server configuration (e.g. requires Apache server with
the "mod_mime" module installed).

2) Input passed to various parameters in multiple scripts is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

Examples:
http://[host]/pivot/includes/blogroll.php?fg=[code]
http://[host]/pivot/includes/blogroll.php?line1=[code]
http://[host]/pivot/includes/blogroll.php?line2=[code]
http://[host]/pivot/includes/blogroll.php?bg=[code]
http://[host]/pivot/includes/blogroll.php?c1=[code]
http://[host]/pivot/includes/blogroll.php?c2=[code]
http://[host]/pivot/includes/blogroll.php?c3=[code]
http://[host]/pivot/includes/blogroll.php?c4=[code]
http://[host]/pivot/includes/editor/edit_menu.php?name=[code]
http://[host]/pivot/includes/editor/edit_menu.php?js_name=[code]
http://[host]/pivot/includes/photo.php?h=[code]
http://[host]/pivot/includes/photo.php?w=[code]

Successful exploitation of the majority of the issues requires that
"register_globals" is enabled.

The vulnerabilities have been confirmed in version 1.24.3 and also
reported in version 1.30 RC2. Other versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised and
grant only trusted users access to the application.

PROVIDED AND/OR DISCOVERED BY:
rgod

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------