RedTeam Discovers CSRF in PHPWCMS
RedTeam Discovers Cross Site Request Forgery vulnerability in PHPWCMS
Jeremiah Talamantes, Principal Security Consultant and Security Researcher at RedTeam, has discovered a cross-site request forgery vulnerability in PHPWCMS version 1.4.5. The security vulnerability in the open source content management system revolves around a lack of security controls around input validation.
The CSRF vulnerability in PHPWCMS could be exploited to conduct cross-site request forgery attacks. This issue is caused due to input validation errors in the administrative interface when processing HTTP requests, which could be exploited by attac...
RedTeam Discovers CSRF in FrogCMS
RedTeam Discovers Cross Site Request Forgery vulnerability in Frog CMS
Jeremiah Talamantes, Principal Security Consultant and Security Researcher at RedTeam, has discovered a cross-site request forgery vulnerability in FrogCMS version 0.9.5. The security vulnerability in the open source content management system revolves around a lack of security controls that check for CSRF attempts. An attacker can execute a CSRF attack by enticing an authenticated user to visit a malicious website (via phishing attack) causing the default header Snippet to be overwritten with arbitrary code.
Jeremiah has developed proof of concept code ...
RedTeam Labs Awarded CVE-2010-2028
We are pleased to announce that a vulnerability discovered by RedTeam Labs was awarded a CVE just recently (CVE-2010-2028). We feel that not only does this demonstrate the security expertise of our team, but it also demonstrates our commitment to contributing to the security community through research.
As further contribution to the security community, we've ported the proof of concept code to the Metasploit framework. Click here for the Metasploit proof of concept code.
About CVE
The Common Vulnerabilities and Exposures or CVE system pr...
RedTeam in @RISK Bulletin by SANS
This weekend we were pleased to see three of four security vulnerabilities that RedTeam security researcher (Jeremiah Talamantes) discovered this month were published in the @RISK Security Bulletin by SANS and Qualys. The vulnerabilities included:
* TYPSoft DELE Command DoS
* File Thingie File Security Bypass
* SmallFTPD RETR Command DoS
Thank you SANS and Qualys!
About @RISK
@RISK is the SANS community's consensus bulletin summarizing the most important vulnerabilities and exploits identified during the past week and providing guidance on appropriate actions to protect your syste...
RedTeam Discovers XSS in FileThingie
RedTeam Security Discovers XSS Vulnerability in File Thing Web-based File Manager.
Jeremiah Talamantes, Principal Security Consultant and Security Researcher at RedTeam, has discovered a security vulnerability in File Thingie version 2.5.5. File Thingie, a web-based file management application in PHP, is prone to an XSS (cross site scripting) vulnerability. An attacker can exploit this vulnerability resulting in a possible theft of cookie information, among other possibilities.
This security vulnerability has been published by Security Focus, SecurityReason, Packet Storm Security and other online databases.
...
Categories
Contact Us
Phone number:
1-612-234-7848
E-mail: