Acunetix Standard & Premium

New feature

• Added a new option to export results to HTTP Fuzzer

New Security Checks

• Test for XML External Entity Injection
• Test for XML Injection

Improvements

• Improved directory traversal vulnerability check
• Improved Cross-site Scripting (XSS) vulnerability checks

Bug Fixes

• Fixed: access violation when the application exists
• Fixed: access violation when protocol was terminated in NotifyCaller function in LSR
• Fixed: AbortVulnXML OnFirstAlert was not imported from settings
• Fixed: Form values were not encoded correctly when submitted from JavaScript (CSA engine)

New security checks

• 8.3 DOS filename source code disclosure
• Apache Tomcat Directory Host Appbase authentication bypass vulnerability
• Apache Tomcat WAR File directory traversal vulnerability
• Apache stronghold-info enabled
• Apache stronghold-status enabled
• ColdFusion 9 Solr Service exposed
• Error page path disclosure
• Error page web server version disclosure
• File inclusion RFI list
• Checks for multiple vulnerabilities in XAMPP
• Server-Side Includes (SSI) injection on Unix
• Server-Side Includes (SSI) injection on Windows
• ASP.NET error messages when requesting URL like |.aspx

Improvements

• Added more variants to FCKeditor arbitrary file upload
• Updated cross site scripting in path security checks
• Updated directory listing security checks
• Updated directory traversal on Unix security checks
• Updated file upload security checks
• Updated LDAP injection security checks
• Updated possible sensitive files security checks
• Updated XPath injection security checks

Bug Fixes

• Workaround for window.open used with NULL parameter
• Notify elements that they are unbidden
• Notify form if an input was removed
• Include select element values in submitted data
• Fixed: HttpProt was sending content length with CONNECT
• Fixed: Crawler didn’t consider post data for links from CSA engine; some where ignored
• Fixed: Login sequence recorder was sending requests synchronously

New security checks

• JBoss BSHDeployer MBean
• JBoss checks from RedTeam’s paper
• JBoss HttpAdaptor JMXInvokerServlet
• JBoss Server MBean
• JBoss ServerInfo MBean
• JBoss Web Console JMX Invoker
• phpShop v0.8.1 Multiple Vulnerabilities
• Invision Power Board <= v3.0.4 Local PHP File Inclusion and SQL Injection

Improvements

• Improved Blind SQL injection tests to reduce false positives
• Added better JBoss server detection
• Better detection for Postgre SQL injections

Bug Fixes

• Fixed: GUI crashes when specific settings are changed in the Port Scanner node
• Fixed: Login Sequence recorder was retaining post data when redirecting to the same page

New

• New security checks of AcuSensor Technology
  • curl_exec() url is controlled by user
  • PHP preg_replace used on user input
  • PHP super-globals-overwrite
  • PHP unseriazlie used on user input
• Other new security checks of Acunetix WVS
  • osCommerce authentication bypass
  • Apache Tomcat insecure default administrative password
  • Apache Tomcat directory traversal
  • Checks for PHP invalid data type error messages
  • Check for possible remote SWF inclusion
  • Added further checks for possible sensitive files; general tests per server
  • Added further checks for possible sensitive directories; general tests per server
  • Added a new security check for SQL injection in the authentication header (basic authentication, base64 encoded)
  • Added AlertIfTextNotFound group parameter to invert search and issue an alert if a specified text is not found

Improvements

• Renamed Weak password module to Authentication module since now it includes much more authentication security checks
• Improved Cross-site scripting in URI checks to include Ruby on rails security checks
• Improved Application errors security checks
• Introduced 3 new setting parameters for the crawler in Settings.XML file:
  • 262144
  • 256
  • 1000

Bug Fixes

• Fixed: false positives issued in weak password alert
• Fixed: WSDL importer crash when importing recursive complex elements
• Fixed: Crawler proxy request handling changed to decode the input name/value
• Fixed Vulnerability Editor to show group parameters with default values if no VulnXML template is used
• Changed HTTP_Anomalies to log PHP errors and save the results in a file (instead of alerts)Changed HTTP_Anomalies to log PHP errors and save the results in a file instead of alerts
• Hidden VulnXML properties for alerts that are not using vulnxml default template in Vulnerability Editor
• Adjusted VulnXML to reduce the number of false positives for Blind SQL injection timing tests
• Updated CSA engine; delete the BOM characters from script sources
• Updated URL_Helper; UrlEncode/Decode modified not to use str := str + ch and to validate hex characters after %
• Updated File_Inputs; possible values are limited in size now